{ "Event": { "published": true, "date": "2025-12-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-29", "timestamp": 1767052982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d5d13a40-9969-40a7-8a9b-f82e5bbd97aa", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6e369d-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969555, "uuid": "4cd5fdcf-3c28-49e2-82bf-294d5d7ebd51", "comment": "Malware payload (Mirai)", "value": "c4c710735c90663859b3a0acafdb8821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969555, "uuid": "ff3b0809-0e5f-45bf-a7e3-3b03ff1fb859", "comment": "Malware payload (Mirai)", "value": "0097b4eb4e94c6f8a56aa200f916c4ae1aa42659e21679e41d76142db1a68d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969555, "uuid": "327a08fc-54be-4917-a5c7-6df8a7b07e31", "comment": "Malware payload (Mirai)", "value": "344b8d531a751c508d805efbbaa6ee15cb37d7f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969555, "uuid": "ab2503c4-22aa-40b1-9d57-de84dfe2e1db", "comment": "Malware payload (Mirai)", "value": "007427f2276c549c86a3e67d611d0b701fa96bce727b6769cb980f2b43d80284d9ea3395f6944fd007b1e819c5e75501", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969555, "uuid": "abfcf399-b830-4687-9f55-5e37f71ba927", "value": "T1A2D3AED7724B4821C46106F05BD3CF8E3FA36212CE0BC9E72E0DA67B28795DB5946792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969555, "uuid": "abec4389-06bf-4f52-a496-2d54935e8591", "value": "1536:N4VqP+N6Gb6MqZ0xcYn1QulTm3BSbNmv6YlocNMVLKxGlb4gInN/LWS:e8GN6GOM3X1QgqqI6Y3NMVLqgInNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969555, "uuid": "c0b466b4-4e90-400c-9028-e26834686224", "value": 132492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969555, "uuid": "40276f27-d520-463d-bda6-8ad7c764faa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969555, "uuid": "4d6ba513-266c-43ba-9b69-429f75f04350", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837f84c2-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989247, "uuid": "1ac6391e-29b2-47f3-8356-e8510e81b527", "comment": "Malware payload (Mirai)", "value": "00dacc90f823d6aa063216d21e0c2c31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989247, "uuid": "b5cfae8a-45ad-4ad0-aa8e-fc8cd53f9b1f", "comment": "Malware payload (Mirai)", "value": "010115a6c5b9d0e44b40878dd61acfb75dc4e92dce96e9d91c9516b988e353e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989247, "uuid": "f853df3f-1c95-4fd8-98ed-83d653592e7a", "comment": "Malware payload (Mirai)", "value": "95d5ed5299a26281f6fa55f5e3cbad4d79eb142e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989247, "uuid": "b138de2b-e1ee-4f9c-8bda-9fd168571d73", "comment": "Malware payload (Mirai)", "value": "9e16972b2537bc732a26e33f5d64e03c5d54426892647f27218b36dc07a8b425712f66881132f706376d2fc458c2f46a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989247, "uuid": "4904924c-b7f1-4561-8033-375ce3509b1e", "value": "T112B33893F400DD7FF84AC7360683CB35B53173A65BB30662B642A53BB9383A45D26E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989247, "uuid": "328f5064-a2f5-4d3b-a87e-b5e51424f25e", "value": "3072:ScJmbvjB2pSanwN1FrhQhn5kNv6RCpW340li:SeKIS67kZ6D3Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989247, "uuid": "7b5cf1df-eb6f-4ce5-88d6-9e1621c1907f", "value": 112116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989247, "uuid": "d1eb2e32-9135-4bfd-99f4-2326fe813672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989247, "uuid": "336ee726-4fd2-4223-b9d9-f492054de4f8", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9bd644-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1767029745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029745, "uuid": "b082e108-40da-4e1f-9db9-c4a47e455b4d", "comment": "Malware payload (GoToResolve)", "value": "bc2359b290025a49b69bd57c1281ad17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029745, "uuid": "332dc18d-7695-4a19-93ec-7d974095492d", "comment": "Malware payload (GoToResolve)", "value": "015f742cf3741281b2bc833fb0c1b6db3745ad8b5b881e4f243ba727259ed5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029745, "uuid": "622a6c53-4ed7-4770-b0ee-afeddc77e4f6", "comment": "Malware payload (GoToResolve)", "value": "19419057691465d007b172756e28101859595faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029745, "uuid": "d1ff82ca-6894-4ea1-ac6f-1c02b5739c50", "comment": "Malware payload (GoToResolve)", "value": "137113472038604cd95417260b16a63477a253be1e49e7a82425d9c608b478d4819131bb21292cc0dda1d46098ac615d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029745, "uuid": "bd018d1a-b916-4148-a5e5-6db8b332745e", "value": "T1CC3733217159D071D89111B1A9289FBBD2AEA8344BA60DDBB3EC5F2D9B301C33736D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029745, "uuid": "06881568-470a-489e-97c7-ddb8c1b3b9b5", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029745, "uuid": "50747aac-47fe-48cf-80f2-4915cd57eee7", "value": "393216:F8QVLTc3XQ/P2M4fBNssphLGmFINm4Y/kiCngsvba6beOBL2jk2WhyMwU+gBz5B:GQVLw3An2nBSsTiwImki6ba6NRqkPhyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029745, "uuid": "fd19455e-9654-4078-aac9-b3c40fc738db", "value": 24464352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029745, "uuid": "306df26b-ef92-4dc6-993b-cba7a6731cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029745, "uuid": "6bb4551e-78ee-4cc4-828b-688f80533292", "value": "OpenThisInviteeee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deed15f8-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967066, "uuid": "0988425a-f5d9-45f0-aad3-898174cb0e67", "comment": "Malware payload (Mirai)", "value": "2697d118a757f8b91396e56dadd3c9ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967066, "uuid": "007d9e20-6a7e-47ff-8c12-2268aa8c644c", "comment": "Malware payload (Mirai)", "value": "01c3e2d5d9caa029dd4435145c9fa3896de2806ae3599c7a77b0ea06bb425dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967066, "uuid": "8c64a43d-be1e-498e-a39c-c6cf965c6677", "comment": "Malware payload (Mirai)", "value": "9d0345d65894c6d6048dbf861634bf80d737c1b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967066, "uuid": "da702a99-e7ba-43b8-9970-ab206f962c5b", "comment": "Malware payload (Mirai)", "value": "bb69ba5fd26e391f4475d2cc0bbbecb80df88be05f81a8880c0f26ef8cedd029ba0831835ff12a5c4643a63970fb48b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967066, "uuid": "3816f5f9-fce3-4c15-b74b-cbd6b04fac5c", "value": "T198A35C22B8791D2BC4D4A43A21F34331F1F6574A21A8CA2B7E710D8EFF64B502257BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967066, "uuid": "cbfa9bad-95b8-465a-884f-d62834440285", "value": "1536:6TZSyH7Scn5sZxhi/ZeEpp11uRRn/e1JjOgM+tICY65IKwxkVthQepchYh:og1SCZiRPpmwJa+6CYKPAepXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967066, "uuid": "0ea72101-a458-4f4b-b10f-83d71ff47856", "value": 99512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967066, "uuid": "b3572850-c4f8-4247-89e7-8e288a1d29b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967066, "uuid": "6163e0eb-6f77-4143-9e47-181d72ed061d", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54e039c-e480-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766990216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990216, "uuid": "53bc5f1f-51a6-4df6-b2b9-748e6b4c0151", "comment": "Malware payload (Mirai)", "value": "205c547406f389e578a93447dcfc9af8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990216, "uuid": "a0450f4f-2a41-4963-b314-c2a13145ddb8", "comment": "Malware payload (Mirai)", "value": "01dae467a1fc4554e8b639eb8ba3665fb9bc2de5800b30494553890bcd013cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990216, "uuid": "4b6dedab-b6e4-4e22-b63e-19f50370ed12", "comment": "Malware payload (Mirai)", "value": "3480f852b906de16474efeafdb5e8ee78e23fe20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990216, "uuid": "7cb718dd-b66c-454f-b959-b9fde0a858fa", "comment": "Malware payload (Mirai)", "value": "15948efc2f45911e8131d0373cfecf3500f15f957772d5f5d922439d2857af45aa07b1f9197e36543928a73fc9178478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990216, "uuid": "ca7b3b13-c46b-4399-a04f-8579e4a0993f", "value": "T155E3520EA9219F2FF22CC33547F7C961B36523D723E7E64AD25CD5201E6438A582BB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990216, "uuid": "d0791980-334a-49ed-b0f2-0c5cd55ed623", "value": "3072:WJ082DFuK4+Gai345dlOmFWJ5CtswPGVo:z82JuKaz3GlZErtVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766990216, "uuid": "0f4f1769-4d0e-4fb6-bde5-700481722698", "value": 146988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766990216, "uuid": "c9b8a9d6-fd15-45f7-b4b4-2e55a77cd4c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990216, "uuid": "2495424b-a624-4abe-9f15-7b3a8e4c04a1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d69f48-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031316, "uuid": "cedae1e3-af8d-4047-b49c-33f8381486da", "comment": "Malware payload (Mirai)", "value": "2bb8331d1815a280f746c19b8d149cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031316, "uuid": "6a894922-f24f-4b67-a5f3-863c3c64afa8", "comment": "Malware payload (Mirai)", "value": "02a27a465b8de39aad8442b5fb7c7495b531508c6ba887fb9a4c2402f53e907d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031316, "uuid": "68bf7f4a-ef40-48ad-96b6-4dfa17da9e94", "comment": "Malware payload (Mirai)", "value": "ea074165ff8f1d194b528349b71b4bdebc75cf9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031316, "uuid": "903f6b61-da83-4ea3-850f-6ac82d724f29", "comment": "Malware payload (Mirai)", "value": "21f4f43b19bf18d71933263c035e7d98fce5909b2388c336ea587de1eddbeda70eb7d4f95c0cc5cadf55582ac977f94a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031316, "uuid": "2dce50ed-3c17-4f7e-a6ff-ffe09e8c0e61", "value": "T1D0D38DCBB38BE950C4600BF047C79B9E2A632215CE57C5E72E1A15BA397D5CF1909BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031316, "uuid": "62bc3745-6382-473e-91e7-42b7f4e0d574", "value": "3072:5kl7Sz6lr0McHqAPzeQbbRtZTaozEfVeHgNnd5q:Ol+6m7vxC91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031316, "uuid": "19353f56-4bfb-4c95-ba08-ac9fb19217a7", "value": 140656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031316, "uuid": "903760d0-a00c-4116-a2c5-bd15289ae7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031316, "uuid": "9312ad51-d8d6-426c-a985-c6e357fc623a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7479414-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016472, "uuid": "b1e28165-5d49-4f0d-89d8-dc45be820a69", "comment": "Malware payload (Mirai)", "value": "222bab01518bd66d3a9363e98bf8082b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016472, "uuid": "83833e3d-20c0-4533-a2c2-d98fb3e51a7f", "comment": "Malware payload (Mirai)", "value": "02cc74be9e124b3ddd4450dc8e5f78fb25086888e005325deb851f399c20c067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016472, "uuid": "fb29766c-2011-494c-a813-711260fe9cfa", "comment": "Malware payload (Mirai)", "value": "23ddd7b603a93c7de2acfd8a4c7a0db83f725b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016472, "uuid": "00068980-222d-44f8-9dfb-39d926e1e866", "comment": "Malware payload (Mirai)", "value": "108405720fa1686b5f6c2d5d7ce58da7f7b0af8657eb56c3942244c68fc8534c025d2dc284aef4f070caf6200b410d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016472, "uuid": "12d9b028-1588-4b1a-9ef3-605d0397f458", "value": "T109833B45BC819A12C6D5627BFB5E42CC332653A8D2EF3207DD25AF15778B82B0E7B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016472, "uuid": "c7ec39c2-ccc4-4433-a645-f4ade9bc99cb", "value": "1536:EfL+EnNptab4x4SAU5XfMtxH2P8+C1nZUYHn+U+uQ7R/N:EfL+I4n/H2PwZUgJ+uQJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016472, "uuid": "72d7c987-1e18-4a83-8d8e-24e835009759", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016472, "uuid": "ce330616-4b81-4b86-8fa6-1b04aad01f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016472, "uuid": "2dc2d0ea-f58f-4825-a757-290ae63cd853", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc360827-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027245, "uuid": "de264374-462b-47bf-97bc-72da35ab9ddb", "comment": "Malware payload (Mirai)", "value": "149d3d1e47813ec227947925b9209982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027245, "uuid": "7ca1b406-2115-4071-bd4d-665b5ab7bb0a", "comment": "Malware payload (Mirai)", "value": "034c2cd2ac8f565fbc9d7fa616fbfc6dcdd983a2dc30a8627dc27ecbb005ed41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027245, "uuid": "e91573d9-9fb1-48a1-b27a-f5dd5b207ebb", "comment": "Malware payload (Mirai)", "value": "f3c603a7fcbea5ea8015d2376b3478272ed866c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027245, "uuid": "a50d39ed-c708-4c60-a82d-0749799694a7", "comment": "Malware payload (Mirai)", "value": "d5751353d4720c3ff77d649552bdae179d052667c5928a2344c3efdb79e376bf31c7e1ba165f41b1f18e7522003a7e19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027245, "uuid": "0bdf89ed-269a-4bfd-9623-a874bb6bfd5b", "value": "T1AE63F749BC819F15D4E822BEFA1E018D33676768E3EF7212DD105B15778A92F0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027245, "uuid": "c4bac694-0c24-4abb-999c-2858dc73728f", "value": "1536:qZn+y0+hfQ1DcOzxtssk7+lDO2l5ecEym9dlpriU/JT6zgu:B6fRYx+H7+lDzl5ecEbd/JUgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027245, "uuid": "41d5140a-e48b-4634-8f1b-50218d578d37", "value": 72908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027245, "uuid": "31c44206-f3be-47d3-898d-994490a9520f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027245, "uuid": "41e6e83a-1374-4510-b94d-6070f8d5610a", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547b828e-e458-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972847, "uuid": "5774693f-7752-4ce2-8383-7c77e5f6ecc6", "comment": "Malware payload (Mirai)", "value": "c81f81ee6a89c6f92e1d9153d45b2852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972847, "uuid": "528b72f4-3ee6-4a92-869e-fda3c1a24aa7", "comment": "Malware payload (Mirai)", "value": "03b8e6148a14e5943161349abd2518c430d9206e196d4d7cba3da8379cda5350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972847, "uuid": "a8c1e486-ba90-4837-87f0-3e8f57f43319", "comment": "Malware payload (Mirai)", "value": "91c79b8959ef83e64de7688789a9a5348990ab3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972847, "uuid": "ef9cc984-2837-42de-ba9f-d1d2df077d6f", "comment": "Malware payload (Mirai)", "value": "6c8861b9015454f93b1d5ffcc9b44e188a15c4f7dbf55b7a22e6e3c700142e9785111d26f345b62aaf8d760aa2544d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972847, "uuid": "c02bb828-5549-4b71-ad7d-3e2c2b1d10cf", "value": "T15CC32902F88580FCC08AC130177FA93B9936F2DD5238B6EB77D4AF127D4AE515A1DA94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972847, "uuid": "9da58728-4d30-4899-9e75-e78cfc8e19be", "value": "3072:ZJDAonCNu8NeNEQuBSObv9z6a9IBHGjTOqs1iwapdxWCFf+:ZdAonCNu8NeNEQuBpbv9z6a9I9GeXEzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972847, "uuid": "1162bf04-7160-4681-8424-860e90e70ffa", "value": 120816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972847, "uuid": "0d436083-dea3-4afc-8adf-17623b615b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972847, "uuid": "82ced0fc-7832-44d0-b163-86c2b0cf2f17", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d5735-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051294, "uuid": "a995f1dd-687e-4187-a4b2-c3ab4a1df0c0", "comment": "Malware payload (Mirai)", "value": "f10058bbf74cb8a9c91ab8420bcd5f1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051294, "uuid": "00088526-de51-422a-b739-33922d6e0d36", "comment": "Malware payload (Mirai)", "value": "049084cd56b2f3e1422b98834e2a0ea84528b2836e5733c81fe976a3599933c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051294, "uuid": "d1de29c2-2b11-46fc-8b85-db7d06daf0dd", "comment": "Malware payload (Mirai)", "value": "d42ee66f6bf767cba88de1a6b4919ee135154b76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051294, "uuid": "f8507db2-bbea-4858-bb54-cf13be9f0c9e", "comment": "Malware payload (Mirai)", "value": "28ca95a97e4ab1c3795ccab15648cf14dc5fc0ec4d8234da495a68717280b4d3e9742ad54911f018954b31ff503335c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051294, "uuid": "56feabc4-7f1e-4c93-ad19-2308121fdf03", "value": "T188630214EC763045CB92E6FC1A8A86707B482B84775F44CFA1A59E3947137DC3E8F9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051294, "uuid": "6fafcfd2-e9d4-4eef-830b-7244ce1e1d96", "value": "1536:f8pniEGLXz/QgoM/BFiMJOJcYuPYVQLnGfld0/50f7ysDew6YE2E4u+qgw09a:f8pq0mY/JcYQYSG9ddf7yDYE2E4u+qge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051294, "uuid": "28e743a9-3b4b-417c-bd10-1e3ddd9a48c4", "value": 68508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051294, "uuid": "ff80a0b8-d65a-4569-8aac-cc79c57a5897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051294, "uuid": "4be23792-c142-4951-8ae9-fc46f6912b5a", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abd13f8-e4d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767024263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024263, "uuid": "246dc01f-a420-4004-99c0-020b15ded95f", "comment": "Malware payload (Braodo)", "value": "be2dc667c2a6283177a925ae94298643", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024263, "uuid": "e82787f0-7adb-45e6-951b-f6438da9a81b", "comment": "Malware payload (Braodo)", "value": "05527965d2e4af174710298457ba56c449d575aa2937971a6fa785f9a75fdea9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024263, "uuid": "15066117-b0b0-4cea-a0c1-a78c42b69e18", "comment": "Malware payload (Braodo)", "value": "b8cdd115b40a7199a93a910ce16a0dc6017c77b5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024263, "uuid": "a59656f4-fd49-4a53-8bed-66c2a50812fd", "comment": "Malware payload (Braodo)", "value": "1f157b0da01519528e9754e62873d8c66754ebee0ce38498cbc77f35f803ebedb3cf6287e9190439a5a34fd693491b5c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024263, "uuid": "9f6d621d-bc98-4024-be33-d4ca2ffe0de7", "value": "T13A0522A41ACDFF9FAA044685647CDC05BF24B8D0483EB6A9131CADA1FBF3D15CD29198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024263, "uuid": "43b76b65-a214-4092-aede-35d2abf001ba", "value": "12288:BPIAcheS19/t5+aoOWVTF2NxtwiCi7+wtXkfWmZgCrKb6G4MNG+QKmu1XxWM8r7y:Bw9heSf0F2NIiUwtUeI+b63+Qo8MWedp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767024263, "uuid": "87373fb2-ce32-4bac-a414-522b50f7d305", "value": 861922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767024263, "uuid": "283fa1b2-646c-4e1f-a79b-ebce1ebe6e1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024263, "uuid": "2e509272-8421-45af-ab48-f7d66c4e0f5f", "value": "Company_Event_Gift_Boxes.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c3ca60-e487-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1766993245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993245, "uuid": "7d87433f-d1c8-4d04-ae0d-5119d3c62e5d", "comment": "Malware payload (STRRAT)", "value": "3c10477f28195eb07d41bd38c955f09c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993245, "uuid": "9023208d-aa8d-420d-b80f-e52259bf44b8", "comment": "Malware payload (STRRAT)", "value": "058b59a73d4d8d0d71aeccb74779a21bb487acccffe6838c2e0a23f1082e902e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993245, "uuid": "7cc83d53-eac7-4af6-aa70-401db1b24abc", "comment": "Malware payload (STRRAT)", "value": "f5dee177cd6fb32afe909d042cca1a0900fc2823", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993245, "uuid": "933d42ab-aab5-4ffa-ac31-c4fc1a8bafa4", "comment": "Malware payload (STRRAT)", "value": "7be8ddc31823d9758eda208ef9e8b2c74fb628f58b3585664fda065f41146199ebdc7777fa7cdec54b48298a6de80867", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993245, "uuid": "e786d976-3b07-4d50-b776-7ff14da44f48", "value": "T15624CF903EC19879F263A1F2484A9345E471D4AFC259B1970FE1BC2FEC5AC653E0EB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993245, "uuid": "2d038ab5-bda0-4df3-a518-cab4624e4810", "value": "6144:Rqa5wj2on4+d6iqUCXyUIC3SJJySg/tcQ2fNA+Ocst:h2D4KBCpIQB2Odcst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993245, "uuid": "454ac04d-1fe8-4aa5-9569-7d0339ddc69f", "value": 211930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993245, "uuid": "93b3f0d5-50bd-49c7-a085-ed8167e5bbe1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993245, "uuid": "e0320058-9b92-4d53-b9a2-535cc532610e", "value": "TEKLIF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c26dd1-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030744, "uuid": "472ee4d3-8ea3-476e-8a43-efa4fe7ddba6", "comment": "Malware payload (Mirai)", "value": "8e493a6f0473d142231f019e01dd5104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030744, "uuid": "7ec2fa65-fcf0-4d39-90db-9f5ad146042d", "comment": "Malware payload (Mirai)", "value": "0593794f247984f80cc935d910bc9412dddfdc1d555b68da53425039bf679b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030744, "uuid": "a736f964-fe90-46f7-a8cc-344ba461d296", "comment": "Malware payload (Mirai)", "value": "2402638e49785e578306f1c10e0cc9f5c079e2fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030744, "uuid": "bc9ae5ce-4208-4cd0-8f9f-bf42e1713d3a", "comment": "Malware payload (Mirai)", "value": "f067612d123e05c9e3ebc389d8960ca6a61081beaa63e613149c909650921b2eb0b14ba3993a6179b2dd7b5d5cf3e4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030744, "uuid": "517442cf-db74-4c7a-bb18-c572d6f9cbd7", "value": "T149144BC7F801EDBDF80BE7774413490AB530B7A254934A37725BBD67AC390A90927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030744, "uuid": "a74ad805-cb44-47ff-8afb-d3a9de0c33ee", "value": "3072:/yRyio41PEzvP/rRCKZEZzvGRicoyF7RTZ0cZ9QHBUxYnfZvoVGjbiZL743muh/M:aLo4elWVByFdTZbZGH3fZvWL8WE0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030744, "uuid": "2ddd3cd5-fb22-40f4-a43e-5feb2ffcdd17", "value": 205952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030744, "uuid": "2b2521bd-c02f-4898-b5e5-f708c90e0fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030744, "uuid": "329c0783-bc0d-43d6-92e4-fb722c73c1a0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf031f6-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995438, "uuid": "2551d47b-a4ca-4dba-bbc4-6898a775a0a3", "comment": "Malware payload (XWorm)", "value": "69d0687c57faf3cd6740ef3273658349", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995438, "uuid": "dd2a192c-f6dd-49f6-ac07-899d51c56a6b", "comment": "Malware payload (XWorm)", "value": "05ea1e7a46d4948c5d7a5f80f6263fb1f2cbfb6ad8cdf47224f2dd76540eea2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995438, "uuid": "de4dae57-1fa4-4e9c-bed7-1c769084825e", "comment": "Malware payload (XWorm)", "value": "fc8072cc3081c03133268b016258e86980994062", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995438, "uuid": "b5dc4960-11f1-437a-8c7f-c98eedb47c78", "comment": "Malware payload (XWorm)", "value": "3405f33197cb86e3ac77f179407e8133233281b3bdb7acbc207258da1b32ac9e4f3d37598d5164dc78f6395f65836e7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995438, "uuid": "656a83a5-48d9-442f-a04d-86ecf8fa6ee0", "value": "T14D6329F10F0EADDF016CB55B877A915C04BCBF1149DB662BBA6B2825B41912FB2031E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995438, "uuid": "1c06fbeb-95d4-4997-8988-755acddb706e", "value": "768:I8w/h62/jWs6oS+xISN0v/H9uEUdkfScBYrwz2y8kTAlGB:I9l/AoSSMUtusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995438, "uuid": "a0ef7e7d-b783-4ece-aeef-2cac0a145d07", "value": 69588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995438, "uuid": "fe257984-d18f-4042-b529-af9ae56976b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995438, "uuid": "e6553139-0c53-40c6-bcf8-905982993cd3", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1b1aee-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966738, "uuid": "14913301-dfd4-4075-ac32-54b35f67d932", "comment": "Malware payload (Mirai)", "value": "68156e8a9119c627623eaca0b0671e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966738, "uuid": "11b5bc11-e793-4acd-9d23-46b4359aad18", "comment": "Malware payload (Mirai)", "value": "06bc54246800a99e30cd1c47dd4d8badc4e503c332ad42e9b88a9d5c78e82c7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966738, "uuid": "a973da23-8e39-4efd-9466-2cf37cd47926", "comment": "Malware payload (Mirai)", "value": "4f4c0e63c0cdb78087c076b8e9844db60d359b4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966738, "uuid": "f7f0665b-949b-4588-a578-62b32061cc5e", "comment": "Malware payload (Mirai)", "value": "73c07582810d0f1b7ea07d56a8bab3a17b3186ebd46e081d8ba65f2e0f50c3e98e46b971e6a80da865f6bdeb1029934a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966738, "uuid": "7fe4f2c6-b6de-4802-8b3f-f9ecaff3011c", "value": "T15FF37DC6E743C0F9EC1645712177AB325DB3D13E652EDA82D3BD9A32EC41640C61BAAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966738, "uuid": "e046c1dc-24fd-4d9a-ae75-e34c66614528", "value": "3072:X/1/1l5yDwGizlUREzqbg93xqY9SFwdF0A00MQIMsDFVZzKbhGB1nU:XP/IRiwEEgPqfZBMKFLzKGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966738, "uuid": "94d61c36-010c-4524-b7bf-4377af47248f", "value": 162248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966738, "uuid": "7252bdc7-1e69-40fd-8cf5-ce24611828e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966738, "uuid": "3a0df5eb-7157-41f0-9fb7-728dd8457ee5", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c5f4fb-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016220, "uuid": "4ce22cb7-61c9-4131-bc9a-4115dd026d5c", "comment": "Malware payload (Mirai)", "value": "6e1073bdd73a5b0e474c6a68a2d706a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016220, "uuid": "b9bc44af-3535-489b-a3e9-1eb7f99e8d4b", "comment": "Malware payload (Mirai)", "value": "07309d01f2c10fbaa42d0a8b12c1f77ca7dc36e263fa52c44f6b90dbe95f9774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016220, "uuid": "6bef3d57-57a4-4b3d-931d-f7033505f013", "comment": "Malware payload (Mirai)", "value": "876f7a10900b9f7b5237dd88444f63ad10d5651d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016220, "uuid": "f0db9b50-15b7-4108-92fe-533342e86c12", "comment": "Malware payload (Mirai)", "value": "5cb25c9a00a7feebdea892e9f48d456f1226df34f7e9c7fb36b52e7384dc5a99234101aa87d09ab8660fc172172ef8f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016220, "uuid": "9aa3c402-8985-47b8-9ed2-12c019c8d40d", "value": "T11B73E749FC815B11C5E822BEFA1E018D336767A8E3EF7212D9115F15778A92B0F77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016220, "uuid": "1eb0161a-fa56-44e6-87d1-a3296560aca3", "value": "1536:WRntFCu+pHqJcZOVuTnGsP4C1mK8cnJ78oXCEdlBricdsv/LT:tuGH4KGsz1mK8cnJ78optds3LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016220, "uuid": "e7a1d76d-e6a5-4b61-8e5d-0d8b32a82244", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016220, "uuid": "457236b0-65a7-403a-84ce-be0f831c7ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016220, "uuid": "e59a8afc-40c8-4c2e-a244-882affd8fa66", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a18547-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026237, "uuid": "c7e0b8ed-0d92-4de1-951f-cea3609bbb54", "comment": "Malware payload (Mirai)", "value": "dba903ef475e3136fe55cedade917574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026237, "uuid": "428576bd-625f-43e0-8e41-3114ebaad878", "comment": "Malware payload (Mirai)", "value": "07f29dca931b0c18a406d79680eac3a344ff3b28e570b5f166a8ec80003a642d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026237, "uuid": "b5f9f64b-d754-43e4-897a-a3d8deaf5f3f", "comment": "Malware payload (Mirai)", "value": "b280731220c2778e0552baef3d58552580ea05d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026237, "uuid": "d0d07a5e-3bad-4bc9-b519-b1b6c779e20e", "comment": "Malware payload (Mirai)", "value": "c56a45012368681ef71a01351c29b4bc24a2bf355599498e795c0885d6fabda5fdfdaa641f89de50129219a0ec9b3fc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026237, "uuid": "20f9ae1a-68c1-4826-802a-0d534bfbd896", "value": "T1D8531945BC91D616CAD862BBFA1E42CC332623E8E1DE7217DD116F153B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026237, "uuid": "92e32efb-4aea-4b1c-86b3-d5ea1cdcf18f", "value": "1536:uMARkSJJTdBvXHsI97AV+106vrShwdktu+7R:uMARjEIBtOh2ktu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026237, "uuid": "11773088-fa47-4c85-98ff-295498c3b0e8", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026237, "uuid": "fb8cb710-be48-4749-a615-74cfb03dc0dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026237, "uuid": "304f7129-7dc6-450f-9f5f-55164716b723", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383a20dc-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969364, "uuid": "933541fb-36ee-4d87-a76c-75e76278712c", "comment": "Malware payload (Mirai)", "value": "0f1a0d20785c7be6e167e84fd5d2bdc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969364, "uuid": "fc0fad59-d8cd-4a40-aa41-602678bca4b5", "comment": "Malware payload (Mirai)", "value": "084278cce72066bec93c14ddebe9b776a321500b8c36dc75f89139fcec5ee90f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969364, "uuid": "be96a31e-662a-405d-93b1-355c5a14f258", "comment": "Malware payload (Mirai)", "value": "43e7546c0029d6ed78c5f52ad38195df2913e2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969364, "uuid": "3955a421-f328-4fdd-ae9d-2d360d0e8dc8", "comment": "Malware payload (Mirai)", "value": "ed6300c977e0f395054e179fac8f42b7b88148edabe221246c2e34fa87e84e83b0ca77e1468c2de6b173013677ed5bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969364, "uuid": "c124cd6a-3773-4457-940d-0edcda650600", "value": "T1DCE3630EAD219F3FF268C33547F7C964A32523D723E7E64AC29CD5241E5838A581BB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969364, "uuid": "3f6d1df5-77cf-4447-a0c1-15dbe576bdf9", "value": "3072:d/Jl4s3AEUZcZM54XgpYc+8zN2Gs5YBsst2VFyzGD:RJl4s34c3Y1N2T5YxLzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969364, "uuid": "cad85349-404e-480b-88a2-a21e0e2d58fd", "value": 149468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969364, "uuid": "24c60808-ebbc-498f-bbaa-457b9ed4037e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969364, "uuid": "a1ccb3a0-ac98-48cf-8445-bd28d8ebfb86", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56f2ddc-e466-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766979130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979130, "uuid": "463b483c-1d57-45d4-af9d-6e6a055acbb5", "comment": "Malware payload", "value": "9deea16f393abf006add15682991e092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979130, "uuid": "d3c0a976-3c20-4ca9-a5ce-2d34a9d88cd4", "comment": "Malware payload", "value": "088d77a9df20b83458d876c5571e8436b4eea6d65017a71108a26ed8e4eb756e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979130, "uuid": "9fdc2919-a2f9-47f0-b077-12e7fd7899eb", "comment": "Malware payload", "value": "83b65d89795976c24c61a92e6b62edf1b9dd1405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979130, "uuid": "99333bb4-7f85-4620-bfb2-afaef653aebb", "comment": "Malware payload", "value": "d8613b07433a0324b189d78e769decbfd936a81a5c325fcbd0835e95609a9edc1104d73840b9473b94006bd0ebd0a76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979130, "uuid": "a5c0e974-bc86-4424-bec5-474a9b1c0053", "value": "T1CD268E07F65349D8C46EC47C839B6232FB31BC598B206EEB17D04B212E51BD06F6979A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979130, "uuid": "780d0b2b-3949-4f89-8079-fecacda0b120", "value": "cc36518136ea8b46acd7cbe9b2ebf1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979130, "uuid": "34fdcc7a-4cd0-4fd0-a5f1-794836d0ebbf", "value": "98304:37EIhNUTmDacQ9PuM80j+7vhuH0ObZFVh+v9NE1:rBUTmzM80qThuH0Ob/q9NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979130, "uuid": "adbfcdf8-97f9-43a9-9b10-072757d097d7", "value": 4796416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979130, "uuid": "5435346c-7552-46a3-af00-000efd00a187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979130, "uuid": "1149f0e9-099c-4342-952e-efcf812d443d", "value": "7xoo1gk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6c2e85-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051295, "uuid": "9ec9f756-9282-4b71-91c0-a71780c80682", "comment": "Malware payload (Mirai)", "value": "bfdd1d1161a29343da553e7d2f0e25b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051295, "uuid": "096d6f4f-47c9-455c-b059-cde89f7ff7f0", "comment": "Malware payload (Mirai)", "value": "08f6809bf0f7144c0c6210ea7dabd6c58c9fb73980f7e5f8abaafc3a78407256", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051295, "uuid": "cd73f4cc-9eb0-49e0-a81f-4bba56cc635a", "comment": "Malware payload (Mirai)", "value": "96769fd97f28ac37d525d002571149e3d194d198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051295, "uuid": "0e25d884-ee7c-475d-bed5-3841cda892a8", "comment": "Malware payload (Mirai)", "value": "feb9bd4d3d5a80aa026c15c3096d3d5fef431c3d7411d4c5ad6727195fda3901c59354c3644ce945ebe1317d6ef4531b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051295, "uuid": "98e566c1-738e-4a08-a4fd-e45f94861409", "value": "T19C93D482BB43DFB7E45324F152F75B624E32FC3A1C26D586E775BCE18A214C0A616329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051295, "uuid": "3afbb726-9eed-4b40-869b-5da314f49ee4", "value": "1536:nUtc7Pp4r4WfOeQ1WETBnaJq2AXyis1DyS4br3:T2ESQA6VaE22mb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051295, "uuid": "4f613403-4531-455d-88f8-79ac3f3699bb", "value": 93940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051295, "uuid": "9ccf1ff1-b1c7-4535-b043-facebc85cf01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051295, "uuid": "ebfe9356-9612-4703-9b0e-fdf9c4fa84ed", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604a4bf2-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766968572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968572, "uuid": "9e790856-2257-4261-bc64-199ee6315a26", "comment": "Malware payload", "value": "76a4d687c47e0ed3778df577b19b96a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968572, "uuid": "68e7976e-264c-47b8-8185-996685137add", "comment": "Malware payload", "value": "09284dcc114047debf04442f82e37e7b571d3b17d7c6a2bee868d94092f382a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968572, "uuid": "25bbe8a8-9942-4aec-a40b-52f1e5696247", "comment": "Malware payload", "value": "d7ea662b3827b273d5ac3e495059186a4a070f29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968572, "uuid": "bd11a1ca-4596-4293-80ca-2bd3d94b3bc6", "comment": "Malware payload", "value": "9621a0f16bac96e7e54233f8e46ca90b400add9174e3468a6b3a8b746ffd56af52f3927ec286d662a271f470c1a6e4f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968572, "uuid": "f1dc6edc-e795-4f79-a6aa-6fbe58a4f52b", "value": "T1E4635A139463E970C824117C168F9B605936B4B2782BDD4BFBDC2762ECE4B446A643BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968572, "uuid": "f0852b58-725b-479a-b38b-ed5697b539e0", "value": "1536:4ttJzdsQepP7VQtqNu16564bax8eKdcIPq9vqFHyUYbRWSyg:4ttROQzYixV6gvwHyUYbRug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968572, "uuid": "2ebebd36-3bff-4f7b-aaaa-c5dcd51f2899", "value": 68448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968572, "uuid": "90fdf123-942a-42f8-82e1-49bf0a922900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968572, "uuid": "47780df0-9acb-4ec7-ab74-0ab8738a5d1e", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b64cbc-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051313, "uuid": "f4951217-e60a-4091-8bf8-3cc785d579c6", "comment": "Malware payload (Mirai)", "value": "c902bd2a53f3b5136191bd0b91522e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051313, "uuid": "4d0d4db2-af82-402f-a7c6-d6ac4045951a", "comment": "Malware payload (Mirai)", "value": "0965eb997fa84dd47647e61e9b1bb3716b3a1b15f89f92e2589e94be3a81f572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051313, "uuid": "cbae5fcc-529c-4baa-8e44-ce7f640fadf8", "comment": "Malware payload (Mirai)", "value": "2ccbb44b6eba8260a771945d0300e3598e050a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051313, "uuid": "4163d475-e64a-4ab7-a106-e6b9de6d5973", "comment": "Malware payload (Mirai)", "value": "6b34efc7018ba592cfe6abe205718714bd7b04959333e5c03c1a4fb5a9043a1649d43227dd2378198ff933e5998fff92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051313, "uuid": "f5cd1f5f-161b-4229-b808-344da0b6512f", "value": "T1ADE308077A81CABFC4D7D1F44BEB9525CD32F82E1935715A73A4BE961F49EE02E18220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051313, "uuid": "da584652-ef69-4427-a4d2-e0baa3748270", "value": "3072:n2peyzYoNvOSE4dpmjTPa/BNaSTO8Ylzi+qRgRRRRRRRRRRRRRRRfRKRRRRRRRUD:n271N+wNVTjgRRRRRRRRRRRRRRRfRKRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051313, "uuid": "1d06b00f-2932-411c-85be-40887c2f5443", "value": 144688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051313, "uuid": "45f4e6c6-4bbc-4484-99b9-2e0bd30140e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051313, "uuid": "ceac7597-42a7-4ddf-acb3-b40ac351743b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77b82e9-e482-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766991159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991159, "uuid": "e6345f5a-6a6c-4b50-ae88-b3a520ba438a", "comment": "Malware payload (Mirai)", "value": "c127037a6e4e6ab8de10e0a4ba998049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991159, "uuid": "596248f7-2291-4c22-bc53-0e92a17d9aba", "comment": "Malware payload (Mirai)", "value": "0967c1e23ef98e028c153785e50c65980e410534d6e0caee881f20aca14af04e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991159, "uuid": "4440921f-b768-462c-a0e7-716e509a7124", "comment": "Malware payload (Mirai)", "value": "6126294e8e0b9e0358057fb2075c6411e4bed0d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991159, "uuid": "5766cc3b-afa8-4507-88ad-d6d0a140a4a3", "comment": "Malware payload (Mirai)", "value": "d425d2a96d28966223ce9911826760ce72e2124319d3f9da7d866d224d3173391a48dbdbe67da8d3721225636e53617d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991159, "uuid": "b30f7133-01bc-43d7-8540-aa114669caa8", "value": "T19C433922AE7A2A1BC0D0A4B622F74365F2F6435F24A4C71E7D220F4EFF5494452676F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991159, "uuid": "d84b0987-2f03-4ac4-8ee7-4b99c2e807ce", "value": "768:0b6UIqipMsokc/LCiY4AstqNypBWnpSH5Q2kO+y0T7Oi:g+MshiLCiY4AstqMBXZQ2+Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766991159, "uuid": "e2c8258a-e6a0-4607-aac3-3ae97f81201f", "value": 58348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766991159, "uuid": "102412bc-54fe-4e7f-bcac-eb5c3630980b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991159, "uuid": "8504a5da-ad53-49aa-a3ea-e4558650a0c2", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38804167-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997711, "uuid": "5e687168-8357-4b63-8f04-1f92c8895c9c", "comment": "Malware payload", "value": "036481ad0cb13e9e7ee57903c02a5204", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997711, "uuid": "3393f032-e011-4247-b6c9-e861cfec7a55", "comment": "Malware payload", "value": "0970b5bea3795f0d8e9b2adc6e97ba05ce8ca486112e1110c4d5652d068fff4a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997711, "uuid": "2ff77962-5072-401c-a81d-ce23ee807e23", "comment": "Malware payload", "value": "1c3f797c111b7c91bc7d7db6c44619d1a142fcab", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997711, "uuid": "a1e014b7-cbf0-467f-9a8b-ebde4c97a520", "comment": "Malware payload", "value": "1f607a26d6ed72b38365d9c6393629f97eabb292bf3a7678dccd8467f76e3883e45aeef9b2ee4f8a9547d4052c1c0dd1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997711, "uuid": "f3062e47-bb21-48ac-8afd-820d20720c4d", "value": "T1C9F0051351A993CC15D846F211146DA8832D67DB37141E4D73F5CF4C8B8215855DF7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997711, "uuid": "87b8c3a6-b3d6-4b97-82b9-01bf1e4d5dd8", "value": "12:s80Qpc5InLgyaIS1PKC26wx0kTV45kJ00qo78YnaXBXOVZ50H:xLw1PKC26mJZ4Yn2kVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997711, "uuid": "5266ae43-3906-4d1b-bfe2-0687f7882174", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997711, "uuid": "e9b06500-0684-4b68-b349-8e31358d75e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997711, "uuid": "85c27fc8-3533-4b15-bedb-84f46ad89ff9", "value": "lx8y2c.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f3af57-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031315, "uuid": "da357995-1a74-45f2-871e-16c17e54ab04", "comment": "Malware payload (Mirai)", "value": "6ca823e54dddf7d9866c06da8c26a107", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031315, "uuid": "a2b57dbd-6a4b-4f83-8a20-364d385b32b0", "comment": "Malware payload (Mirai)", "value": "0992cac6336f99693e0dc5534bfe1ea9c9baff6f54a60a74f2e11054764f2840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031315, "uuid": "4c7632ad-329d-436d-8a08-d460b0001a46", "comment": "Malware payload (Mirai)", "value": "a47cb38012b57ef4a007be46c15f54748b53dc07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031315, "uuid": "6d67b0f4-e80c-49b2-bf16-29be2f12df95", "comment": "Malware payload (Mirai)", "value": "4ef842f8f7bd068014c9ff6bb7e15b50cc29c95ba31b03421854c96e63f88970db5d23b76e99abf26737755ef5db709e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031315, "uuid": "185b0516-a938-4c51-b603-3d29056be6cd", "value": "T12B34B50E6E228F7EF769873447B78E31975D33D622E1D684D1ACD1101F6428E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031315, "uuid": "150798bc-b496-4c98-a637-519613691f3f", "value": "3072:5RRccL6JmWg6YPFR4TV5n8CphNEGcsDdHGf2r7sJKthKk:CceDYPFKR/OGRdm+rAuhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031315, "uuid": "ef8a669e-a0e6-4c29-b510-433997888a78", "value": 238248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031315, "uuid": "c88a40bf-d38b-4d44-9f0a-be18e4852ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031315, "uuid": "e228e42b-1108-40bf-a91e-390f5f766852", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc85a9f7-e4a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1767005717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767005717, "uuid": "691201bf-e1c7-42c1-bf83-110d54e32104", "comment": "Malware payload (Stealc)", "value": "5677b14a667cd354b711e2c1e6f72f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767005717, "uuid": "bbfee17e-2274-4731-bd70-1b2f7ebfd2fd", "comment": "Malware payload (Stealc)", "value": "0998c51cbf4cc217c71852a258fb8709f530cb4bc2ddfb9e495709ac5d94608e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767005717, "uuid": "c881861d-5564-4962-9d73-cec7c93b8f71", "comment": "Malware payload (Stealc)", "value": "2493623380ace381d35721ea16ba1d7dfc618775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767005717, "uuid": "11086268-004f-40e5-a422-71abdfaf00f0", "comment": "Malware payload (Stealc)", "value": "af351789500752bfd4d803702e0d98f77446bb59f2880a4c68ed3b3f990f8fc5e657f2d6a6a1dca653afcd70435b215f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767005717, "uuid": "cc5cb09f-15bf-4582-9519-6652487f8e70", "value": "T15DF47D5AE7A502F8D2BBC378CA428556E7B278155370A78F03E319A51F372E05B3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767005717, "uuid": "c82dc9c1-7e63-4328-9090-ab734884484a", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767005717, "uuid": "ab598c3d-8d4e-4b6e-af27-acd947785988", "value": "12288:YU8VHX4ZPBuvzkOvW7UE+YTRqwJ49gNv3YZtF15kjHGA:SVH6BuvbvW7xXVVm9gl3YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767005717, "uuid": "c9fe6183-4a5e-4bd9-9cf8-9b61add57d5a", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767005717, "uuid": "2bce1e1f-afb9-4a2a-b9c5-739df27e645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767005717, "uuid": "36060c26-c16c-4777-b1b0-24d2cdb3478d", "value": "0998c51cbf4cc217c71852a258fb8709f530cb4bc2ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4494a2e5-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766968955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968955, "uuid": "07bc6938-430b-4684-9aa4-56986a1e92bb", "comment": "Malware payload", "value": "e1720a5c3f7f7285138f786611cb7f1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968955, "uuid": "48e812ee-29db-4a2b-9fa4-8b0f84d258f9", "comment": "Malware payload", "value": "099b14212d7997385fa9ab534837b0b12bfb8dc86121d7c3afa497e9ed6375cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968955, "uuid": "394758d0-ede7-4951-93c2-e1998b4f18b3", "comment": "Malware payload", "value": "86caaebe787275bac398e4e9bf610e2bf3276a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968955, "uuid": "1e906d7a-a20e-478a-b7dc-fab121a16bb9", "comment": "Malware payload", "value": "4d7bccb873e6895772044f16651bc47af42fbe09511e9c7478b3263e0290b0f40291969f328e96b27b57ff50b5aa586a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968955, "uuid": "8e69c31f-5596-47d5-b537-48c34ee0f155", "value": "T1C35319437204651FECC69B7546C6CB70BA22376297730583F650FA7B25BE3A07F29A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968955, "uuid": "00b79a8f-072c-4211-851a-6e9a988740c7", "value": "768:HpheevtPGfzkuRcRnVzcDzEuoPBf2QRBCLv3ddzWM7tZl3I3+T85L2QtPErrSQDv:H2ugGcDzEvyLv3dxQ5LBtsCRukMhWPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968955, "uuid": "01abad45-743d-4332-8745-15940fc1e639", "value": 64100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968955, "uuid": "9e6b5f6f-4428-427b-b277-09ea2949f07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968955, "uuid": "fef514a3-439d-4e2a-a7cb-9edfb8813fcd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fbbb85-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011343, "uuid": "24f3996c-81e8-4d7a-a36a-41fa29404143", "comment": "Malware payload (Mirai)", "value": "c0d585ed1e21537fbe417fc70f83e2e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011343, "uuid": "b5183221-0a11-482c-ba4d-3b5259cafbeb", "comment": "Malware payload (Mirai)", "value": "09c1755acedd83968ee90d28e17d34e761beef5655af6a0796d2c19e4b70fab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011343, "uuid": "a1ad3f46-d805-4ebf-b6a7-250ecd42b5bd", "comment": "Malware payload (Mirai)", "value": "8bee04fa495632b358e2260de80b8c4fa4c9a7e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011343, "uuid": "1821c017-381a-4a92-89f6-0d4dd8bf6e97", "comment": "Malware payload (Mirai)", "value": "04df790f9addc9b8df9a630ee43af325e97e3bc4862d9493cff60dcc885beb480935940fd24d7174b143c27d87f54fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011343, "uuid": "cb6e9a44-369c-4e78-aed6-e3b71764c561", "value": "T16373E716B9419F02D4D721FAFB9F51593313AFB8E3F97111D920AFA023C65DB0EA6212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011343, "uuid": "cf645afe-0ae3-4d49-8072-490f1049d65f", "value": "1536:Ptn4pCs21BPekdOw6pjVo+5IaNRTW8yDA0f1ClCpkiWek9+bHYASH3:eQs2vGkt6j5IaN1W8yDl8ek9+bHmH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011343, "uuid": "ff646d32-a0f8-430a-9814-a9e5c4be576a", "value": 80476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011343, "uuid": "d9a630ec-375e-4361-913f-84f87fc391b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011343, "uuid": "6054deed-3856-4396-a232-1b31dfb4010c", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b95312a-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995515, "uuid": "99bb6148-0cee-4f1d-90f7-fd3c96f237f3", "comment": "Malware payload (XWorm)", "value": "8c523e93526463075b6d27a1d775cdf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995515, "uuid": "e0e5340b-50af-4543-ba04-90a91bc32bdf", "comment": "Malware payload (XWorm)", "value": "0a6e1d1d264a178934806fee34b1a834e01ad5983d782d5247e6b6c193bd6a89", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995515, "uuid": "45d9749e-efb9-48a3-9cc2-708dfe4f28f7", "comment": "Malware payload (XWorm)", "value": "1b0c6b25c1c993b11e819dfb53ac8121f160faa5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995515, "uuid": "7bf763ff-ec4e-4acc-a106-fe02184ce715", "comment": "Malware payload (XWorm)", "value": "8c1aa68e83535e63d8c46661667d29ccfdfe92b4ae37b104d0d0b0cc255b04014766e52be9a296f7401e166f31c46061", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995515, "uuid": "7b1821a4-9373-46dd-8f73-bed8b63f962c", "value": "T14673FA8F152C80141F6B2377A18AE09F6A402B1EED5725362931FDB11A46E8F607F5FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995515, "uuid": "8a9f3944-7b0f-44ca-8dba-ec1521619feb", "value": "1536:I9l/AoSSM0powFbFz86NfS9sD/XooscfmfxOfmfKo1R9r+ZzHIQzHRWxMvXjZaF8:I9l/5M0powFbFz86NfS9sD/XooscfmfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995515, "uuid": "cf112184-60a6-4d4f-aa5e-ffea59941a0e", "value": 73414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995515, "uuid": "16d3b7c2-5404-4e76-8ee3-8cc68fddcccd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995515, "uuid": "912c47ed-6d05-47a4-a8a3-f592e9c19531", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feee580b-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027249, "uuid": "b1306685-a77f-4cec-a4dd-4edcf3b5fabe", "comment": "Malware payload (Mirai)", "value": "d5f30a8bc77de7e52c01920b9ead4f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027249, "uuid": "1aed4907-28cc-470c-8d11-215ed48e7851", "comment": "Malware payload (Mirai)", "value": "0ae51e970930fddf2d42154897cb7e548343160517b4e4d65896246349a3d3bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027249, "uuid": "27510c52-76a0-4bc1-9f40-00e1de2a041c", "comment": "Malware payload (Mirai)", "value": "303b8f58b285a8f3b75a8a023d2d66c25e82b48e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027249, "uuid": "215addf6-ba65-4bba-b950-dcbc4a5877f3", "comment": "Malware payload (Mirai)", "value": "48eb9244451becd6c22bd110dcdd968a458a0106689161e3e0bb56c766375285f0cfaf2fb13f6fafb80112a5fa91870e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027249, "uuid": "5279cdf1-ccbd-4d30-8e6a-cf4904968b13", "value": "T173334B2179792E17C4D1B8BE21F34764B6E6170E36E8CA1DBC721E4EFF1068061176B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027249, "uuid": "51896b45-8a82-40f3-96f0-2aeeefae12f3", "value": "768:7A32onq9RKUfjr8r95AFAr9nTzH8Sqx2FZRO+lZrVesqu:7A32iSRKUfjr8r95AFOB8Sqx2vhJe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027249, "uuid": "a438906d-cb8a-4c4c-93db-ea3a832d60c5", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027249, "uuid": "f332e9f0-02f5-4b18-bc8b-a819573f4c2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027249, "uuid": "873e0f2e-fef6-46ee-bd59-efb0644887e7", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35739725-e497-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766999853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999853, "uuid": "75611822-990c-4de9-bef5-c0c90a91fd59", "comment": "Malware payload (Amadey)", "value": "c1908aa1d46e5e976a27d5c66378a6fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999853, "uuid": "baacb0fe-04d2-48f2-bcb0-22d66ea62fb4", "comment": "Malware payload (Amadey)", "value": "0b491c48b9be2a68202ac644589f0dfe57bbf00abef12ee4d57c7839e7933fcd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999853, "uuid": "4b2387b7-a7da-42bf-83a8-dd7026e78c1d", "comment": "Malware payload (Amadey)", "value": "15eb7c26a04fdde1d7829c4df22e8db312c251e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999853, "uuid": "627cdc6f-d756-49de-bb94-31e95c33778f", "comment": "Malware payload (Amadey)", "value": "7b533fefb93ea963fc0652173893d055d185024bcd6b87ae811dcfaca630d5adae9840fe51ea1a55f5459c9072a18a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999853, "uuid": "f5824d54-c2b9-40e0-a168-1412229495a5", "value": "T1B9756B057B9CD711C429033049BE8725E336AEB98293F74F1A88BEF46C7B394691E653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999853, "uuid": "6aa0aa24-0740-4fed-b1ef-08c82357c9c6", "value": "24576:+9cVA6kxP2VV1eatHh48Q4XmWkXP34xDDKx0HPDPOI5OPUiby8Ca:+HHUG41W0Hr15OTy8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766999853, "uuid": "22362b7c-f01b-46e6-b910-752a10fe9d2a", "value": 1595392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766999853, "uuid": "065b5bb0-9816-4ccd-9a0e-1f7bfd9396b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999853, "uuid": "99e0d721-af71-43e7-8498-5483cffd6dd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edd3035-e482-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766990930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990930, "uuid": "bb4275b4-b4e9-4389-b3e7-8e3966a60fac", "comment": "Malware payload (Mirai)", "value": "c35c82a3b029207bbff8574841ed54be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990930, "uuid": "1129fc1d-f50a-460d-b564-a722e1d2de8a", "comment": "Malware payload (Mirai)", "value": "0b628af17c07eb59c742048ef39e2745848e78eb1366bdfb151db9a3b9c731fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990930, "uuid": "c5bcad30-4517-4411-8c20-5ec8e34792b8", "comment": "Malware payload (Mirai)", "value": "8d12ee2ca34189d58b446f5645e644a50571ef45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990930, "uuid": "1aed3099-6e91-47f8-8a27-07b40bbaec2f", "comment": "Malware payload (Mirai)", "value": "66f73ae403c6bc0d2db5bcf3d7d9a4784304bdc4ea7b3f51881f3ef1ee742931160e6008063c6d66cec74182f5bcfa12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990930, "uuid": "2ef37a58-9afd-4a5a-a5f6-2482f9a951d7", "value": "T186A34B02B32C484BD5F71FF027BB13E1A3AA669116B0D286360D97855176F729B09FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990930, "uuid": "5f1b44cf-d6fd-4270-b348-ad51c9372405", "value": "1536:oiYthFgMZ2PI9sLPmgtCpneQursdYHkgBKrdcO3Hnmb9Z1qdquuJYYFaw6j:oxthKA/9kOgMpeLAYLW6P15jaw6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766990930, "uuid": "12b2e526-ba3f-4657-b6fe-444927138976", "value": 105248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766990930, "uuid": "9fbeaae6-2438-43c5-bbe9-4791cdb90d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990930, "uuid": "33aa1237-248a-4cde-ba2a-0c3401fa68e2", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96658cf-e4e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767033575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033575, "uuid": "13730a28-1ec7-4b9a-ad1e-f0c0e514daa6", "comment": "Malware payload (Mirai)", "value": "a7665e494ab3162eac87934901fe8c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033575, "uuid": "ef9da9d4-62bb-468c-abdb-21eb927ed1da", "comment": "Malware payload (Mirai)", "value": "0bb222a46d77d6bab2d86c699c50d5c562cc9b2f9ccad71c985f23c129326f2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033575, "uuid": "229164b7-6815-4445-b556-d102044a462b", "comment": "Malware payload (Mirai)", "value": "1978a9b8f754a273fc0f8ef874ed548926eb8795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033575, "uuid": "404f544b-b895-46d4-9772-15e2a3dfd89e", "comment": "Malware payload (Mirai)", "value": "d29e10ea3a5b4257c0fd78ee7ce9088796f5b16d8af9d50924b3f17e1eb00d74bcd47dd0a53fd543006840ffdf0bb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033575, "uuid": "69554e01-8343-44de-8311-91727c078df9", "value": "T1F573B80A7E65DFADF76CC7368B778E209748239727E1C641D16CE9005E6034DA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033575, "uuid": "e867cc67-aed1-4cc8-ba7d-168499273390", "value": "1536:TnkPbHPpTbnh07dmT7BfZ2qrJJphGAQovrAjcXzATzC9Tzz7K35bkO+o0uM7Rm4:Y1XwdK7BfZZ81pbkOl0uMY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767033575, "uuid": "3702b33c-7b9d-4d85-8d18-cdd967e41776", "value": 75644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767033575, "uuid": "b9294026-11f1-4e1e-82fa-c2271fa747ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033575, "uuid": "535d72b0-d278-4b81-890c-e66a5d4e6603", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8392c0-e454-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766971280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971280, "uuid": "e77d2889-6067-46ea-a894-583bda9803b1", "comment": "Malware payload", "value": "781626e73981679ba86af1ccd26a7a46", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971280, "uuid": "bada7d3a-07de-447c-b2c9-e1af9850e7e1", "comment": "Malware payload", "value": "0be6afbf8ba3f9b80c4a6f753edf53014e2a471b5506b883ce0f79514eae77b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971280, "uuid": "66d595ef-1375-4172-862f-653117ca04a1", "comment": "Malware payload", "value": "376c185fb4cda44f96948671f57555a66cf9dccf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971280, "uuid": "9294717d-903b-4079-997b-90fa10e79a44", "comment": "Malware payload", "value": "6968affe84d1546e62219899b41c4a8fbd6ee00177977546780dc2cff6c66e50e941fda3fbeef44f31aeb94fd122bfae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971280, "uuid": "92087499-dc58-47b7-9a51-ec38fa7d30e7", "value": "T18785234277E868A6E8B4D373F0E701839B713455EB6126EF1294D13A86132D1EA3773E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971280, "uuid": "f5848872-e1fc-421e-bce3-5231694a51af", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971280, "uuid": "b9335353-bbe0-4153-812e-f43cf82691df", "value": "24576:KX5pYCcxu6pzrJhMw0iYIEKC0Nxju61h2S9S+9bj+a6kMReEv08vvu4hy:O+DJrJhMw0iYIEb0NxK6JgEEvP+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971280, "uuid": "7a6f7805-6642-452b-98b3-f78a0c8e5849", "value": 1797712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971280, "uuid": "6533e53e-e6f7-464c-b3c2-e7f66d092910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971280, "uuid": "bdbc4b7f-d82f-4533-81a6-62eccb9c4dcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64557847-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766989194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989194, "uuid": "d4d90caa-0c7f-4ff3-a9b9-75c530e0a0d1", "comment": "Malware payload (AsyncRAT)", "value": "68522b841fbdfa2356ba553d5dca0a67", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989194, "uuid": "54a357a2-217c-44dd-ae18-482ef2c3da08", "comment": "Malware payload (AsyncRAT)", "value": "0c4266858173ef3ef412a752b4b43733338c31057856d24cf1cd1363521137fa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989194, "uuid": "a75f44fc-4019-4c97-a62d-4d6ca3532644", "comment": "Malware payload (AsyncRAT)", "value": "f2c9ba100a9d08200d3d1d7dece66a2ef5a9370d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989194, "uuid": "4ae3765e-5b18-4393-9ed8-f687c999a870", "comment": "Malware payload (AsyncRAT)", "value": "49d376d868ab006ff66833bedc593a3189bbbd0fb83137581c16f95bac2df03b130d44208c580a998205c8a582a1e144", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989194, "uuid": "26d778b7-8c50-4952-9a0a-ddd68b3d0c2a", "value": "T155D5335D0A669154F6AAA4376DA061F0F423F0E560AD6D1710EC7AF6F0CAE1B7C3ACC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989194, "uuid": "dd9fbff2-07ad-477f-a1d3-b510b86c4a4f", "value": "49152:LSB0m92jUrFbElvzacPsi5qhof/j88/rXhdf/4u/0vY43CU55lTlqIV:Wuw2utEl+i/5qhonDn/4ucvY43Cw7ToA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989194, "uuid": "3a50d88f-8601-4095-aca1-800264fecaf3", "value": 2888603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989194, "uuid": "7993ed81-8711-48b3-b45d-b2a7ffbb3568", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989194, "uuid": "34a6a1ef-9814-4a48-b70a-8581f8154f54", "value": "gamify.in.net.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1462702-e469-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766980358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980358, "uuid": "2309fe0e-eec1-442e-a0bc-0611114f5b5b", "comment": "Malware payload (SalatStealer)", "value": "f6d709797c5db5f16e9749cef4dc2671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980358, "uuid": "45710e67-16fc-4261-a721-5bbe0b32c0fe", "comment": "Malware payload (SalatStealer)", "value": "0c8c54f1c697bb6f4e4618de7642b0949fd626a6832452275834b2d2b103990a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980358, "uuid": "1575bd54-4414-4dec-acce-92eeb7dc3f9f", "comment": "Malware payload (SalatStealer)", "value": "2ec2c8fcd9d669de4b770d5ed5c1fe35121a337f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980358, "uuid": "a937883b-4f4d-43ef-89c9-f87cdde5a683", "comment": "Malware payload (SalatStealer)", "value": "961d2d4782d91220f89bfa05d3ab607c54bef4039dd98c3f815bd490bd943f1e7dfe3816bd9f26a7c2e40130a571e6bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980358, "uuid": "73f50a6d-c3c0-435c-9184-36b3076ffa89", "value": "T1B6C66C51FA8B54F5E9031831406BA23F23319E048B28CBE7EB547E6EFC7B6911D76648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980358, "uuid": "d60333a7-cab1-475f-910a-d3bf4d2efd3b", "value": "49152:vl3/f0RTTFW8pzWS2X3PO51kw9sJnxzsWlV70QBdCdNhaQZoSdM2FKILb92WC6w4:tPfo/zW/2zk7qUmgAwvwJxFlEH6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766980358, "uuid": "2089abec-f388-4e5f-bed0-53b8d370902f", "value": 12093440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766980358, "uuid": "78ba736f-8db6-407e-b08d-56d404cab98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980358, "uuid": "d4975469-6b2e-4c02-ab53-560dc943c696", "value": "i2nayc0mk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1f5144-e48a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766994519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994519, "uuid": "b43b1522-6ae3-4b86-b01a-005405da1d26", "comment": "Malware payload", "value": "1d259872def07c5380d8c35f099f9c34", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994519, "uuid": "363a2779-af7c-47c3-957d-cb5dc9f8366f", "comment": "Malware payload", "value": "0cdb02107d7b47f67dc8ae35491163825853eb96e9153e9e5dfd1dcc29c744af", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994519, "uuid": "c5fb8d26-bd70-488f-bdb0-9e44151e4140", "comment": "Malware payload", "value": "2ac4e7de4f90a540150cae474714d24918644302", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994519, "uuid": "767c3f72-d635-4046-8d9a-832c08e19f80", "comment": "Malware payload", "value": "ef96f44b2a8712a277121cf32b275494eb0973c6aced7d11a2610f6173eb82ac0cdced20528b8d7290d66224bc7c3507", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994519, "uuid": "63d21f36-d845-4c1b-9ae5-d2f7cc57274e", "value": "T187E1C79AACF328187417405DCFBFA2587059A057874ACD9CFDCC66A8DF4C2A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994519, "uuid": "5d57a989-65d5-4b4b-bddc-7da851376d14", "value": "192:OZxIE/CTK/e6v0llHYoHsfOBro2Tc/OvSmy:Ot/XIYoHsfO2/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994519, "uuid": "e7cd8ca5-6971-4740-8cf8-825fc696bcd8", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994519, "uuid": "d40a04b1-4582-4d27-af9b-c65ec123cd90", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994519, "uuid": "ff54b733-e683-4abd-bbf4-0ba2b23855bd", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d612a848-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013008, "uuid": "19561f13-6fae-4ca3-ac5d-601a90cca9a0", "comment": "Malware payload (Mirai)", "value": "f0b0ada38f624aa374bcf6a121350499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013008, "uuid": "6e5f1fa6-28e0-4f12-8a1d-f099a01e318a", "comment": "Malware payload (Mirai)", "value": "0ce49dfe6cfa55082328a7e3f95f2d49edc5daada6efb5e9aa1ec19d2eea4a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013008, "uuid": "5e8f95a2-3a21-4433-b225-f30dc5428bee", "comment": "Malware payload (Mirai)", "value": "1e494d8004931dc0aee8657dc86ec0bd3744d726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013008, "uuid": "91d5a985-c1ee-4171-944a-7ef0dceb2fdc", "comment": "Malware payload (Mirai)", "value": "3688216fff5a8d0834167ba3da9687d5f26e338f51e3ff5214b2e3be45a94c3964926abbe906e4a45a9291e2ab2f4ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013008, "uuid": "83d327f1-e4f2-41fa-b54e-429bca2962da", "value": "T10893F78AF8819B61C5D422BEFA1E41CD335357B8E3EF7212DD105B14778A92B0E7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013008, "uuid": "3aa3ef27-c75a-4ed8-a663-6636c6304a9f", "value": "1536:WNn22MqJMC1fQUmHVsYfY4C324X9bpSVEguZfmOYklli0iTRr7t1ZJYmDWTAbVRF:0nJPBxCDfY4CmepSVEguZfmZVRr7t1zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013008, "uuid": "7de7310e-6822-41c0-ba41-6a481fbd8159", "value": 97088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013008, "uuid": "85d060b5-6db3-4e40-8705-5371deb4492e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013008, "uuid": "69e8b14c-9a07-4c5b-b881-34d7b9333748", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcea187d-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968351, "uuid": "8e82b93f-7f46-4980-aaf5-93ff1f026530", "comment": "Malware payload (Mirai)", "value": "f88d2b0604b7633a165a1fbea15896cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968351, "uuid": "e2852c0b-2384-4712-bf93-358ae0f52a7c", "comment": "Malware payload (Mirai)", "value": "0e050bfacfc6d1adc8eaeecabb7185fd1f7df13c0d1ea597bebd3babe80b7286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968351, "uuid": "8ac835e8-feb7-4f06-8024-ff606c3d2eb3", "comment": "Malware payload (Mirai)", "value": "cbfb360730f8ceb2a49d1403d11a826ecacb4766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968351, "uuid": "38b003e7-2adb-45f3-afff-58a89f274251", "comment": "Malware payload (Mirai)", "value": "1a25b05c87da271835fbc5763c4fbc9d25310e54d6ce4bb039b18440044b1b59f7bf8e339e52a896c24fe49d01364ab7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968351, "uuid": "577e1741-cd94-4cae-8c4c-b9db83c5f253", "value": "T1DAA3820EA9145F3FF369C33687F7CA21A374329323D7E149D19CE9251E5838A682B764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968351, "uuid": "9072a0e1-68b8-422d-99bf-06ec2dcafba2", "value": "1536:gX2r2B1NDDv5j9/w02WWU3sbRJ7a3iDsdjClzfuZd8vTFuP4nwgG+dVdRNe1A42j:a1j93oa3iDsdjBguP4wCf8AGJqVFy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968351, "uuid": "a959925d-936a-4d16-9b97-7d4c7ee0d576", "value": 104884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968351, "uuid": "01a94647-4ab7-4ec7-8d6b-dcf74b109be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968351, "uuid": "35ac96a7-2e39-4761-af1c-1c1af8d96c61", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc0fa13-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017023, "uuid": "5e0085b1-203e-4924-badc-e8ab923c8e34", "comment": "Malware payload (Mirai)", "value": "b949dd96f4270d30e5b6dc4555096eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017023, "uuid": "f947cad2-1f86-46ee-a3b9-75deca72bf9a", "comment": "Malware payload (Mirai)", "value": "0e70207e7ef9799c6f52880d691cb3e64b5d484fea291be6a315fea3c7bcd0ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017023, "uuid": "d6a01c71-47b4-451d-a62f-18fa3f96c821", "comment": "Malware payload (Mirai)", "value": "790e784d26c98ecc038ac075f60470bc78a6ad4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017023, "uuid": "2d6d93e4-fa91-4aad-bdf4-45f0a15b11d2", "comment": "Malware payload (Mirai)", "value": "dfe4a7ead9fde9f5c4a0919c1e0107925575aa49a0446082ac96618e61febd95dca2d17c97a25df20cc80108f065302d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017023, "uuid": "c3db90d7-a2dc-4bd6-9a93-af4e9b370c51", "value": "T141D3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017023, "uuid": "07c29a41-d02d-49c1-9989-27c0e829506a", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xg:PiySSGp+PMmT7zMply", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017023, "uuid": "28a26c1f-6fb4-4cf5-a57f-c061e9b856f3", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017023, "uuid": "10b327f7-ac09-4a58-9004-c23b56a5e7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017023, "uuid": "0e460bfd-31f9-4cac-914b-196792c5ae8b", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e31249-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026969, "uuid": "f6ec47a6-7511-40e1-8830-1b161abccdee", "comment": "Malware payload (Mirai)", "value": "e9605562f3e48becc80613c601fa9921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026969, "uuid": "d1633ad4-c424-4f82-85ba-236badddb814", "comment": "Malware payload (Mirai)", "value": "0e8a04ba64180140f392c9ec9aab1c5f3b535b33c6eaf2cbb259397c628d64dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026969, "uuid": "c48566c5-9397-4f40-82c1-0eff0e6c2452", "comment": "Malware payload (Mirai)", "value": "ee6a04f1e3b5ed216a543f990c2eaf5ed5c51ef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026969, "uuid": "fd03ee48-6839-4b8d-8ba6-e0bcaa55fb3e", "comment": "Malware payload (Mirai)", "value": "37c01866dee1763d082e4fcf932ed12359bd6ec05fd21ad052cf4e8a96cb682c60399f81945c9d72a3a92c443950b246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026969, "uuid": "255a6137-7cf2-40d4-bfe3-311cd29fbc73", "value": "T1EF531A45BC81DA17C6D462BBFA5E42CD332613A8E2EF7217CD116F157B4A82F0E6B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026969, "uuid": "743afa32-ce01-42c3-bd51-864a55d75d5c", "value": "768:ifV+cz0K2HLLo9x5kKeI3dAuqRuUqvq3OzB/Gd5I8/b4fsNlogKq81quM7R:WVrz92tKegaRRpqvqVdum0fBMuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026969, "uuid": "342c6b89-71d8-49ee-b9d2-12287ffdaf57", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026969, "uuid": "dcb2273d-fed7-47c6-aa64-5c037a32f6b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026969, "uuid": "511439d8-96da-448d-9b9b-3184a2ce9926", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfaa939-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995408, "uuid": "a72f0db1-f31a-4591-b495-3aca1f86d834", "comment": "Malware payload (XWorm)", "value": "2acd4c95d38f1b9402d6463a9e4476a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995408, "uuid": "489f523a-f779-40e9-8067-30c5a0f47784", "comment": "Malware payload (XWorm)", "value": "0edc5ab0860abc7342850c596b22d421440d786cf901d378bddd8d4ff6f2f49b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995408, "uuid": "01388941-9167-4325-a228-39e17bd44594", "comment": "Malware payload (XWorm)", "value": "7bad50c6d07490884dd23cc187e954510192f2c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995408, "uuid": "fb2e5c20-ffea-4bfd-9cd3-cbedf7cd7d0c", "comment": "Malware payload (XWorm)", "value": "14f80820f9e28c059dcb0b9518c16550db69e87deceb10fe48d95b038f30f2af82bd850c67dda876061df2dee7166aa4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995408, "uuid": "1283724f-32da-425a-bfeb-1d1a4d367e01", "value": "T132632B7F441EB9FD20B36CF6024917D502E986390CB899983DB369CADD8A23D453B97C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995408, "uuid": "e10e5c4b-7040-4b0e-8cde-51cf401a27a0", "value": "1536:I9l/AoSSM6eMdX/UdrxqxDHtMgxmWKgvDQmSUKBFKmyNycRk+dtQkHJv+JPtEBMZ:I9l/5M6eMdX/UdrxqxDHtMgxmWKgvDQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995408, "uuid": "77059972-6254-454f-bc80-d41b60204465", "value": 72521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995408, "uuid": "d082f22c-0a8a-4cfc-a8b3-7876094004dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995408, "uuid": "3a37d297-61ec-4e99-aae0-7fd4fbd94864", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28d9ce4-e487-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766993191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993191, "uuid": "22cceaa5-859b-4b66-92b9-fcd807b70f0e", "comment": "Malware payload (RemcosRAT)", "value": "2297d2de1601a75a7154568713c0816f", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993191, "uuid": "2c74972a-3ffa-416a-b096-50984b682016", "comment": "Malware payload (RemcosRAT)", "value": "0f8c783b02f16c59793732d4fa5c1ca87fc333ad08a6136d5d1e70b7c5a8c660", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993191, "uuid": "9164f486-94ff-41e0-98a1-9b384cc7e45c", "comment": "Malware payload (RemcosRAT)", "value": "22e7fc41f317e0d339d000a303fae72ea340e3b6", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993191, "uuid": "e90f3bf1-064f-4a5c-b510-8c1b9de249ba", "comment": "Malware payload (RemcosRAT)", "value": "6428a1fce6e34c530369b29046dd64156990cc00e30ea6b5beafe17c045d5fea4b20e37689fdfcc9ffde09a81db62268", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993191, "uuid": "78772097-169d-42f3-a3ff-4e4a346ed08e", "value": "T17695F1027292447FC0262D749D6BD6E4582EBE202E2458453BFD99AC8F397613F23ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993191, "uuid": "d42b2b80-f224-4fde-85eb-6fe9308930d8", "value": "24576:kIOQDrRq2CCxW1z6+kzRao1iC5pc6Ou8gNXIIjapErezkKhDYbPRx1BBOG2:kIOQOsYd6ODEfWYbJjBsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993191, "uuid": "72921529-260c-4001-81b8-5610b0196ef9", "value": 1948779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993191, "uuid": "6c333e2e-659f-4b94-aefb-f3d3338116a8", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993191, "uuid": "004fdefa-7ffd-4c46-a17e-5e84e1f5f6f9", "value": "REVISED PURCHASE ORDER # PEEE-AJ-GS-207-1R-2025.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f70f3e0-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767030740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030740, "uuid": "180cc712-00f0-4925-8d82-46c8db56f692", "comment": "Malware payload", "value": "89660293808b4a6a7c509840cee459d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030740, "uuid": "c8e7c1c3-b6eb-4fb8-ac7b-52a6e9c1442d", "comment": "Malware payload", "value": "106924453bcdd9d0106f853248632b6f53876b6c8f570c1105a9bee37e95a469", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030740, "uuid": "a8177964-e86c-4029-afd0-4d277c5090d3", "comment": "Malware payload", "value": "8ddef0fb7e40191c119b777117a884b1457db0b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030740, "uuid": "54d72c72-6b5e-46a6-9034-fdb86f2587ba", "comment": "Malware payload", "value": "87f815a679635a6f1b31f305ed8f6093b20f9c226a32e724ce058383497b30974fe25875b55a3404a49d0255b9f6dcd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030740, "uuid": "175e44a5-a19b-4ac5-ba85-2f9c3944e6e5", "value": "T1E8B0128F00180000C004FBF419628B6010514FD136240A4C40F90530CC5463430B0D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030740, "uuid": "7fc8b11b-ff71-4fd2-9de0-5966a34f0042", "value": "3:L6FTH6K0NUClswWnGaKzSE/LwWAAqvn:L6FTHMajDusv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030740, "uuid": "2eed6dd6-0088-4460-92cc-37667dfe41a0", "value": 92, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030740, "uuid": "89ee5605-eb41-4cb5-ba9f-d1d28016d66c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030740, "uuid": "2588fa16-97d4-4e90-ae52-d4543567730f", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c767d7-e4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034435, "uuid": "e5d83f22-62ec-4234-bd75-24110d9f556f", "comment": "Malware payload (Mirai)", "value": "5b6f2aac7a022df29d8f490b1778350f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034435, "uuid": "5247f158-eb93-455c-8b3b-97d5d6d4cf2d", "comment": "Malware payload (Mirai)", "value": "108b1bb30ba455a9d5d175135a7933f561d712b64b1120039eaac72f14fc90ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034435, "uuid": "5dd92cc9-e381-4928-98a3-fd693d1c93a6", "comment": "Malware payload (Mirai)", "value": "a8aabb89796612f539cfed6390343137b5a62fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034435, "uuid": "c23d149c-1276-4f42-8c6b-018b255d0d53", "comment": "Malware payload (Mirai)", "value": "aef614c164b61787957b946d1f71e21904f1e6e26da7a31cb6c9d226cf72545585a37abb7637ea1170376f1f3c9a0dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034435, "uuid": "3fa0edaa-c34d-4203-9657-f5f06ece4f49", "value": "T104F2F23AA967B830C6300C74781E9242B1D762B790E913755BA00C64DB87F4E4BFC7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034435, "uuid": "63e4d7a7-602a-4cc0-8b0b-ffe7c1b01189", "value": "768:GfvIEeXXr4+xUReeX0QMZmES4UrMN4MoiiPJS+zb2xpeIfJs3UozC:WvIEqbVORe0VitrUrE2JSyI8zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034435, "uuid": "daab3deb-4891-4821-a7c3-72857a8b97b3", "value": 34764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034435, "uuid": "feab3318-5a03-4202-bcdf-9d0cc8e75a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034435, "uuid": "3557d11a-f493-43b5-84b9-17dda068b072", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4330247e-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995152, "uuid": "81fa2e9b-1b2b-42cb-9fe5-506645b15303", "comment": "Malware payload (XWorm)", "value": "0e2571498c3d8f5dbbf076e4054017cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995152, "uuid": "4af4ae96-138e-4a99-b64e-e4855749038a", "comment": "Malware payload (XWorm)", "value": "1137fa943b5dd9f3b00f4dec441195b9d604f73ab399098af7a74996aaf4ddf9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995152, "uuid": "d1e12c18-5654-4738-bb2e-89efa7656c39", "comment": "Malware payload (XWorm)", "value": "0c41058738c30d3ddc1f98f020086ebf01823c53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995152, "uuid": "8f10e79c-33d0-4772-8550-6ea24c354946", "comment": "Malware payload (XWorm)", "value": "e76fbb449150370e1096d1de926b2f9a7609984b9780135ff9ab98512ad31470d4e606f117432616e1a4699287852a66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995152, "uuid": "a9c82e90-dad8-43fd-ab70-c1f5cc1ef7fd", "value": "T16B6309C7CA57AB5D8AED36F488C2A14EC4E1ECC84856C11ECC9A2DD391AC1DFD60D58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995152, "uuid": "481666dc-d476-47a9-b931-96f3359fc584", "value": "768:I8w/h62/jWs6oS+xISN0vfsMSRufdkfScBYrwz2y8kTAlGB:I9l/AoSSMU0usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995152, "uuid": "7ab9f6b5-dd4d-4fef-9135-c681de4cb442", "value": 72493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995152, "uuid": "4c4d663f-5efb-4bdf-b0e0-491ce2a83ed6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995152, "uuid": "40d545c5-5639-4596-a4a4-cd5ddd880bc0", "value": "invoice-1645080830.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312cb21b-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017026, "uuid": "23ff2bb6-1ddb-4f4c-9b9f-066f9ee353e0", "comment": "Malware payload (Mirai)", "value": "a4f3f7094c89c8d006df28fc93368f9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017026, "uuid": "13cfce36-3337-4f42-b860-6ed164431aad", "comment": "Malware payload (Mirai)", "value": "1152b0ad11cb63e56abff7f9d4f38918e100eb2dfa9c58e1d720b55be02bad56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017026, "uuid": "a48aafda-7a4b-4289-ae3a-bec361cccdff", "comment": "Malware payload (Mirai)", "value": "91b9d223ddaf40df2dae9e7ed39c7041a7992ccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017026, "uuid": "944bb22e-0fb0-4ac9-8fab-c76b65e6c746", "comment": "Malware payload (Mirai)", "value": "53d85044650ce03c12533b36c46d4eaf64f18d91dacd72c1be0be82b899877a198cfbc000c8e51d26d1fb38095829c73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017026, "uuid": "a667d4b9-d1ba-44e0-a7ac-14c023f7167c", "value": "T1BAA3084AFC819B15D5D522BEFA1E018D335357ACE3EE7212DD109B2477CA92B0E7B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017026, "uuid": "06ffb579-f89f-4261-9cbf-19a21109bc2c", "value": "3072:BRrXQPfZ+66Rn/OaDqyJr/dArYElWGswzpgGumy:BRrAPfZ+tR/OaDqyJr/kYNGXzpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017026, "uuid": "d7e946ef-2d62-4dcc-b942-8c923d06d121", "value": 105040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017026, "uuid": "988cbced-c27e-4bb0-aecf-b831b50169f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017026, "uuid": "479ffc71-7563-439c-b200-1208b65aff5c", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2702068b-e4f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040202, "uuid": "674a80c8-2a5c-4c6b-96d4-73c7e50f852b", "comment": "Malware payload", "value": "3d9824e8804b8557fb8877cf3b12fc17", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040202, "uuid": "14297edb-7937-4cf9-8194-0d4ca7ca4382", "comment": "Malware payload", "value": "119fe2b1af4b4d49030d5126dedecfe407a82e7c8dfa18b78dac5c8255c85f40", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040202, "uuid": "0e5031aa-7fd3-4a1e-a784-27d639fda502", "comment": "Malware payload", "value": "81a46a0e0219d81dd4c0b36d1fd0ef26828e2c6d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040202, "uuid": "27971040-89ab-463f-ac69-5265103c4479", "comment": "Malware payload", "value": "d16d3476f59f978e64dcf22ad50f8397cdd166af3f9d21d542899672ce5f2c518a9ee9a6454472819ad5d3fe90f64436", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040202, "uuid": "ce4436d2-c944-405d-8151-24fd0d0288e4", "value": "T196472396F780241BE2F242F6007562A1B6432C265BC38B877E64713C59F7AD07F68ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040202, "uuid": "59cccd15-a6a0-4f03-853f-a1559cf3bf60", "value": "393216:MaVz6nv09j6GIg8v4K41rps4KLfkpIhy94/wmwqUQ1FvyOmw3gMOlNEjAN8LNdVc:LVivtGrS2G4KLfsaom2QLz+MRdPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040202, "uuid": "95a34761-1655-42f7-a96f-a1f505b42608", "value": 26934741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040202, "uuid": "dfba5e4c-3489-4de8-a713-1c37053f8b53", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040202, "uuid": "16f0e98e-fdab-44cb-abda-786e269c9612", "value": "Chrome (6).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6fd0b4-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995199, "uuid": "a66e1f05-1dac-40b1-b5df-57246acc41c8", "comment": "Malware payload (XWorm)", "value": "aad2a19d38346e5feeaafb32bf4cc4c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995199, "uuid": "73be8c37-d999-422a-bc52-9c76e6a2eeb5", "comment": "Malware payload (XWorm)", "value": "11e2a7167040f3047cb0d5d49766ef5f5701521f1f45cf3a322cc8dfda619a08", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995199, "uuid": "b6e8d639-3d31-4f99-a65e-ebc2586e6b46", "comment": "Malware payload (XWorm)", "value": "38586e6a7e7a3066f0494bb227541c6b8998c9f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995199, "uuid": "e4588e97-3896-498e-9298-ad85ce860fd7", "comment": "Malware payload (XWorm)", "value": "fbc6ec5d66fa3620d5c11e70914ff35953dc0fb1ad8c037929ed56a37fe6214de3b1aaa8026f4b631b8437511f568e89", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995199, "uuid": "47b55d15-e7f7-468f-b392-82f7d585621a", "value": "T182630AF12F0FB1CF5559421A4A4B451B7D10BAB88FD5EC91EF103C23A62DE92366E18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995199, "uuid": "3af832f0-0aaf-448e-ba6d-23a4bf984ad5", "value": "768:I8w/h62/jWs6oS+xISN0v1DI+/OZvaf9LDLjjQ9sl0yqP9qWx1HEEaF0WHjNpBdR:I9l/AoSSMDcusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995199, "uuid": "677d6dc7-fe98-4f55-b674-063dc42466df", "value": 72503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995199, "uuid": "70c64a08-506a-4edd-b1df-947086d357da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995199, "uuid": "44c5b0b9-1ec7-44a5-bc7c-5802f2843bac", "value": "invoice-1645080830.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fc1ece-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (For)", "timestamp": 1766993652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993652, "uuid": "e2092010-4fc1-441f-af39-ae8d0ab4943f", "comment": "Malware payload (For)", "value": "8fc4e91bf3d44333676b5ed147fa344b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993652, "uuid": "b4b751d5-c732-4098-8f93-e9b5c21eefb8", "comment": "Malware payload (For)", "value": "11e6fb6d0a431b017cdadd0500e22ec184841935e47a064c0fd2d1405e123bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993652, "uuid": "ea815f85-80e6-4a32-ace0-125ebf35f39a", "comment": "Malware payload (For)", "value": "5826c1ab858421f01686021bbdcf98085aded4c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993652, "uuid": "7925c157-4814-4366-a68e-03753bd8fd3e", "comment": "Malware payload (For)", "value": "581dbd5f9ffed789b8087728a10ce9d007b4defbfd934ddb787c2bd4dad9e8a6d20be69014a1167f8a9e9953dc661601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993652, "uuid": "bb8f970b-e3a9-4acf-b52c-1a4ccc68ad9a", "value": "T1D8E401D03E29AB02CC791BB189A8CD7463B42E6A6015FAD75DED2FCB72D97006448F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993652, "uuid": "8deb480e-ee86-4b8e-80fd-389698df1957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993652, "uuid": "db9978cb-89d1-426c-a959-492a1fa95865", "value": "12288://uWGia3/D2KAccSCO+sBfQgXZlxWHy2SKMgnmS1CHJXhQKpDh:3uWGD/HAcNBYQ1WS2zNnmSE9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993652, "uuid": "4f5ca5a5-ab41-4597-b3bf-4085f480e977", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993652, "uuid": "4ea8e482-9366-4a65-86e1-0324c887728a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993652, "uuid": "9043a122-ef9d-4515-b6a5-45edc37ad935", "value": "INQUIRY_DOCS.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13d2dd2-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026716, "uuid": "18858673-9935-4feb-a00d-20bc69336966", "comment": "Malware payload (Mirai)", "value": "15e07dced3791aa3c6a45223c49c60c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026716, "uuid": "b8fa0060-bfbb-4989-b52e-91360bbd8348", "comment": "Malware payload (Mirai)", "value": "1279b1b9f6b152af9c8142e60fc8dbbb5af73531e74d214ff465d52afa018986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026716, "uuid": "56f345ec-db39-480a-bfb0-5af7ab57187e", "comment": "Malware payload (Mirai)", "value": "469295e0929aff5eb9ea2273e4b2bc8bde461bea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026716, "uuid": "4f0e4009-2186-433a-a7b3-60612e7d0222", "comment": "Malware payload (Mirai)", "value": "72abe3b9cf811fb880a3b4e372d423fcb4b8b9c90bbe6f544f4cd3d75a5adc3ae5b66fc13d1a4dc3885cca1a79ece44b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026716, "uuid": "c38a67d9-1364-4003-8fe5-6030ee74bf1e", "value": "T1E1234C43721C0A6BC4A21AB8293F1BE0D3FFB96021E4B6C9640F5B5A4675E371486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026716, "uuid": "f02b03e1-7731-4d3c-b5a6-66187a00c39a", "value": "768:jX+5CZoIu/RuXl/Bx2ySxNtpn4/rk3Wp8FwCZqSGb0Jxtur:S597w3SIjyWp8xqSGYJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026716, "uuid": "a09e5954-efc6-4617-8a08-49c1f6018851", "value": 46968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026716, "uuid": "40b1b0ce-278e-4e4b-bbb3-ef427e053477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026716, "uuid": "368aea2c-d85a-4b76-a6cb-5105eb50be5a", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40e67ff-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026721, "uuid": "73d85e24-ccac-48ff-9367-fedfc5bec9a0", "comment": "Malware payload (Mirai)", "value": "62964659e7793c0411c2200526287fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026721, "uuid": "d0b20028-481f-4373-9ec5-24f2ae621df5", "comment": "Malware payload (Mirai)", "value": "12a37788418b32ea3def214229f7fae49f2d69a1952c9c892acaf12940a9966d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026721, "uuid": "12af3875-8fb5-408c-aff4-637e71a65fb7", "comment": "Malware payload (Mirai)", "value": "445c02839b8898c6e73eb4d04dc5d28821437c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026721, "uuid": "262ce97a-727d-4291-8dfc-8edb0c803be3", "comment": "Malware payload (Mirai)", "value": "3fef911efc41dec16b565e618c30458856fab5b18b3181a5a2dc65ef07dcd39aebc8fe28391b4af5ea826850e09239b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026721, "uuid": "8857f2e4-88e5-4a9e-a271-9923a10303e4", "value": "T10BF38C73C8296E9CCA24C4B1F0B19F795B53902661836FFBA5A7C2718047E9CF6097B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026721, "uuid": "f51885fe-9e61-4421-812d-82ae155df12f", "value": "3072:Lepl5Kay0WdX/5efciXNPbOqfZ/W8j55VL6hh1BV:LraWXkciXVRu87V0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026721, "uuid": "f9fd5d5c-7baa-45a1-9f07-fc9b6b3b3f8b", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026721, "uuid": "fd3d1ae6-f145-4d64-89dc-0e994b3db213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026721, "uuid": "880ed48b-979a-4c3d-a334-4357c5615178", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0f6c4f-e4f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040103, "uuid": "b7fe65cf-3932-46ec-a312-0a59e06e941e", "comment": "Malware payload", "value": "103b6103770640d9347757e76cc93998", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040103, "uuid": "41d567f8-d6ab-424a-b926-66f317cece19", "comment": "Malware payload", "value": "12cb6136d2d325563b5079c138eeac2bc4ee4af3373718ba1c79c47a6121829e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040103, "uuid": "bd2da04d-83e1-45d6-8e41-2e60d62b63fa", "comment": "Malware payload", "value": "838ce98977caa3472d86e724422d7615067c6ecb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040103, "uuid": "515cbbe3-a348-4d5b-a61f-8bb6c7f38328", "comment": "Malware payload", "value": "591bbf9452866d0de717fef72f8a1acfa704ab4a4ccc9bf05790df7e205f5923c28634631af79c133daac30d18db2d2b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040103, "uuid": "31e26487-c409-4739-9090-a23aa2c0d259", "value": "T104B5E046BB989F1FC87791320D4A5231A41AED67C713C387D9742B5928AF6F40F123EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040103, "uuid": "b19a6fbc-b945-457a-bcb0-f204c0e7ddd3", "value": "49152:yUILp9QGwWWkAj1jx6px1ErDc3fqbCp+s9q4APfYE:yUIV9lwvkAj196vSriqeJeIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040103, "uuid": "a0c92d84-ef63-4534-bc04-e66b7afe88f7", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040103, "uuid": "3127f7db-ffa9-4179-ab3a-2c3e34dba987", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040103, "uuid": "983572f9-a32a-4599-9a59-720a18fc8247", "value": "Chrome (5).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7ea9d4-e50c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767050309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050309, "uuid": "68c280a9-4f7d-4617-9eff-e11ea92d9f5c", "comment": "Malware payload (Mirai)", "value": "7da7747aecaa873a2044e0b25c2a2fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050309, "uuid": "b27732fa-f588-458f-8dff-806cc72e0d80", "comment": "Malware payload (Mirai)", "value": "1371291387b5524508fb2cbb63e1e5e9111763753357d44669752c431361d46f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050309, "uuid": "d202ee16-50b7-4552-9484-f80f84899071", "comment": "Malware payload (Mirai)", "value": "89337e9ef6d329fa6d4d76d5d45b23b5c2d078c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050309, "uuid": "c3805859-8ced-44e8-a1da-f5245088fc1e", "comment": "Malware payload (Mirai)", "value": "75da540644de9dff20495f55e7e3bdc0c775059ff81a5d4cd902b4777d110eaa9805b68578f1a54dd266c238ace6eca0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050309, "uuid": "ebb8364c-f70e-4ea0-b31f-ff0cfb12878c", "value": "T14C83A50E6E219F6DF76C873587778F219798239227E4C242D1ACE9045D6030EA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050309, "uuid": "46d93b6e-552e-4589-947a-5d89f044a652", "value": "1536:sj5+kYB511Mnd0WmNv4D44gPxDqyi9Cw2lWiOovus3Ff3Fs3Fs3Fs3NMktoRqW8U:Dkq1xBPxDqto3lWiOovus3Ff3Fs3Fs3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767050309, "uuid": "8c2ee794-224c-40e6-b3c9-97acad3db072", "value": 84400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767050309, "uuid": "3ff44d07-736d-4ae2-a98e-da14ecfb52d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050309, "uuid": "a3665e8b-0d97-417e-b150-4193e0a30c68", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562179fa-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995184, "uuid": "bafa5a54-cfe1-48fa-9e45-1bc353f79502", "comment": "Malware payload (XWorm)", "value": "26fce1b977d07725edd692f87f74d50f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995184, "uuid": "2baa5a2e-d636-4da6-b19b-bdcb0f13bb53", "comment": "Malware payload (XWorm)", "value": "137ae1279096ff194dae5905cb82cffdb936c3cef5fc8785e54a925226d3be86", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995184, "uuid": "11730fa5-8bc4-4820-83fa-8314386e05cb", "comment": "Malware payload (XWorm)", "value": "6dc43168e790c2d84192d527fe274e381fb6ac04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995184, "uuid": "b237a282-ea3d-4a4a-a73e-462adcd0953b", "comment": "Malware payload (XWorm)", "value": "8b557afce4cfaeb1e9610e49bbf50a346e03ff750adfa3ace14ea1b728e43cf3ba47ab37f2dfe299e609e749bd3c3415", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995184, "uuid": "3fd09367-951b-4abd-b43c-bef6ecbaa16b", "value": "T16F633B5C8FA93E0477EADC49C49723DAC5C2ECA70454E2C912A322ED7A58CC5D268DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995184, "uuid": "9b977319-9dc4-481d-a379-71815e4733ba", "value": "1536:I9l/AoSSMCGTpGTnGTiGTHGTnGTeGTqGTgGTNGTgGTKGTpGTbGTsGTvGTNGTmGTL:I9l/5MFTsTGTlTmTGTZTNT/T4T/TtTsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995184, "uuid": "d8eead2c-e94c-4855-918e-27fca1c99c4d", "value": 72493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995184, "uuid": "9c9013df-46c2-458d-942d-335ad5409ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995184, "uuid": "89828417-925e-4997-ba7f-4da48a7fbe55", "value": "invoice-1645080830.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b2e206-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982164, "uuid": "6cd47eba-5aad-4165-98fb-3e17fe12c11c", "comment": "Malware payload (SalatStealer)", "value": "c7abb515f9f3077d57a9ed94e29da294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982164, "uuid": "b061494e-0120-4305-aec0-1dd782a98b90", "comment": "Malware payload (SalatStealer)", "value": "13b2479fca8dd6800a276dec4045d1be3fd9e1bc243b51b37379916ab3349488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982164, "uuid": "8482e486-539d-4438-86ed-e766ebc44093", "comment": "Malware payload (SalatStealer)", "value": "fed0b1283b188fab9579b2df55527c81ae8cf732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982164, "uuid": "a6fce2f9-812e-4d41-a89e-a909560297c7", "comment": "Malware payload (SalatStealer)", "value": "22eb297bddbcacfc36d2c4738f1e6c429096d0517efbc81191220feedd507ff3a29f92bdfe3a78a0b9875cdbd79f20de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982164, "uuid": "bf6e6633-869b-4bd6-be42-a6c5c1420ec4", "value": "T110062369F79A24F9E627C27DC8438906EB727C41039096DF23A509866F237E05E3F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982164, "uuid": "0be40fc1-a09f-43b0-b2c3-4586dbb0a8d3", "value": "4fea8f461ff7027c19f06a8dae23613b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982164, "uuid": "073a0593-64a4-49e2-bf6d-82f13fcfc9e0", "value": "49152:GQ45wQWHiybTwhqVKvP1bIlYBLvgqY62ii7AZ7x4XIh2uSC6oW0L4vQoQbJjLPq7:Gd5wPH+UyVBw7AZxM+gCVpoMJXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982164, "uuid": "2894fda4-624c-4d2c-89af-d9c218e8e401", "value": 3865050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982164, "uuid": "0aca9371-8a97-48ce-9bfd-febe1b7d4d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982164, "uuid": "6007e130-b43f-47ed-963c-32cacf6e4b46", "value": "13b2479fca8dd6800a276dec4045d1be3fd9e1bc243b51b37379916ab3349488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b501239-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016748, "uuid": "8c3bf6c4-930a-4bee-a7bb-442e3573141e", "comment": "Malware payload (Mirai)", "value": "ea7a8555cf40460736b59299704eb9c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016748, "uuid": "16d17b3c-2cbf-4c1d-861e-552584478a43", "comment": "Malware payload (Mirai)", "value": "14d81c7efa69f261ba200acd441dd6592bd4b911017ebdeea3217c56897156b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016748, "uuid": "03e10b38-d822-4254-aa5a-61fe7de0a6af", "comment": "Malware payload (Mirai)", "value": "051d09021810df31f2070be8776009dac78e3c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016748, "uuid": "b625590c-bda7-4155-aebc-5982d3145bcd", "comment": "Malware payload (Mirai)", "value": "28e019dcb08f6129d13354ddf71243e1b242ad45c287d7cac9ec93c752fc0681012479d3ca2a0034146da3df7d822ca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016748, "uuid": "35d95666-354b-4700-a13b-25c4b12a3646", "value": "T124735BC9BA43D8F6EC1A09319077F7375B32E5351128EB93D7A4EA33AC53600A54A6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016748, "uuid": "19bd8bfc-2a21-4a61-951c-6566bccbaffb", "value": "1536:4Gr92NLlhJTLriisQGrrU37WadRBJyokbX5Yo9cxHpQPKY4xkZanRs:4GrohlhJHrwQGrILWIRLy/YocH6SYiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016748, "uuid": "82af9cd4-a9fb-4943-851d-815db4804376", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016748, "uuid": "79df0392-f7b5-404a-bd13-2ac1351bd3e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016748, "uuid": "fc29b7e8-a7c1-4ae5-8a0d-56ca0951edd3", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0a5a2d-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016752, "uuid": "dfc2b0ce-0566-4669-8599-87b62fd3c740", "comment": "Malware payload (Mirai)", "value": "6d676653fb9ad4e69f9206fa479cfbe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016752, "uuid": "d5ba1c04-b6fb-4213-9b2a-017233cc7ffa", "comment": "Malware payload (Mirai)", "value": "14ed719c4493dfc727ffc5a9f7a4b51a93ed6e6bdda7e5f5b0d83fc12042248c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016752, "uuid": "1f3d5f91-414c-4ba0-8324-187a59eb16ce", "comment": "Malware payload (Mirai)", "value": "5a934c61e7ae99354651e914da59575b00301b25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016752, "uuid": "1574e4f6-c420-408d-9467-78224f913b7c", "comment": "Malware payload (Mirai)", "value": "e1c53596ff3c6baa2a6e9623795d84bb59602b3972072ccbe473cca63e4f87d245798dd699f2cf1fc1927477c6b6d72e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016752, "uuid": "d443fdee-292e-4411-8e8b-e0d034b75d8c", "value": "T10E73085AF9819B11C6C6517AFE1E528D331307BCE3EE73139E14AF24678B46B0E7A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016752, "uuid": "bb9895ba-2648-4b71-a878-dafde30dff20", "value": "1536:qdndGZ1qQoxsYtpIfdntZEtaogs35MRilbbkse/Jfu57gu5uYYuQ7Rc:yGZEQoxLtpIfdnt4aybbkse/Jfu5MuMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016752, "uuid": "b4d2d4e4-a86d-4a96-9bdf-d1247a6ec610", "value": 79020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016752, "uuid": "d07062f4-08a5-4df9-a5db-f2fd119f0cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016752, "uuid": "89dcca94-4d35-41a0-8e95-cf0c685b178c", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260f092b-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967615, "uuid": "556a2b0b-f301-4b7b-9b87-39d6c4888432", "comment": "Malware payload (Mirai)", "value": "b91d81017f5dbc3e2b120278b0942fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967615, "uuid": "66423407-8b55-47a7-94a7-c1381d07b336", "comment": "Malware payload (Mirai)", "value": "1551ba5fa923b34c646c81281f095e11f90a32721d679dc3ab0e22e9d67cc8a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967615, "uuid": "96b52c1e-6f1c-4b4f-9116-cc6b4db601ac", "comment": "Malware payload (Mirai)", "value": "05a8b27f0261e47136a1cace247f0e89b19c1e20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967615, "uuid": "850125c1-5504-4bc4-875e-0c6aaf11b7d2", "comment": "Malware payload (Mirai)", "value": "cf3538708ae176284a593ef2c788e2551f856ec496e385dfe2b51e0eb846e16ec8993bbf71c94627c499fcc924200c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967615, "uuid": "4d3a3935-fb20-4a6f-8c7a-00b6ffa8fa4d", "value": "T12F730756B8819B16D5D412BEFA2E118E3323177CE3DE7312DD205F24778A92B0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967615, "uuid": "ac1ee11e-7c03-427d-9e1a-903b57f3b510", "value": "1536:+hnckPeobf27r8KO05bsKI0sO39C8ZU9aW7dDk8M3iiY9ZmFHoe5fYtuz:eeef7KO0JxI0DNDZU9a+9ZqHoeNOuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967615, "uuid": "9d691e96-bff3-4b20-9ba9-08e241462aae", "value": 79016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967615, "uuid": "355e1df7-1336-48f1-95cb-2bd90ea7f97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967615, "uuid": "ec9ee70f-a21f-4aef-be88-2f104faa3ddb", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aef02f-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986801, "uuid": "bae9bdfc-1b02-4092-8a97-0ad57b8b3748", "comment": "Malware payload (Mirai)", "value": "86afc7cfca7d5e428e402747f2c020fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986801, "uuid": "7fa6e5ed-9d2b-4683-a743-ae98d5f56cda", "comment": "Malware payload (Mirai)", "value": "1669a9f6ef308f890600d5c8f0d96619d1123796f65959ea5b39b5284aa83790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986801, "uuid": "1f0558d2-65ba-4142-939a-ca911de30f3f", "comment": "Malware payload (Mirai)", "value": "a26852b5509c8a52152e170104392b324fea3a46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986801, "uuid": "6636d183-e4f8-435e-92a1-686602e1f362", "comment": "Malware payload (Mirai)", "value": "41361e46de03ed80730ed7b2f51888bd529fee98ba8013cc05627403abe89eb555c0cbb63e81fb7ebacab9db01462fd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986801, "uuid": "b313dc82-a330-4ee0-90c6-f4be90cbff30", "value": "T1E5432917B58180FCC549C1B45B6BB636C573787E0239B29A77D4FA22AC46E321E3E9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986801, "uuid": "ee5f28fa-394b-44b8-a206-ae063d03b5f4", "value": "768:l7brunbAPR/jnHs6GzBqNGpMgHmM7t8uhqWE13v2qJOuLqNSZP6oxD:Zbrd1jHXGzBqQpMgHmCWnJau2MCoxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986801, "uuid": "866affb7-e37b-43dd-97a3-a406d1218c44", "value": 58624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986801, "uuid": "62cc7dc0-791a-4b23-bd10-1df7377f2960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986801, "uuid": "06dd0c20-d866-45fa-9fc0-1c572ea67a6b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c967fade-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972614, "uuid": "6f1f8e09-6de2-4b6e-b675-65f43c1320f9", "comment": "Malware payload (Mirai)", "value": "0ea0e11e7fe9fc046c34f3cb7da20f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972614, "uuid": "c4f928bb-88b3-4ceb-b423-58bec029252e", "comment": "Malware payload (Mirai)", "value": "16e91ddb5ffb6ba3c3b9ce62409bd29f5f054b1e07ac1623778508133fc5f9bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972614, "uuid": "3839649d-f25f-4a65-a78f-249e351fb390", "comment": "Malware payload (Mirai)", "value": "399aef562b3538b806548f06935a2090efc9ac10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972614, "uuid": "0e92e1aa-c751-4946-8d5d-c62bacc4e7df", "comment": "Malware payload (Mirai)", "value": "2e27dc0906499c36ff2c751031e9b5c664e863186e474f170b4a84082c6695f8fc4ee21b38478a1c982ae3d7840422d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972614, "uuid": "ccd8956b-a684-4d57-87a4-daa09019a49b", "value": "T116F32B46EA418B53C0D22B79BB9F424533239B24D7E763069928BFF43F4279E4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972614, "uuid": "9bde5409-ccdb-450a-82cc-2d33d6e3bcc0", "value": "3072:o7fSpXcEaOltwq1iizjwTpvMB6o1GqXFvxqig2/0dH5AeM/9BjWmqS6YStQ6:AfGcEaOHwq1iEjwxMBrIqXFvAd2/0dHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972614, "uuid": "1a6bbd30-b692-4fc1-bae9-a5de12700e54", "value": 171884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972614, "uuid": "7b7b31f6-79aa-469f-87da-249a57961a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972614, "uuid": "86cd45aa-d1eb-4358-9115-9a22f013e839", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decc5338-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995413, "uuid": "7b551a62-6082-439f-949e-7580f51b7066", "comment": "Malware payload (XWorm)", "value": "0573cfda2c21e19f07bf64d3ab98e54d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995413, "uuid": "abe7a299-ccb7-482a-ae34-9582c6e5f82e", "comment": "Malware payload (XWorm)", "value": "170c3fce8e471d7f0b4c302928be1e520163a54731a06199f5d00a97c80dc495", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995413, "uuid": "d07325ed-57a5-4e5e-93ec-87277d53c51e", "comment": "Malware payload (XWorm)", "value": "615ce5b13e8dadbc7e1b1a77ff7df9bf1d24d8de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995413, "uuid": "1d4372bb-1b84-43d8-ac54-72bfc3740f9a", "comment": "Malware payload (XWorm)", "value": "adb79cf87f6e99171024bf9fcbb6e55a481ce66551dddc7eab304be2668a8a000c400859c83fcfc50ac87fd7e1961a98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995413, "uuid": "902a7a4b-f08a-4097-8ac0-f4dee48eb946", "value": "T1B7631AC03EA4559461B5E4C68CBBE82B05010AEB8E576FD909352D3D8DCAF62CAE51FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995413, "uuid": "d9104bb8-5faa-444a-8adc-abb56e79889b", "value": "768:I8w/h62/jWs6oS+xISN0vwpaMjCdkfScBYrwz2y8kTAlGB:I9l/AoSSMe2usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995413, "uuid": "6b534b3d-37db-486e-9666-7fa6736b1654", "value": 72448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995413, "uuid": "9e219bd9-c4f7-47bf-93f5-1fcc51c1d117", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995413, "uuid": "7239dade-6629-4cec-a97e-378b6527d9d9", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508342d1-e4b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767010636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010636, "uuid": "5d69cc66-32ce-4f0d-9141-06cc81234d1f", "comment": "Malware payload (Mirai)", "value": "18eace1c3ce5a5ea2acb56413fbe8e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010636, "uuid": "814d4e2e-5d23-4098-beb3-5d0075b215d3", "comment": "Malware payload (Mirai)", "value": "171bec04821df9d346d7595c452d51040cf0ed5b741f9d5c3773ad305a246b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010636, "uuid": "f3c3143a-8ff9-467c-9b58-f3c027fd592c", "comment": "Malware payload (Mirai)", "value": "98accbd6e8d59781479c1f6fdf77e3c846d7168d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010636, "uuid": "dd9504a5-7a2b-4076-8fca-04b4aec70abe", "comment": "Malware payload (Mirai)", "value": "f0ce1e2b4341f4eacb227ba4fe4405b53cc4aca6407e5ecbdfaae054406646744f3ec52fd1ba9f0e997e2dd9ebf5f02b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010636, "uuid": "8897f952-9aee-4500-84a5-2fcacb4323a5", "value": "T1AF631297FFCC1FECE8DA27F907BA22DA27919035547741B809D65C8A815F96020DACCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010636, "uuid": "efc44366-35f6-411f-9528-66cf995731ed", "value": "1536:Ja7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgCjrPl:47Mbp2L+Xqdfoz2svjrPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010636, "uuid": "90383438-ca0e-42c6-a67d-a10f8f5dd522", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010636, "uuid": "8e6a18dd-31d9-43e3-ade7-7f63c44a9a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010636, "uuid": "1c6ebc2b-8412-4ff4-be55-b74a6ad3e0a3", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984ef166-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767028366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028366, "uuid": "f5577612-9bce-45cd-a5ca-e9671cf9d357", "comment": "Malware payload", "value": "3f3c1a3c4c2ef86b3602d4f2be9b9abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028366, "uuid": "db9b88cd-90ba-4359-ab1f-244df1e9e990", "comment": "Malware payload", "value": "171eba62ff1726c421e64868ee492710ba274a7f4d5b1ec5e1835431fb0ab0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028366, "uuid": "488224fa-54a2-440f-8447-a0ecb20bb627", "comment": "Malware payload", "value": "d4b3d3b29f312010c531158126e0a32440458a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028366, "uuid": "b8e28bc0-c0e8-4376-9141-00bb1a43efd9", "comment": "Malware payload", "value": "7e9a068d8ce3a558d2469589c954b9c4e3230c5928c0240fdd44a5b6cce8b29b395c45c8f2e427856e7236da275fb835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028366, "uuid": "24683d68-7a5c-4f24-a625-17e1564cda9f", "value": "T1A383181A7209C62FC17B0739E4831644EE354E274603DA593DDCB0CAAFB6715CBA279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028366, "uuid": "4791eed6-08b7-475f-8da1-2e7d99ebf707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028366, "uuid": "be23fc77-26ee-4ca5-994c-76abdd319613", "value": "1536:pOpwLXzmKmvaJ9XMWS2VeHYBbSnoO9Thn:p4wLjmKmvabXv3V1AoO9T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028366, "uuid": "7ee2bdd4-65ea-4f0a-9277-0eda2df8e12a", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028366, "uuid": "fdbfe400-9a77-4c32-84af-409c0d88a74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028366, "uuid": "57f6110c-c9f9-4f9e-b4a8-6bb00e5b9f7a", "value": "eszja_1.3.0_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4393d70a-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997729, "uuid": "f2b1e17f-d77e-42e4-a3f3-cd8c46f6156b", "comment": "Malware payload", "value": "44a3cd5f50df6748c1375eda8c35e652", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997729, "uuid": "68af44a1-54b7-41c3-82ad-c0a447138c28", "comment": "Malware payload", "value": "175b950ae076d4cddcb1711566e19d908ff546a01e99bedb861970d331187f68", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997729, "uuid": "87068d27-4aab-452a-9801-99142ebd66d1", "comment": "Malware payload", "value": "96fed75bdd011a465dfe493d7ea5060a8bd54e8e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997729, "uuid": "5d2ac7cc-cdb4-49be-be59-da8fb431346a", "comment": "Malware payload", "value": "ab76c95fcbc4355376c67d3f9b44574821e810ca29cb16b1517f48a31a128dec5d6338cfaf2eedfd3caf2514e2714424", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997729, "uuid": "4159c893-f68e-457b-a688-da22ce0334cd", "value": "T15A51A8000EE61268F3B38B715BFA73268A37F8A5DD394AAD004D86445733620E4A5F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997729, "uuid": "a82a9fb2-91bf-4a55-b68f-7bf1b9b0d9c2", "value": "24:8Ayw/BHYVKVWO+/CWNYdlqbDUBsrVbPLpYhCFCZs26dd79dsrabqOl:8y5aG1arVrLpLgp6dJ9AauO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997729, "uuid": "8a78ab1c-4409-46ae-9bad-c15742af05f3", "value": 2854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997729, "uuid": "18def20b-7334-461f-adb6-85401175adb9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997729, "uuid": "ec0c60fc-aadd-4d05-9d98-0ed5aae58c8e", "value": "lol.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4d2388-e511-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767052480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052480, "uuid": "bd949cfc-65a8-4dfa-b26e-abda69cb168b", "comment": "Malware payload", "value": "a950e0fb47fb38ae663efd8d198d5a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052480, "uuid": "a3bbc7b8-fe64-44b8-942e-1d86b704b02c", "comment": "Malware payload", "value": "1762b863ca4b76aa1fd2bbf5d25a653b3977e005ab20f481a73c7872cc5b0697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052480, "uuid": "a4ad53be-b2e2-4807-ae52-bba390a68a1f", "comment": "Malware payload", "value": "86c4cc658b2bcb6880c15073e38019708551b131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052480, "uuid": "5f2b6f26-b33c-4920-863f-b6338a899161", "comment": "Malware payload", "value": "8c076aa79cdce30b8ec476cb954bd20678820e71699e1379d6a9642371a072343f5b38d189d8998c102bd800fb7b877e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052480, "uuid": "3d4cb3d3-2eed-435a-a04e-0cdee7de94ef", "value": "T1E7C66C01FE8B94F5E9035835419BA23F23356D048B38DB9BEB543E2AFC776921877609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052480, "uuid": "0331f390-3196-46aa-a615-6ba356d75f02", "value": "49152:sO4iGkRdfb3nEKhs+gNcXgrEqgzJVGyGQdTxOHUmGN+K+U4THbWjkWeXsK3hMJRB:3BGQfHhpUZ2RQZWjkiMhMJRHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052480, "uuid": "85cc8276-e64a-4927-a3a8-6c682d510b50", "value": 12097536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052480, "uuid": "3f06cdaa-9dde-4fe7-8033-761b4e7d6c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052480, "uuid": "60416ad1-59d6-4b2a-a194-d9e9b05096ad", "value": "krph07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2661eac8-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995103, "uuid": "ccd40c21-1fb6-4c2a-88a6-6ae4e1a96b43", "comment": "Malware payload (XWorm)", "value": "35761ab7261251b27f6fd5c104e1eebe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995103, "uuid": "a0449619-8058-474d-97c8-dfa82dc444e0", "comment": "Malware payload (XWorm)", "value": "17a2d9dd3754c94a082434d81e7fbb09a9390ec2f55ccb2391f6178376b8cb1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995103, "uuid": "0323d6e9-5813-4119-8b4c-3bcb083ddb47", "comment": "Malware payload (XWorm)", "value": "8401d8983c8ed7219cde1b6c5bc1bfe1bc8b8fc1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995103, "uuid": "757a02ad-8900-4e3e-b9e8-f3c2410df266", "comment": "Malware payload (XWorm)", "value": "05aad3abeaa4be9ef65ee7b97446149a2f0fc01dcb70308cdcaedeb48068f281fb722f6447483a8c4c16c1414fc99f5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995103, "uuid": "a339f8b5-f4f3-4090-b100-458feadbda5a", "value": "T1027318CCB74DE5F12229030660E506F66594B8D688DA087F8D27E97CD3036EAE3B5DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995103, "uuid": "a00f51e0-afdd-4dd9-b652-d92562ace936", "value": "768:I8w/h62/jWs6oS+xISN0v11uuPheqqQtOrqSZSROfONX2eJDZ1i+ELR6LP4BKb8g:I9l/AoSSMCOiusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995103, "uuid": "585ef953-9586-46c9-be66-6ef0d9bffe84", "value": 73421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995103, "uuid": "90b9e5b2-55d5-4964-9a3c-eb1b8d8de36f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995103, "uuid": "07b5ba59-b47a-4e48-b08c-a68dc7677565", "value": "invoice-1645080830.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd7c5dc-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968162, "uuid": "717a9f2c-8493-48a7-b79f-b71b21bdd8dc", "comment": "Malware payload (Mirai)", "value": "5e3d468eb2ff926f28fde51b859633bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968162, "uuid": "edc6e7a1-b370-4907-b341-87208380eb16", "comment": "Malware payload (Mirai)", "value": "18260446ab7af15ccc304bc6c672d25a4a9546b622ca3042e731d952c69e179f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968162, "uuid": "8cb6b8b0-e900-408f-b0ca-eaaab526595a", "comment": "Malware payload (Mirai)", "value": "34539ad6449f00df43ddf9b8a26588fc9dc8c89d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968162, "uuid": "802bfdc0-b6f9-47f2-aea2-46c37c640fc2", "comment": "Malware payload (Mirai)", "value": "2d0cf01409cdf28ab58a3577d5c9549ac3d3bbdeb910bf8c28bdc2fc4880512add89acd8249da4db4d7cf52c45f1823c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968162, "uuid": "d07c480b-e41c-4e3c-80d3-bc05ac847c1f", "value": "T130532C02B30C0953D2676EF03A3F27E193DFDE9111E4A684255EFB859272E3252C6ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968162, "uuid": "f67bfa46-5933-4a10-afad-f82d8d7996fe", "value": "1536:hrEgZrv1wDhKyqj5cfduiAQyk6P0PTEvrSpM+bijxV:nZBw41907EDSpuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968162, "uuid": "b896fdcf-0612-4c47-a647-52aa4bc671c1", "value": 63280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968162, "uuid": "40475a64-5ae0-4885-afd8-b826ac67cc24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968162, "uuid": "8d96545b-63d8-440c-baff-5c67572eb0fd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c3e06f-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013009, "uuid": "dbdc04af-e81a-4544-b7bc-c1e65bb28196", "comment": "Malware payload (Mirai)", "value": "6ffdc2823a38ee4519dcb1fb5663afd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013009, "uuid": "5ae80caa-fcfd-42ef-a426-570a1549b907", "comment": "Malware payload (Mirai)", "value": "185f9f47b9c1685c93650262779ae3ab9a436cf14450ef136a8d5226dc046b9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013009, "uuid": "e72c53d6-2dd2-4ebf-9e35-2c9ba30eb0b3", "comment": "Malware payload (Mirai)", "value": "dd94a6c833f52200ae4ecbf54bfa00f04e9744cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013009, "uuid": "d52294a5-f97c-499e-a75b-ff73f3d057ba", "comment": "Malware payload (Mirai)", "value": "5255c482cfeb401f61192c93f30609f3030a92785c47f838c3d070e550d8df7ae5be0ecb1d57605e54932fc3794dbe75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013009, "uuid": "84e2281f-2be9-47c3-9a34-92f61ca0bbac", "value": "T126638D77C96AADA8C54C55B4A832CFB51B536100CA431EFB4A89C9B64003DDCF64EBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013009, "uuid": "b58bc646-d079-419a-b88d-0c2d47c429ca", "value": "1536:/aqwt1XSfXWoc8V/gJKD6XUd+uh8C1UuyBoTAbVR:/dqSuWIad+uh8YVIoTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013009, "uuid": "813cf576-7dd2-4312-839c-5d0d17f7b1d9", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013009, "uuid": "5ef01e95-8d0c-4dd2-9285-a0f45aef4291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013009, "uuid": "ccb35f91-e5b8-44d1-a74f-d07b038acfb4", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfa816b-e494-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766998606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998606, "uuid": "de44f2ba-f00a-4dec-9dbf-fda4584ea145", "comment": "Malware payload (Mirai)", "value": "17c6a3cc6e31e95367ff530a6fd515d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998606, "uuid": "bf7c0149-d749-4345-8705-8a972d38c5a2", "comment": "Malware payload (Mirai)", "value": "18a41cf0b94de8f36de9607f96e84cfd255e3df9c213e42fbed0638ea58d1bfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998606, "uuid": "5668357b-e49a-41c7-bb35-9b32749bccf1", "comment": "Malware payload (Mirai)", "value": "f95b0597c6506bb332d0097c74f892372ee829f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998606, "uuid": "d6f45ebb-255d-40d2-afcf-83a93d788866", "comment": "Malware payload (Mirai)", "value": "45746c379ef06d36955d6b449383789c3167b141285a902261e8a80bc36d0f0d128df81052848f833661c9af32831146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998606, "uuid": "c2903e85-b704-4542-bf6c-90019d3b4fdc", "value": "T19FA2C031B346D951CBA04976DF6CC644799202F9E0C61BBB320017A97BD682EC1BE5DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998606, "uuid": "86f3d507-d08f-4ebb-8d2c-7747a35bd86e", "value": "384:es1ukZzN+XvhQfTrl+/jbvyrQXOXiT69eSgsjU3/crMqJhymdGUop5huS:es1ukZRKZQfTrajbKrQesLc9Js3UozMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998606, "uuid": "b0b72bc4-0833-4b9d-8950-d0a388186c26", "value": 23072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998606, "uuid": "4ba0fe34-2072-4840-bb38-9aa6d8a3bda3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998606, "uuid": "658c7bee-5e01-40dd-8bec-ee2c8a38369d", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c6ce58-e482-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766991155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991155, "uuid": "2bdd7bee-c2d7-4eff-96f2-11a9ced7ac10", "comment": "Malware payload", "value": "7115c15d2e8c548a6037f20983ffdf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991155, "uuid": "ed68b599-812f-4f1f-9ac0-5687b056d583", "comment": "Malware payload", "value": "18b456fc4cfb723b03b49a7e82b4b4beea29bac55983ce8a6453be963c25bca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991155, "uuid": "2e337e2f-548e-4f77-9383-b9d12dc9628d", "comment": "Malware payload", "value": "c012ea726cb9e268bd51c0d46db128cec7178013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991155, "uuid": "7ff07788-80cd-4336-a6eb-12ae5cdb0c35", "comment": "Malware payload", "value": "eea1aa70d0e8feecd895355b40feeca69ca64da7a1e89ce75774922ce99c2c8a72b26bd681980be4cb0fb1df689ccb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991155, "uuid": "f838c30b-965a-4f0a-9549-368f2665f4ae", "value": "T1F9356C5963A841A9FEB6E0768A12C637C6B17C8A0277871F01E07E777F736B11A1E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991155, "uuid": "f773c88e-a8f9-4f3f-813c-08a57a9f55b8", "value": "a6b79195015e1e45d816e61ee943224b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991155, "uuid": "913320ec-0567-40dd-ad01-d98f5049c617", "value": "24576:JRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamtfdhM4yOzQ:TkxOm+7TjsPnztyDMmaGfdC4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766991155, "uuid": "3d761aac-2e59-4879-ad4d-c6d7549de974", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766991155, "uuid": "b8894601-49f2-4426-87ea-410bfaba298c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991155, "uuid": "0cdf8aba-e2d7-490c-8721-4ff718fccc33", "value": "18b456fc4cfb723b03b49a7e82b4b4beea29bac55983ce8a6453be963c25bca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8b6750-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031007, "uuid": "63f58e8d-fe25-4b9e-938a-9bd47ef69776", "comment": "Malware payload (Mirai)", "value": "8567327cfe6aca43e90f2e67cabf3bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031007, "uuid": "98388b8e-89ec-442c-8ea8-c4db2e44d2d4", "comment": "Malware payload (Mirai)", "value": "18d7b93a1fcf8e3482c26cf809c24a509ce09717ece26d1b6778da52b276f145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031007, "uuid": "fb7b1671-dcdb-4aec-9770-e1de5347e7db", "comment": "Malware payload (Mirai)", "value": "8e1aaac575b4d53a6c1e2b5c84d8a20e5c300b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031007, "uuid": "f3c40b0c-408c-4758-a2f1-f574394ae525", "comment": "Malware payload (Mirai)", "value": "8c737e732997a9bba53635a61c8bbdca467436a8a8f6288144487c4476e90a95e5d488ac1cec105079c5f8f699e0785d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031007, "uuid": "bcc5ed42-2fb9-4750-8fec-010c0e6dbd80", "value": "T1055339C5A943DCF5EC1905712477FB335A31E1361025FE8FE7A9E932B852602FA0A69C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031007, "uuid": "a4a3b862-666d-4127-85c9-68a32c772ebc", "value": "1536:k1jR3o+3ST8Y2B/3oo+eElfH8F2rJkwjhzPdLFiGZ1uRJR:k114ISTn2ao+9Bu2rJDjlriowR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031007, "uuid": "460c3e82-6855-4494-a9e3-182dd69f1504", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031007, "uuid": "dfd149e9-c619-4270-9217-dcf837d98e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031007, "uuid": "afc3bc95-cc30-42b9-8d25-2a5372fb1777", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e0753d-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995510, "uuid": "277806f3-923c-4a2f-ad13-e20b99deee65", "comment": "Malware payload (XWorm)", "value": "9abbc202be502e3d10fa73e947c749d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995510, "uuid": "e0ba7741-410d-4813-bade-4a730248aa4e", "comment": "Malware payload (XWorm)", "value": "18ea9b3c29436194bbd5a33ecb152406762436b242e591499d7aa22c2a847e67", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995510, "uuid": "bf0485de-eaf9-4cf8-8783-a61a3dbfea87", "comment": "Malware payload (XWorm)", "value": "adabec65e77afd631080e08470201c1d611171cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995510, "uuid": "3ef19308-b36b-42d7-8a48-3461e148c9bb", "comment": "Malware payload (XWorm)", "value": "20827f09ef96ef489c2f5ba5f7f692beb96562fbdc64103e6325f311d19a34ab2412dff3426cd9fea7e76208915aea80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995510, "uuid": "f95afefd-5ebd-499e-9735-f67135930a89", "value": "T1A1632CE3AA9634CE638DC1D45F8E723E54A681766D9B95331CC9D930120F8222F6D72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995510, "uuid": "51b9cecd-81dd-4679-a77a-8f6c967d8fa4", "value": "768:I8w/h62/jWs6oS+xISN0vBKCpBkm8q4XgQgbeRTmTanPWcGWYvqS+f/g2pJ2y58i:I9l/AoSSMW+usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995510, "uuid": "08997349-00dc-4749-b77e-e89d82d853c9", "value": 72496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995510, "uuid": "be2f1620-49fd-4aa3-8c0a-458ef3f245b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995510, "uuid": "732915c7-ea97-47ce-ba1a-47e7387e0108", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a264de8c-e511-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767052435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052435, "uuid": "370a83ae-f7ec-4d81-ac4b-148dbaffb198", "comment": "Malware payload", "value": "a3ed5ac838324f5f43ce4552173f9f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052435, "uuid": "72ab1210-f37f-46f1-8501-9f9a93b79ac2", "comment": "Malware payload", "value": "1949679989d5251fcdcef73f4531d88705e497ba90dd8acd586bc62e9b2fa1f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052435, "uuid": "5144362d-22fd-4d57-b958-0b4ee04422b4", "comment": "Malware payload", "value": "f32c65b457574df1009003d806f875037769e488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052435, "uuid": "8e8437e5-4978-4027-b32f-c8a227631d0c", "comment": "Malware payload", "value": "ca4c293c519bd44493929b27729e7eee79af90e7281f4a7734f976153ecb5a7d5586d422f7b0b83051b2c09db0f9982e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052435, "uuid": "9e4c4258-a3e5-4143-913b-44fcc94d6c5b", "value": "T1A0083360F27E460FFCB69438CB226FD6CED90394545F08E2AA5D3A09BD724FD368115A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052435, "uuid": "74d6d4f3-2461-45b0-be5f-6a7a23108ad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052435, "uuid": "d9f263bc-5977-476a-8f35-246a304a4d16", "value": "1572864:Xa7ue01mHWR0eX3B6m9ZFCPsXJyl4ECRQR1ae7maGGBNbqtiYJ+j+U:Xa7F0bKeh5ZsPsXQOECAsIm1GBZKJ1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052435, "uuid": "bfa10118-54f7-40ba-8952-2e70afc8e0d5", "value": 82882048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052435, "uuid": "a13a3c1d-ed10-40a9-a3e3-d7d4a3f23db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052435, "uuid": "661b0425-ec7d-4b1f-b49c-a9887c356922", "value": "HWID-Spoofer-Pro-Portable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2318311-e49e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767003096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003096, "uuid": "5b77409c-06ef-4ed0-98ba-c9f07b028546", "comment": "Malware payload (Mirai)", "value": "94844ccf04690acf23f889fee376a90b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003096, "uuid": "038e9ec6-f20f-40ed-9178-b32c33171cdf", "comment": "Malware payload (Mirai)", "value": "19c4473a15313bdfa0cada24d9c42f77e9627d30baca4e18b4aae0f41fa8b9b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003096, "uuid": "a93a72f2-e0ec-4a60-9bd5-602751eb3c28", "comment": "Malware payload (Mirai)", "value": "655a560a8a6915348d466302727618637a488cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003096, "uuid": "f478bf36-4e20-42a6-9b00-cd549675bd16", "comment": "Malware payload (Mirai)", "value": "c8993bcd6bb4f86f5381cc2cb3551e3388844c8e310dce206acbfdef0a640d23efb957dc6df03039147d4c67b0af6ab9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003096, "uuid": "53f0f1eb-c992-4f2f-aef8-a3c475c40bd7", "value": "T1D904A91D6E228F6DF768863047F79E259B5823D523D1E684E2ACC2141F6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003096, "uuid": "1f5cda9c-e790-4458-8922-dc040d2de477", "value": "3072:AJ9X+sQcy+02S893Zyk7IF5BelSAL88J0:K5Xry+npZ9keLLBJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767003096, "uuid": "37a6b95b-46d9-4fac-b123-99c43cdf4eb2", "value": 181928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767003096, "uuid": "4c047f21-83cb-426c-9e28-a1317dbf4066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003096, "uuid": "95527bcd-29b1-47cd-9104-9d3b4e50ef46", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91d721c-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969177, "uuid": "3a355b16-bec9-4ca7-bac5-0cf971833336", "comment": "Malware payload (Mirai)", "value": "e9c3f858e2330d68b46b3cd3afb50084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969177, "uuid": "d79b976d-9c5f-408f-b2b4-342ae6d1e7b4", "comment": "Malware payload (Mirai)", "value": "19dc09610f3bdc07cdc8ebee91d381d3662f96c7a98b4ab2c63b5f5a0063a9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969177, "uuid": "42f166a0-3530-4138-abfe-1b8b98fc52ee", "comment": "Malware payload (Mirai)", "value": "07c35ffac9d79c02bc0e7b3a8eccb086889e25d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969177, "uuid": "9bcb53de-c111-4755-9169-3d13582f6721", "comment": "Malware payload (Mirai)", "value": "61990cc5175c1c9ef244d5779cfc9972359b5beb1b310bc74bba5437618b07942d7d17e4d6bc0d2dfea754651f412674", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969177, "uuid": "298c05f9-d01d-4bf0-b0ac-4d3a201a5759", "value": "T1B6638D2388A56578C0E50972F0F3877ED747790286090F1AD5E3C2AB2843F9DBD6BB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969177, "uuid": "b4690e17-7d4d-45ba-91c7-b11545ebe121", "value": "768:GIvKOBQFZJpDVsGOgX6Fs6rWH+e58MXSfWersoOL3rkUgu0vmZJnn3EAMJl5nr/G:xvBSGI6y6q/O4QWCRAYFvqJnhkHnzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969177, "uuid": "9bbd046a-e691-4b9b-aa4f-94c32b1583ee", "value": 67316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969177, "uuid": "36a32421-0dd6-4199-9929-0f8c6bb5fbec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969177, "uuid": "4b20dd7f-db02-422f-b54f-c506b63e5a73", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cf9912-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028407, "uuid": "a6d266fb-0122-43b6-a68d-a020da3f4659", "comment": "Malware payload (Mirai)", "value": "4c8718c906351108368179978b0e1de6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028407, "uuid": "c7c31472-c93d-4ef9-9ac8-11ea2d43893e", "comment": "Malware payload (Mirai)", "value": "1a05a748b27e7aac5fee75e473f4d9503a33f7f85c784a7d32c7a0a75f9dce79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028407, "uuid": "907f1244-3d25-4836-bf6e-216a64b38753", "comment": "Malware payload (Mirai)", "value": "9785b969695553a1de66c12b9033268b9e587f01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028407, "uuid": "67da168a-569b-4412-9686-1c4dd9f7fb70", "comment": "Malware payload (Mirai)", "value": "de9a337663d4d7a83ab02990ea216cc2f873cdedbfd060ab1b0559aabe073fd7182d884075a2b56a1ee2cc4fc7b962d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028407, "uuid": "d5da4ea8-ad2a-4621-bfd7-5c10fe472e29", "value": "T13FE37DC5F743C0FAE85605B1107BBB369AB3D43E242BDA83D3B95A32EC51601C51A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028407, "uuid": "c46fcc83-b6b7-49c4-9ac8-143c19fa2d72", "value": "3072:t76XRxjzXlN8HugJXeLzxwcDj3kIRVYVviREHJhIB16y:96XjHXl2JXk0MmvWATy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028407, "uuid": "8327333b-328e-4f5a-98ea-e870b8814d5a", "value": 154056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028407, "uuid": "809b6275-69ff-4f9d-957e-376ff7a20be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028407, "uuid": "9f090a03-43a2-45a8-8d8d-1f42e85f977a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bbeb8f-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986568, "uuid": "80df7476-bc6f-4c6b-af84-958ef30ff10c", "comment": "Malware payload (Mirai)", "value": "81c07f504171fa26472854a5398b4c42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986568, "uuid": "e5d4e327-80f1-458e-87ff-72cd5b0c0194", "comment": "Malware payload (Mirai)", "value": "1a17b1a9a04847ef69f9b35c2d8b9f465be7df3a5b4086ce78f7e8a46e91639a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986568, "uuid": "c4cbb7d2-aad2-4713-97ea-710b9d7edc9e", "comment": "Malware payload (Mirai)", "value": "94a173e07a46db134c5c57ee04229765d093f714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986568, "uuid": "0132facb-9d52-4754-baf9-b33463d35265", "comment": "Malware payload (Mirai)", "value": "372d005e55a29bda53724832f1fa4c836e9236a850b4c0ceb031da8dbf674fea2eafc2e8b5b566a72944ae455718db3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986568, "uuid": "ef9e2c2e-653e-4ef5-8015-6afa807b95f5", "value": "T196334A35B6752A1BC8D8987D22F74368B2F4168E28F8CB1F7D720E4EBF6085065172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986568, "uuid": "1d142438-bb47-469e-9051-27d1b3977898", "value": "768:vj72UF999I26p/d1DNwm+BF4HpX2KlNhdtBBYyhju/QJwO+351TSOj:v3pF1IDp/nNwDBF4HpmKlzB+yIQJa3e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986568, "uuid": "18c6f8ef-47fe-4a63-8122-1d32584b677c", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986568, "uuid": "200a56e7-cb95-4e7a-bf2b-b9301f6bdc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986568, "uuid": "1025d6e2-d097-4b3e-863a-6582bb6f8e87", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553d6a46-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026965, "uuid": "e8e7f8f0-a186-418d-b4b3-72ab0830e15c", "comment": "Malware payload (Mirai)", "value": "53870ef46cf2ed0b09ef274caf2f28ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026965, "uuid": "ba042fbc-fe3b-4641-973d-b264b1b6d617", "comment": "Malware payload (Mirai)", "value": "1a949dbf72f70c2cfb951ddc8c80c2a0651c6fd882500892b6351af45b8cada4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026965, "uuid": "b0e19160-b306-4d33-8bbd-81c3407289a0", "comment": "Malware payload (Mirai)", "value": "5271b6e283dab1eb15d49e1bd641e32b765cf95b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026965, "uuid": "d5b49cf9-309a-484a-bbc5-4dd4c5672095", "comment": "Malware payload (Mirai)", "value": "cc1947a0f8840f10476140ee8009b8c5617f52dfe449eab686b2f75919fb47f917b601abd433c36a94d12f7a8661db8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026965, "uuid": "957d1e32-bd20-4432-8bf4-ddd0ba64f354", "value": "T10153B506BF210FB7EC5BDD370AB85B0524CC650A22A93B393D34D91CF65B65B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026965, "uuid": "22dc9c7e-e5a4-4eb3-814a-a129d7111685", "value": "1536:cgVsLY6bv3pij15DQDQU7CQ8GAP/N5uY:c4h6bvpifRvTuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026965, "uuid": "801fac56-4f0e-4489-a82e-645db9c2043a", "value": 64940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026965, "uuid": "2062f708-becf-4565-b1b0-455e996830c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026965, "uuid": "ab376784-0b7d-48a2-9b82-2d986ac09475", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5140e694-e512-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052728, "uuid": "d388bbe9-12a2-41c6-a318-e1823c22f6de", "comment": "Malware payload (Mirai)", "value": "5bbfd4228c1489dd1f509e4fd1bbe93b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052728, "uuid": "d69ad1e7-b522-4e7d-a6c6-769bb7d5da71", "comment": "Malware payload (Mirai)", "value": "1ae9862fe26724e4b0a00ae8d3eec104404b819c824121f414975712133e250f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052728, "uuid": "f5d6d15f-eea6-4033-9a3a-45b81ec75c67", "comment": "Malware payload (Mirai)", "value": "2acf2cc62d74fc818fe1028dc577d3d1f4fa6ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052728, "uuid": "ea7050ec-d52d-4252-bcaf-7bba5b229353", "comment": "Malware payload (Mirai)", "value": "66e1a8ee413349fea0029f3daec6c417af131211b228145eca55f99eb154191e6474629fb7c1d61233d888229acd4b78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052728, "uuid": "4a5c4d59-529b-4048-b2dd-215b7b575b57", "value": "T1DA536DD6B404DF3CFC0B9A7AC0170E06F524334696971F2B97AAFC936DB2198C916E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052728, "uuid": "e14b19e6-064c-4241-bfc0-fa180613644f", "value": "1536:F68t2u3vP3se02AxaQrE4r2QU8uPqLRFftkcLFDPe:F68t2C3c2Axr5r2QYqXtHJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052728, "uuid": "2a56e4a7-2f4c-435d-bb1c-9664c4ce349d", "value": 64164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052728, "uuid": "fcb42599-ebb0-4813-9045-aff0f551b399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052728, "uuid": "b780cfdf-16d2-4cf2-96bf-7cb479d0f489", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29359e48-e451-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969768, "uuid": "24b941a3-024a-48a6-b323-a800f8227a4f", "comment": "Malware payload (Mirai)", "value": "0b154866094c1ba4a5f7a01cdf359a25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969768, "uuid": "8e236d41-0bf0-4165-a75c-c2894c3d8701", "comment": "Malware payload (Mirai)", "value": "1b033adf02be62b74303a8bc646f83a369ac0075ad337c74852e3693aa599765", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969768, "uuid": "8a227c4c-f820-48cf-8e3c-1501614e8055", "comment": "Malware payload (Mirai)", "value": "7d10a08d659513a06090a34f4ee946995d4512f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969768, "uuid": "e90e59bf-2c2a-4c8d-861e-ad7c7be25c39", "comment": "Malware payload (Mirai)", "value": "c2c7e8b160d5ea23be6d61fb0ea638384c7a94abf4bebabb0c395ac85d110f6f3d61df7d33ece772d3bd4eddcbc46565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969768, "uuid": "fb5c7db6-e19e-4282-82f7-9cdd43163940", "value": "T1E76302B8F156B531D96F5AC59F8CA6A83FF52F8B6B1344C334EB27913251C3A1084E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969768, "uuid": "ee168102-2c57-487a-bbbf-fd9aa37a934a", "value": "1536:z5ULzIz32cLH0s0IGGTpxuRANHiGqS3XvAMimu66RuX+SB4u+qgw09+:VUH42cLUsQEuRsizSIMvB6de4u+qgwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969768, "uuid": "504fc93b-52da-407f-8e5c-d1cad24819ab", "value": 69152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969768, "uuid": "0efedd08-bfd7-4e57-91eb-79697b2e4fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969768, "uuid": "799f758c-a0c7-468d-806b-2b6fec5cd3c4", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4991f26-e480-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766990215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990215, "uuid": "647d8d08-4ed3-4c17-ada9-aeec612c3ccc", "comment": "Malware payload (Mirai)", "value": "b7a6c1a5a19fc4be13406e528ad395fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990215, "uuid": "77944a08-1bd3-427c-9a2e-59f8322f5e1e", "comment": "Malware payload (Mirai)", "value": "1bd69901f03a380a12f76a02928e675c6300d8193ee368c4e60aa5b153a5ed88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990215, "uuid": "df751689-9168-4625-9fce-ba0eea6391aa", "comment": "Malware payload (Mirai)", "value": "12ef70b7e299d4e1d376a7f441886b7003154c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990215, "uuid": "6b418947-cca3-427c-b33d-86d47f49630b", "comment": "Malware payload (Mirai)", "value": "b071fcb7c6ab70b48bdc479bbb90e7863cf986456a1ab3d9b40cfe651226526df37ab3c8f7db281d794ad42b68908a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990215, "uuid": "01be9a16-59b0-4368-8830-39215dcf2159", "value": "T1F5936D83E952D4B2D8221079133BD366DB32F53130329D5BE7A82F35ECA67419B513AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990215, "uuid": "d8c3d867-c0b4-41d3-a659-36b52e81b8ad", "value": "1536:9WZZwmdVJGXUGjdyqt+lH4rOLQCgI+8AH1NLWrK8volEtIqMbdzKl9Z4Z36:9CwirGO46Ls34GIolEt7MwvG36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766990215, "uuid": "cac7917d-1571-45fd-b277-42b72994a93a", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766990215, "uuid": "1a28847c-2c0d-438c-a6cb-fc6213bafaf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990215, "uuid": "966f1aa1-4db8-45b6-966c-99d74c8a3391", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f25b30-e4c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767021334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767021334, "uuid": "e1f27ffc-65d6-49c0-846c-8b4e30e754d6", "comment": "Malware payload", "value": "09ca5e5d0a8fd6e6f02c7a8a3be159f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767021334, "uuid": "ba6ed197-2999-4100-a884-1faf0f08762c", "comment": "Malware payload", "value": "1bda2a5a8807eea14c6acc210f77f6dc9e0c5a52d1f3768f2270dff5cfe25965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767021334, "uuid": "b19e426e-490b-426f-9107-7f2332657988", "comment": "Malware payload", "value": "30aded69f6e5cc1bce295086e3940d6b04ecd2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767021334, "uuid": "13e0e688-a02c-48c3-8436-5c77ee1e7701", "comment": "Malware payload", "value": "8e280676526169990f8b4c847a5ebe0c42b93f6919922406e2629fe18f761febc81442af3368f817b847f7856776356b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767021334, "uuid": "cf9e3340-000f-4274-a3a4-7da5c29908a3", "value": "T176945A22A6A1A0F2E59A0C32AE259205BDFE5C108F51959FE3D039F919337C0D7257FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767021334, "uuid": "26fcadaf-949d-4969-963f-b8ebd08c1e41", "value": "c58a6fdd5514cc5114ad09dc07384b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767021334, "uuid": "3f1a84f6-8baf-4cb4-959e-ca97618ef4db", "value": "6144:BxWD14iTIKu+OqfiBSq8NqmIqGOfmXwifg2Gs5Iv/K0l2X4Yt8RGn:SDrT2VPB4qmIEfrs5aHdYtkGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767021334, "uuid": "f3e0dd60-36a7-4135-af63-530fff50d3d4", "value": 425559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767021334, "uuid": "e6a162ee-41e1-4c69-a282-9eb7b66d4ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767021334, "uuid": "e55305c2-b50c-4a6b-8367-d03453cbd843", "value": "\u751f\u4ea7\u90e8\u95e812\u6708\u8fdd\u89c4\u6263\u7f5a\u8868\u683c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b6b1d2-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766969175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969175, "uuid": "e79a94e5-640b-4b57-984b-5626f3e51ae6", "comment": "Malware payload", "value": "d221ce2539bdec959162ea48b795a129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969175, "uuid": "88ceca46-e149-43c4-a9f1-c9259cd0a976", "comment": "Malware payload", "value": "1c00158b5877aa57d5b97f404337c08e7a0df2cd93a4069907a95e9cb3e40f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969175, "uuid": "32dd9d98-bdc8-43a5-8bc8-16daa2ced6cc", "comment": "Malware payload", "value": "149e240533a5536c191909b571f498534f1e21fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969175, "uuid": "a5151e10-9efc-4b57-9767-5943506cd4b2", "comment": "Malware payload", "value": "9aa15a9afc960640d92f2cecc61b0b5e1251fd52f60d30bbcb281e4a5f2e81831fd0e7cc5b9b0a10ca6cf45ec57411d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969175, "uuid": "560e1ec8-7d15-4796-8955-d22d2de96e5e", "value": "T1E8160862BF59EE0FC29832354DA6C23433D57D00C2E025379A56F7192FBB2B4991ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969175, "uuid": "f4cb0762-fadb-49b9-92c6-01122a4a7907", "value": "24576:sq3HUJec5wjRcq9l10HREzaPfl/AIbUnBLlMYMDRQQqyPPB5U+kk59yjV:rC2tHi60l/l+l6YM1QpWPt5ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969175, "uuid": "f47e46c9-916f-4733-9c77-b9d773a90b41", "value": 4371424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969175, "uuid": "8d01bf92-648b-4649-966f-2d22aa77f9e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969175, "uuid": "a1b36424-c0f8-459b-9383-1de23fda06ab", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad18ad9-e48a-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766994520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994520, "uuid": "177d2ed4-a1c4-469a-b813-41bb6bb1ff67", "comment": "Malware payload (AISURU)", "value": "64542974c117c30e5ce59cf27eae1b51", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994520, "uuid": "dad01ce9-1576-4a49-be7e-4e7d88806983", "comment": "Malware payload (AISURU)", "value": "1c2c8906935971bc8096ff8ec466c883723f67ba723f7466c835c21577bca959", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994520, "uuid": "26c84dec-2b35-463c-825a-82223263f337", "comment": "Malware payload (AISURU)", "value": "02ae25d1abae59d13d4bc49f183ca9870b995e87", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994520, "uuid": "6921201b-83e5-4d00-9e53-a9b31cd06290", "comment": "Malware payload (AISURU)", "value": "c2fbac85033136c418cebc0a84184bd055c6a0fa044aeb3b96f22807c1e425cf2ad25c7c36e761041b4c55f2605fe372", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994520, "uuid": "0123e512-c983-4eaf-bc59-735ecd8897db", "value": "T181D30845B881AF10D5D226BBFE4F118A33139BACE3EE7212DD141F2427CA95B0F7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994520, "uuid": "65ed89e9-2fba-4ba8-b8b8-bbc0fb545c30", "value": "3072:dCikENK3ijtw09JIRWSrVXn2xdtlraD+FY4/2xIbu2EedPU1Z4nzP:dCGNK3ijtw09JIcSxn2xdXraD+FY4/2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994520, "uuid": "f0a926bd-d544-426b-bc5b-a0b015ce0cc1", "value": 130644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994520, "uuid": "41623a72-3ddf-4cf1-af26-0c8d57bbb335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994520, "uuid": "fe2bc93f-6e38-4ee0-bd4a-9c55521a341a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ec6fc5-e504-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767046968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046968, "uuid": "6d0b1680-61c7-4e60-b131-0bcf9bbe0794", "comment": "Malware payload", "value": "a6bfdc22c813ca8a029e4bf589092f7e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046968, "uuid": "e4a4c5a3-aa00-49a8-a14f-57e7ae653f38", "comment": "Malware payload", "value": "1c3d8b83c1d456f8ebeea6dda040d1741df965e92157fab965d8f01969f31872", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046968, "uuid": "d96d8120-2d77-4640-9131-db83de3972e0", "comment": "Malware payload", "value": "11a2415882d7c742d684b683d0da2b5f7e105809", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046968, "uuid": "00aba2f6-9967-42a5-aca0-951eab670ea4", "comment": "Malware payload", "value": "4d576710325445612fb845728ac7ebadd954428083f150c5b66350f8f24694af0a5b06a20503e71d08b2a2b35928ec1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046968, "uuid": "ef695e81-cc49-4b30-a6fb-68dc83e7aa02", "value": "T15B1733C467E508A8E85BA93F64D44B73A3E0F43107A18A8F0BB097751FA71ECAD39751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046968, "uuid": "5193ceb8-3fe1-4f08-ad38-f6598b6f584c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046968, "uuid": "43741c2b-589b-4587-90d4-f88a87612e40", "value": "393216:eVuEMFlgFeUEJSgJ2bQt1DPsZg2Ke5eXYK4mHsF5laSlZbYugDWNFZ:SyvkE4gJR1wLX5arEUSzbyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767046968, "uuid": "080aa770-145b-4529-a88d-6097b9b5eef7", "value": 18605155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767046968, "uuid": "b49b4d4d-19ae-4f1d-94ed-c248796ee040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046968, "uuid": "603fbb12-ca18-4ee0-9622-7bad2b10188d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d83e466-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995303, "uuid": "303f2442-d2cc-42d2-b6a3-66fc3b1cf241", "comment": "Malware payload (XWorm)", "value": "89d65ee922806a53c424e3801629059c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995303, "uuid": "2d1383c8-a975-41b0-a538-75a1a640479a", "comment": "Malware payload (XWorm)", "value": "1c56b6599262b95ec11f46235cde1608b6ba6e22f07c83bef4b96cd04f6aec94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995303, "uuid": "953b00bd-154f-40c9-ad53-614a3a465f29", "comment": "Malware payload (XWorm)", "value": "2fed14ba9a4850c3c3d6851f9600d968ff5b524c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995303, "uuid": "d0cb7a45-7ddf-4307-a295-ea779baf506d", "comment": "Malware payload (XWorm)", "value": "bf80e4a5024c6eb6fd2d64b79afe9f84d9f90a5bb4f8b5be6962c78e6c57e1b909da85a6831cea0c7b16555daa9b6133", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995303, "uuid": "68fb2c2f-df50-47a9-8c50-0605e043a057", "value": "T15F632AD6AF4434AC12C91600B34870CEFE4B5FC77E9A001E6A9F7592D5CA0C765F4BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995303, "uuid": "cb89e95e-793a-4469-940a-70705299d3d9", "value": "768:I8w/h62/jWs6oS+xISN0vnNaTTPddkfScBYrwz2y8kTAlGB:I9l/AoSSMnwJusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995303, "uuid": "50baa780-6b0f-4209-8b18-1b010c64123b", "value": 71569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995303, "uuid": "406e5f7c-6bbb-4062-a0b7-8579c9b669bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995303, "uuid": "d0ad0bf0-3358-40b8-8f7a-534ffb56c858", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adac7ee-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995299, "uuid": "e13d6e4c-6795-4f89-b301-2d56d24f3374", "comment": "Malware payload (XWorm)", "value": "f64115eab2ddfcee5f0a455c5f5fab57", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995299, "uuid": "b661ad18-fba5-4783-af5e-9b2500667df5", "comment": "Malware payload (XWorm)", "value": "1c6cf8edb1d30b852943df15208ef0eed5d757c9bc1c4786a66d569dea37dec1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995299, "uuid": "ca6e2775-4b9d-4c39-848d-e1aadfa401ab", "comment": "Malware payload (XWorm)", "value": "cea8d51d8d3e0166c26a5a38ba08c1d27ec3cab3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995299, "uuid": "96976138-6f81-49f8-be51-f0239abe316b", "comment": "Malware payload (XWorm)", "value": "82bafd731a6d3122183414b897316b2bb6da5d13c340a020c49c530eaacfb04639a57e1304753e15f1cf56cecd48b56d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995299, "uuid": "57b23925-8199-483b-903a-238fbb410b9a", "value": "T1626317CAEB8319D878CD364F54C956537907285587CEC0DC6EEBE604F6B2E12B22439B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995299, "uuid": "06064f80-8d70-4763-8718-53c095291389", "value": "1536:I9l/AoSSMGw+OG2TTCzEJhNl1Yr6x7fOBqOi2iTkMk/hE2x7idpnUISOIxkK6jux:I9l/5MBXusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995299, "uuid": "e7bb7ce6-bfc7-4719-81e2-9b6c4596f52c", "value": 70612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995299, "uuid": "10f66bae-7626-4da2-a0fe-a1955a65ec40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995299, "uuid": "586cac34-9400-4314-964d-fed4b05d3ece", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a165b1-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027801, "uuid": "cbe19706-17ef-4f09-b6ab-4be1f9054e61", "comment": "Malware payload (Mirai)", "value": "a25a0d2ebbfa7605ba6ef584c0fedce5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027801, "uuid": "e83776b1-044f-4deb-9e39-772419d56fca", "comment": "Malware payload (Mirai)", "value": "1c6e804cc7978114718208ed3f4eaa5196720edbdd137c7002296621d9d215ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027801, "uuid": "6e202105-20b5-4805-b329-206fd94c2298", "comment": "Malware payload (Mirai)", "value": "d10d8a106f6779e1291a68d0498b41da9f7489ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027801, "uuid": "45e410cf-2742-4790-ac8b-0bc8a352d217", "comment": "Malware payload (Mirai)", "value": "7adb7b1ff3584ad70f25b1fda09d8c30eb2bcee12b3db1921f1b46430f7fae3a592784dad26f900e94a719d500b2ba16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027801, "uuid": "eb0d3626-6b31-4b5b-8003-c0fe9d25eb8c", "value": "T1EA63F17DB1ABED7AE476DB313A5A7DA0F5667878208A05C6CCC8B3AC457DE0119303B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027801, "uuid": "59097edd-6116-4a59-8a0e-8a84e01aa412", "value": "1536:gmytsWeTLXudKmhcbYIJIlbdDAwP61lF4vc8I:gmJWeTLYeNIlhDAwP6lF49I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027801, "uuid": "dc407d58-7878-42a7-a3af-dc5ed65ba576", "value": 71376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027801, "uuid": "a61254db-9eaa-404e-8634-79152357456c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027801, "uuid": "a35943f8-deea-4840-acfd-5ac2a0abf64c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8d0fc6-e4e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035250, "uuid": "92630c1f-a3c7-47a8-b8da-294a946ad4c7", "comment": "Malware payload (Mirai)", "value": "e9717699d4f49c7f69633916e2d76f76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035250, "uuid": "e2d2be83-5d17-498e-b0ff-eaa2da7404b1", "comment": "Malware payload (Mirai)", "value": "1c7df43769da5c6147eea3039611db0ccd21bcc4cea2e651999e60bcfeeada1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035250, "uuid": "c7415341-51ff-4f54-ad3b-55aa00fb4dc2", "comment": "Malware payload (Mirai)", "value": "c205c3b907a59e06b9598e8212c36aa7c814f980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035250, "uuid": "36c4e5aa-6e09-462f-b135-535eaafb3fc1", "comment": "Malware payload (Mirai)", "value": "3f5b171d9d5f61c498ab565a256ca7daeb4fef129636225ebb6362254c16e4420d5267ca938edf20f6ddd3b7854d624b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035250, "uuid": "48936578-eacc-47a6-890b-5d41fe47444c", "value": "T1AB73D886B891CA16C5D552BBFA2E118D332357B8E3DF73139D105F257B8A82B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035250, "uuid": "ea7f4322-d168-4659-8806-3f06a1e3d411", "value": "1536:+RnRPTxKYVZUuvZlLqne7sckYHweMHVw4sSws3NdMdi8jSu56Ntu+7R:AQY3vZlOn8HkYHweMHVw4ejSu56Ntu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035250, "uuid": "cf8014ba-e91e-4e65-988c-452132f63afb", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035250, "uuid": "cc25782f-c419-4388-8a3b-164f3127c124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035250, "uuid": "395f1e74-f7ac-4819-9f9b-29db522d6b14", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9913c276-e4d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027508, "uuid": "1e22950e-a596-4a68-9590-088d6ebeb2cd", "comment": "Malware payload (Mirai)", "value": "63499fe298b8ce091d78a0eb3ca0c1ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027508, "uuid": "65d72273-5d3f-4b0f-adab-fa71e41640ae", "comment": "Malware payload (Mirai)", "value": "1cc55b241790c5d27e51bd75df580cdd3b9df8c67ae7a2b1b78475b99a3fc487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027508, "uuid": "de2168c5-d089-42d2-b718-9014540d961e", "comment": "Malware payload (Mirai)", "value": "b94ff5fbc38c0e2def66abe90b76ca92e1321267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027508, "uuid": "8ff632d7-270a-4023-b846-07a4b8b253c1", "comment": "Malware payload (Mirai)", "value": "b5bab1e22a5ed0d7ecd482ea1ef91b320e69fdd7ebb8e569b450011ba038ee6cccbae3c558c799686610f5814a361fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027508, "uuid": "4f0834a9-11e2-471e-8faf-c384c04337d1", "value": "T1E3147C63D9619FD9C526A1F4A2F29E741B12BC1A4C171FBAF4A6DAF44043EC8F0193B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027508, "uuid": "eede0d60-d18e-4284-ad92-ed2fa14520c6", "value": "3072:VqDBFeHworaAKPI/lW596a8FmltwyqxP9cOJir1Wda07k0KrE:VqDBcwouAFvnFEFqxP9nUAdN7knE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027508, "uuid": "c78c3ccd-37b3-4402-a23f-9e7536e5110d", "value": 204640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027508, "uuid": "963e25f8-ac9a-471e-ac74-a915e03df54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027508, "uuid": "d41fed37-47ca-456c-b4a6-f746e99a7456", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a67414-e482-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766991161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991161, "uuid": "69b20a0a-dfae-457b-bf17-aa27c0663626", "comment": "Malware payload", "value": "b78865fc90622aa27033dca220451274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991161, "uuid": "4a670692-464e-4489-b673-cf3b3735e46b", "comment": "Malware payload", "value": "1cc6e53f7d609e852861c4cf85f686dd70e8b6181785a291749c855a9fd09aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991161, "uuid": "9ffd108e-c869-4eb2-aae3-162633c545d0", "comment": "Malware payload", "value": "0ac2b86e6b36f5ce153e5db5c86bb5faea41ed20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991161, "uuid": "9151394d-214b-4db1-9779-b3482f1957ba", "comment": "Malware payload", "value": "40024bc5707905a87c3c275e7f3c895db9e3b6dc50532abeb90ff6dbb2f80e3f3862a5996888af7e571c5b489fb7001d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991161, "uuid": "df9ac131-88f6-44f4-843e-27c2cb8f39c2", "value": "T14D355A5563E441A9FEA6E0368A12C637C6B17C8A0277871F01E0BEB77F736B1165E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991161, "uuid": "cb749385-f685-45b5-81fc-013916989699", "value": "a6b79195015e1e45d816e61ee943224b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991161, "uuid": "a47ba2fa-8155-46a6-a33c-d4447f587720", "value": "24576:vRaZROMOm8FN7TjsPnzt2heeRhQbJ1WGaQtfdhM4yOzQq:pkxOm+7TjsPnztyDMnaMfdC4y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766991161, "uuid": "7b20957e-b5fe-4ad8-9a32-d9ba158063f3", "value": 1145468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766991161, "uuid": "bb5e7e47-bdac-48ee-9d42-62313617f89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991161, "uuid": "5f747bfd-abb3-422a-8ec6-237a6e6b619e", "value": "1cc6e53f7d609e852861c4cf85f686dd70e8b6181785a291749c855a9fd09aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a4f3f4-e505-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767047414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047414, "uuid": "482e4d39-a1f4-4e3f-8ddf-d41433bcb27b", "comment": "Malware payload (Mirai)", "value": "a2115c60d043936670c5c1859e158bdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047414, "uuid": "708f5604-51d8-4bb8-9df0-efb32bf0e62d", "comment": "Malware payload (Mirai)", "value": "1ccf64f145deb4d7a10a922f4d288ccc6993fdbf02cf820f9725b6395948a604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047414, "uuid": "19e6ec8c-c380-4f4a-94f3-fabf4dca1790", "comment": "Malware payload (Mirai)", "value": "953c0e36467d1fe5700c408d5c83c547c57012c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047414, "uuid": "33e16e69-3180-4548-97fd-7b23f079729c", "comment": "Malware payload (Mirai)", "value": "6032119bab6ec2e3718bb0eb5aac9b8600b71b18330c5be98d6da86af6c1f6ff34685d8c8331d212a7af920036a8efb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047414, "uuid": "1b5afaee-209c-4898-809f-9e819aff5cb0", "value": "T164B31A85F881AA12C7C2567BFE4F428D37165798E3EE3203CD195F6537CB95A0E2B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047414, "uuid": "a9e3b7f5-50e4-47d1-a3d0-0bd3631e13b2", "value": "3072:hBvAxXPRPwGYfeP82nj4jjLwJeymCM5xSnz4:hBIxPRPtY282WjLwJeymH7O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767047414, "uuid": "ba7676be-fd83-4303-8e03-4ab98e6b93fb", "value": 109268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767047414, "uuid": "d1bc0f47-7af2-4c8b-8219-69530262f355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047414, "uuid": "dd3b246f-e4a0-448b-8be6-ee6094f55cd5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d29327e-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031622, "uuid": "9e903367-dae1-4f28-b715-34a999cc5930", "comment": "Malware payload (Mirai)", "value": "ee60fb76482ce70f6e2826eef3d51f53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031622, "uuid": "19726314-68a3-4178-8986-c1640090e9a2", "comment": "Malware payload (Mirai)", "value": "1cff817a5cea09db39eef4d4ef6b06eddaa5a2bcd4ae85eb6e0d1aab8da3d156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031622, "uuid": "5fa3e4ea-d8d9-4707-b04d-f33233e96dd0", "comment": "Malware payload (Mirai)", "value": "6a8fa2b4b8ac87685cce565ef96ce37451a6e05b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031622, "uuid": "e86ceff5-13fa-4128-8046-6d266eac0496", "comment": "Malware payload (Mirai)", "value": "3e64e9be155721e563273a71def8ea5c0d4fd0312aba8cd9335bb9a3e6a8b769eadb126e10556d902e69b195217c853b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031622, "uuid": "54ee30b0-9847-42e6-be27-7556ac02265e", "value": "T14183F74AFD819B15C5D922BEFE1E018D335367A8E3EF7212DD105B14778A92B0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031622, "uuid": "d5d74dd8-4f1c-47b9-9b5c-996dbca42ca7", "value": "1536:MRniA968zCOPuB/lysYsHwe0tQrstZGQLfevBufmEtdlx8i61dXbXuM7RZVA:Srzk/YbsHwe0tqstZGQLfevBu9g1dLXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031622, "uuid": "5f30c8c9-c0d2-4d5d-b6f7-5bb398606172", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031622, "uuid": "1d9478f3-037c-4885-9861-b398497a77cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031622, "uuid": "9f1b8825-c2c8-4110-9284-7aa2857bbd08", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2d8661-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995142, "uuid": "804f5dab-27b4-45f4-8a2d-4b71022dd041", "comment": "Malware payload (XWorm)", "value": "2473efbc294b55d2a7505c7e4f228177", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995142, "uuid": "0c6f9890-6fc7-435a-b10d-f141791c95e9", "comment": "Malware payload (XWorm)", "value": "1d10225fac4956aff78f37f343090a9bb9dfa1eacd5762ee87ed1018996b13cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995142, "uuid": "b18ec73a-ffc4-4204-93e8-93c9513b9e21", "comment": "Malware payload (XWorm)", "value": "03cdd2623d808bce421bf50d2a80109e8cadf544", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995142, "uuid": "057e575d-b0ba-4af5-b784-aa285d9bd53c", "comment": "Malware payload (XWorm)", "value": "fc7ff67cb162ee7b2abd340e48e587e7c08a45d7b25131d639df12aac88d066d47b3ccf088be294e885eff5315b1111f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995142, "uuid": "a25d792a-77d2-4abb-8219-5cde97b39892", "value": "T151630B16A0A37A842486BDAEFF1D22EE0B059528ED5153747D4CFE72E8DE3215DBE201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995142, "uuid": "04acb8d5-3ba2-41e0-932a-93e8851b2002", "value": "768:I8w/h62/jWs6oS+xISN0vJ+BUUqCdkfScBYrwz2y8kTAlGB:I9l/AoSSMJSNusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995142, "uuid": "4bb21b33-7a2b-4376-b7a3-73aa75638765", "value": 72467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995142, "uuid": "3c85b260-68b1-4383-b7e0-889b2fbdc192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995142, "uuid": "e5b06cd3-660d-4d9b-98ba-69a25d0c657e", "value": "invoice-1645080830.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f3e83f-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968575, "uuid": "531459cf-eacd-4a66-937c-7159e62f3583", "comment": "Malware payload (Mirai)", "value": "d4c7b158b2929f57de6adb0a20dbf965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968575, "uuid": "2f5b5f14-a550-493e-9aa9-32e3d7cb57cc", "comment": "Malware payload (Mirai)", "value": "1d724592596c2cf45a59eb9a215141ff6af7e980105befd24ac6b5240bcc4846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968575, "uuid": "57c67523-8dcb-41cb-9f0c-912a2345ee68", "comment": "Malware payload (Mirai)", "value": "7c872590e849c7499c10ffeee01cca0cd512646d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968575, "uuid": "8f7756f3-9fa1-47e5-b11f-fdd3d0d09582", "comment": "Malware payload (Mirai)", "value": "c7ae8872c5537e0826fbfe90392a71c4c9592156c16a149c27cc4ad6ae1cd9f3d523a5a28c3e61db9cddb787196132f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968575, "uuid": "0e91aa49-ccd3-4ca5-814d-0e4755f36871", "value": "T1F7538E73C82A6DD4D15947F4B8309AB51B63F10482432EBF2A99C7759047DACF6093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968575, "uuid": "d8d913ef-dad7-470a-88af-5f11ec3838c4", "value": "1536:daSwte0IEE3AfDYvPNvKh7XFpRJCobZWuu:dJwIz3A7sVyh7RJZWuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968575, "uuid": "8bafd50d-10ae-456f-8d91-69dde333e1b3", "value": 62624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968575, "uuid": "3ffeb4f2-7ee3-4bcf-9cfb-95d40bcd5197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968575, "uuid": "b9cf4d38-d6b6-499c-ab3b-01dbded3711d", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0441a35-e4cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767023225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023225, "uuid": "e4d37a4b-d5f4-475d-ac62-508214bc7e4d", "comment": "Malware payload (Braodo)", "value": "9d66702f57583210467168691cdbe2cc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023225, "uuid": "e1bb896f-d799-44e4-803f-cc015d5904a2", "comment": "Malware payload (Braodo)", "value": "1d7ea0e0c4200e3810edf0fb02e3a82168e5eca3ce4347fa5672b57209eab99e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023225, "uuid": "7f1393f1-d897-448b-8f76-dcc4563a7212", "comment": "Malware payload (Braodo)", "value": "b4f3a321a581e8f46086471b806bb9fa19ce89c2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023225, "uuid": "d948db61-5359-463d-95cb-3f07fd8ab3ae", "comment": "Malware payload (Braodo)", "value": "2c97f1af8780a49eede5e57366631cd0901acc75e9d025e1dbc305eb38818ae41552f7a0d04c81ca9777806307019604", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023225, "uuid": "311d1365-8a31-4ddc-b2a6-c2e37956e822", "value": "T1BB550285DB2B3FCE2E28098D459F6E0E498D6D323D32C8F1D99F250B42359D646E291F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023225, "uuid": "66b29e60-71a9-4164-91c4-861f4779c043", "value": "24576:EOlo7qyP5wjxJA4orm6ZLR7KOlo7qyP5wjxJA4orm6ZLR7b:hkwwXkwwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023225, "uuid": "6295db37-3bfc-4680-8e2e-3a4e0689c418", "value": 1375263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023225, "uuid": "85ed99d1-c82a-4975-8631-1a992bd8be11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023225, "uuid": "32381612-8692-434d-b738-a87843f8925a", "value": "Wedding_Event_OrderList_Decoration_Catering.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b14e07-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968576, "uuid": "920c2db1-86f3-40ad-bab2-a0a7cc8d26ae", "comment": "Malware payload (Mirai)", "value": "80c2ce2b274d7e98e1e7fadb06769511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968576, "uuid": "0c49e880-5e6f-43d4-8086-6719d6254db9", "comment": "Malware payload (Mirai)", "value": "1e833ebc3bd29eaf26404d18e9f74039218fc2e5ede88cb1fd8a8cf58a86b52d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968576, "uuid": "94bd6fde-99bb-4c79-a13f-38b0811d0217", "comment": "Malware payload (Mirai)", "value": "cf7ccf73d006063ce89681f2d27a6c5a8d753e4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968576, "uuid": "c28bde61-fd3a-4971-91e8-8c39fe955f14", "comment": "Malware payload (Mirai)", "value": "6748189b8a9647f94b7c6a935a69cfad675cacafa7d2e40600e6139cbc1c46d1a7d11c24b8b784137ca812d61eeeed6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968576, "uuid": "002476ef-97f2-4e95-9984-a194b962ebc5", "value": "T15883B95E6F318FFDF278863047B75A21A79923D633F18685E2ACD1141F6024E185FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968576, "uuid": "d43e5704-0dff-4f80-a151-6fb0f0ce87a4", "value": "1536:o+VOz6HGWrKGYQa7KfLv1oHOU5uJZUneX2Yu14JdoRl:NHGxkLvEFnI2YgAGRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968576, "uuid": "05c10a90-9ec4-408a-8e62-0bcc50740b36", "value": 85056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968576, "uuid": "d0bf983a-b50b-414f-8713-06c5510df7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968576, "uuid": "1e13296b-fb6c-49d2-8bfd-f713d4437bec", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973c001-e48a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766994518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994518, "uuid": "c3d27880-c4db-4690-8783-b64f7044ed33", "comment": "Malware payload (Mirai)", "value": "6b1f874b4277a11e65707b5e45c7a0bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994518, "uuid": "3495b0c8-8607-4934-9254-3677e97c7c26", "comment": "Malware payload (Mirai)", "value": "1e90eced5ffa3a774e6903f76f3af4968ff7ed457b9d360fbec6a3590793b0d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994518, "uuid": "21ba1638-a1cc-4f5e-be5c-2dbc8a9f0f00", "comment": "Malware payload (Mirai)", "value": "5a9b8107f4e486d63250705465a75b41906d4896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994518, "uuid": "f8675a54-6aa4-4a85-84f2-2887a0362861", "comment": "Malware payload (Mirai)", "value": "86c4982a8a22e57e92c674481878ecd0f941ec9c8e5319ad379e1b97bae3ff2a7ee03aa18cecf03082579f98ac4893c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994518, "uuid": "bd6b442f-91a7-4426-9efa-9ab12ba758e5", "value": "T197C2D08DFB150E13EC5652340E15F8E284D6F4B56BDDA7DB3A0A8182AE5F17C91E4D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994518, "uuid": "0122ea35-1248-41cf-9447-11e7a07124ae", "value": "768:pfxUIKz6IdE8h1EABD7kK9Y4upm8zx668KzC:PUIabh1lD7nYbs8z8DKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994518, "uuid": "7a2008c6-63a5-4693-b04e-63eac6d17207", "value": 26348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994518, "uuid": "6aab23c4-5971-45b7-8c74-83a5d7d80cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994518, "uuid": "ae31cb2a-fa3f-4f1d-9826-08a488e8f8a1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985f40d5-e4d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027507, "uuid": "cf2f6176-7307-4fcc-ac39-1a1f8f50adb3", "comment": "Malware payload (Mirai)", "value": "23d3de004dea30883042ed05de488660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027507, "uuid": "7129c793-f854-4837-a6cf-0f1cb62b65bd", "comment": "Malware payload (Mirai)", "value": "1eb819c0417c7af530f53490d764ceaf71e65883b3b427881e32a04eed459c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027507, "uuid": "15c30281-ff28-478d-8383-09aaaf4b5cb3", "comment": "Malware payload (Mirai)", "value": "49a5c480b98a92be115c480b98dd29ef818b0f6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027507, "uuid": "1bf973ec-0bb6-45f1-a47f-e332c855e85d", "comment": "Malware payload (Mirai)", "value": "da8ccd679ffbf68a2e60cd475a65dff3acf783d5e7d77f5a565559883f2dc43b20fe037c4cce965660b89d01345bd6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027507, "uuid": "36cc0b34-ca00-4201-b50b-e9bce012af53", "value": "T1B6535C0273184A57D5E64AB0193F1BF093FFA9A021F4B3C5A50F9B698675E332486F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027507, "uuid": "89e7db81-4315-4c5c-b885-dd644afbeb9b", "value": "1536:aikP7tID5Wldd+bayM/qkXATfBFlqu+7RR:4G5adxyXfBF8u+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027507, "uuid": "077106ce-3704-48f5-9274-c2ee165b24bd", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027507, "uuid": "66e8b503-46ee-44c0-883f-ab82296506a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027507, "uuid": "c1892840-3763-4165-b8d2-f1618bac6861", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0089151-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995307, "uuid": "f605deab-c55d-41a5-929a-d6cf5cb484b4", "comment": "Malware payload (XWorm)", "value": "8474ec659703781af34350732c12575a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995307, "uuid": "531b37fb-d2b6-4d63-bdc7-1fbb943e9f5b", "comment": "Malware payload (XWorm)", "value": "1ef61a21998805bbe48a6081d0f38f4ac1ff3ea72d1e79f5833695214451c9b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995307, "uuid": "3845d68d-1f62-48c6-aab0-23358be302d2", "comment": "Malware payload (XWorm)", "value": "e3616ae6dfdc0751e108febbb8fd0c094393eeb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995307, "uuid": "4255af59-df6f-4d4d-8b30-986adaeda83a", "comment": "Malware payload (XWorm)", "value": "b1ab88c543cf2ce0a4d0586249c98aff85ae23c82a7c78354473aa88e74b32a2ad19ecc156c48bbb5c9d16b22aaee0ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995307, "uuid": "d4fd1914-47d5-46d5-81b8-11db65837c9d", "value": "T1BF63E693DE31B88FBBE45412579E74D91027335269B68305BCC276A63FFDBA25803887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995307, "uuid": "8f679a46-d4bd-4cd2-a8e1-71f5304c25e0", "value": "1536:I9l/AoSSM41BsyWjcoBDOounKHgGtTGXrTRW6vYP7zgtPo1PDauM2Joe1FPnBG/a:I9l/5MvousriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995307, "uuid": "93db714f-82db-4c48-9cc1-abf11473f174", "value": 72526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995307, "uuid": "4a7fb3d7-014d-42a4-a2fd-ed89b68cbcaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995307, "uuid": "c52d9988-0862-499c-bbfc-fe510adafdaa", "value": "invoice-1645080830.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a396d7-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031885, "uuid": "091cc1d6-ca98-4174-9874-41ffaf6f7f02", "comment": "Malware payload", "value": "213b3f9bb99c399d6f7d18ec0bac5004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031885, "uuid": "67ddee31-052c-4a65-bd9f-47e356a6db1a", "comment": "Malware payload", "value": "1f4ee2070e30ee5736cc7cafd139e5e287f3ec9eb5e1c95af1c3ff705808bb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031885, "uuid": "f223a469-2eac-4635-9382-bae06c19c899", "comment": "Malware payload", "value": "60099e83e2562253f365fc96a4345a8af9bcb8a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031885, "uuid": "edc498ed-2eae-4912-84cc-406292664906", "comment": "Malware payload", "value": "32a62ecb15d7cff0609782c127660d979c1b1e9f09bb58a6a3c9ef8db5df7ab7e685aeea0073238636336bb12f88171f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031885, "uuid": "f92886d0-0dc8-4a77-8781-8aa2dbf2ff2a", "value": "T16E9423107B6629F1C3B4BCAC04CDFC8C6AB68550504B7EE7E9A550FF56C61031ADAEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031885, "uuid": "649717b5-c081-4ebf-8457-07ad29db58cd", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGK:hzfEtBkjj8t0D/p5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031885, "uuid": "40aaa359-6d1c-4f80-a591-0655f4eeb169", "value": 409340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031885, "uuid": "ede59870-ad29-401c-94b4-bd9dd91f0139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031885, "uuid": "ea034bd3-8223-4a89-863a-1cef69a8ee96", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9f144f-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027251, "uuid": "2226fc96-21d5-4015-b142-c4bf13d7033b", "comment": "Malware payload (Mirai)", "value": "68e7cc6634fc39e77c422734fc8a5cd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027251, "uuid": "8a7947c1-aced-4a41-bee4-eedbe1febebe", "comment": "Malware payload (Mirai)", "value": "1fdc2dd437ef8feaf38efa4e7e0f772384a49c20053c87478d8dce2fe6893eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027251, "uuid": "fa9d3771-0dc4-4366-8649-38ff193a554e", "comment": "Malware payload (Mirai)", "value": "0de07ea97011a3bc3414c3cbd0ed64f466460062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027251, "uuid": "52a13350-673b-4e08-ae5b-cf7d48af8a61", "comment": "Malware payload (Mirai)", "value": "bc094499ea04ab73cd97469dd2c0b728fb4ce613ac7903ab03a5273f9bcb35d4fdcba0bff5b50c1589d3fcff5cfd004c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027251, "uuid": "a814c4cd-688b-4c6f-baae-f244e73f1397", "value": "T13D144BC7F800DCBDF80BE77744134909B530B76614935A37B257BD67AC3A0A9096BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027251, "uuid": "ef1e8ac2-2e4f-4a69-a230-714303ec4d08", "value": "3072:sbAiS1AQex2FN7Smb+p4zpDl8N8sydnKjPbngLScGHxlrnQVGjbihLtA2Guh/Frq:IZQk2bM1ydKjPbgLirrniLybWhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027251, "uuid": "a7c698d3-40ee-4d84-bae9-f71d4273290a", "value": 205344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027251, "uuid": "91b6861e-7c13-45fd-ad34-b1e5058904e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027251, "uuid": "772f3ff0-fa7f-4016-9d21-60d9f10be191", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0041d111-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028111, "uuid": "931518a4-fc49-4148-b7a6-02add68b975b", "comment": "Malware payload (Mirai)", "value": "4a21a3eb1e31b67ba30e7c20bd381a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028111, "uuid": "0cd3a78f-81aa-4504-8445-4292ba149a10", "comment": "Malware payload (Mirai)", "value": "20342ea09cdaa44bf134d2e35a34604b480a6d50ce36be2799a6ba01c4e7155c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028111, "uuid": "f560e789-6453-4d18-a5b7-eea3b095a817", "comment": "Malware payload (Mirai)", "value": "624c9fa3874cf41ade231f6fef7fe114440c5118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028111, "uuid": "ba3e9f7b-7edb-44ed-9053-bbca649a07b4", "comment": "Malware payload (Mirai)", "value": "a05b87151af4664a01cb2324825a02764a59637ec900c73531d4e5ad046da1b0c09f76851491d223605e8c7a6def5223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028111, "uuid": "3cea9cb4-0049-4d18-bb59-7d2debaff74b", "value": "T11F141942BD418F13C6C722F6FBAE028C37166BAAD2EB3103DD256F6037865DA0D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028111, "uuid": "2042f2d7-e8d1-4f31-a1f2-391791e7c620", "value": "3072:oQoBROqH4HDnr96OIStApxSCJsNw4J2MSHo+v+x06hh1PWij:oQoBROqH4HDp/tUsMUw4gMko+2x7Wij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028111, "uuid": "db2aba0c-501a-4832-b1a4-b6fcbb053737", "value": 193052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028111, "uuid": "92e55d0f-9354-4785-a398-c8a3d8656427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028111, "uuid": "72039e29-f2f0-4501-a75c-0e3c5347efec", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcea4b4e-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766996215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996215, "uuid": "462c53dd-b5e3-4a49-a5b7-5c7a9f805cf7", "comment": "Malware payload (Formbook)", "value": "b0f3fe8cf26467eb8f2141accf1aa7ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996215, "uuid": "6a661f9e-b2ef-4900-bac2-e000be007664", "comment": "Malware payload (Formbook)", "value": "20ba741b01e8499cff8956a8d710b7d27009f33479a6122761cb691b8e546ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996215, "uuid": "97d70bbb-903a-4fed-8344-85156070e4d6", "comment": "Malware payload (Formbook)", "value": "5bc99097f1b7c87c42916b341e82d9efcbfe44b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996215, "uuid": "8e3b6756-7d34-4740-896a-83916a74cdee", "comment": "Malware payload (Formbook)", "value": "aa3b507aa9c76c54d488a020ddc2f5de3df50e9a6a996a744ff2b3bb341e45ad15eb79be6a2793223fefc76aa86950ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996215, "uuid": "83d42f30-746d-4e56-96e1-ab6ac3ce7b72", "value": "T1D354236140A3A27DCB17567ED2F7252D20E4FF6D770547CA4B1E24EEA2168A42F40E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996215, "uuid": "d69c9383-3a6d-4517-8b5f-4bdd520a7019", "value": "6144:kfyRchQcET1RbMSEwcRd9DYAkAZMTFKZUGN6W4mC3++:syRchGT1RbfEhRd9DYnAZ+KGW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996215, "uuid": "e09dfb35-db45-465d-bd04-5e42cda2f9de", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996215, "uuid": "8ec5a5f1-770d-44ab-bf97-eda499c229a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996215, "uuid": "05722f95-21a6-4d42-a3a6-8b996834863d", "value": "20ba741b01e8499cff8956a8d710b7d27009f33479a6122761cb691b8e546ac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01634d8d-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967983, "uuid": "1e41b774-7217-4437-bc39-8e14ff65fe95", "comment": "Malware payload (Mirai)", "value": "c2f3d1219a7f401908ff7badd035028a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967983, "uuid": "7dc0bc0e-f9e7-41d2-bc4b-bb423eb6a082", "comment": "Malware payload (Mirai)", "value": "20d98f38a39882460f356ba2bd7d8ed4bfb55359d34c88f85e13e41ea46edea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967983, "uuid": "d0001240-52ae-4978-95b2-6b6307ac925e", "comment": "Malware payload (Mirai)", "value": "ab732c88eacca64d511decc99d773378e0a10749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967983, "uuid": "08e1730d-9afe-4d7b-9756-ec8a31fbb943", "comment": "Malware payload (Mirai)", "value": "f30ee25c5d931e77daaf3ab44cdca8257c6161fb52b1895af27ab6b907fa9a078e37699a7229e471cd327724355ab49b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967983, "uuid": "a59056a6-b717-4ed4-afaa-d3ecce44284e", "value": "T14D730121371844C5D67789BE0D8303187E6E9BB1B0399C09F94A60C3D99CDF97AA3AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967983, "uuid": "78f36312-df3c-4a16-8c79-76e8015e49d6", "value": "1536:PcEzP5xFtQtj3noYD5o6zNzaCt4bhLfkUbydijEQDVVJu+:1Bx3QtjXvDC6zNeCtmLsUbtjEQDVVQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967983, "uuid": "3312bd03-4cee-45e0-8bcc-a8343107c589", "value": 75260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967983, "uuid": "f5bf602f-d10b-46a7-aeab-bf16d774ffac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967983, "uuid": "31cdf63b-b85a-4020-8580-ee86359d4abd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf6ef8b-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026466, "uuid": "07abc25a-7d63-4feb-99e1-27498b52217f", "comment": "Malware payload (Mirai)", "value": "d0d2917379d3ab7bab15de0ee3968854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026466, "uuid": "0eb87a8e-6508-4ed5-a95d-1f7dc37acfce", "comment": "Malware payload (Mirai)", "value": "215fc71534de2de768b4e1b37c6e33d1ffbbde3a59cfd246fafb4a748ab1de1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026466, "uuid": "1efac9c8-9284-497b-8db7-d65f60631483", "comment": "Malware payload (Mirai)", "value": "4e4ced6987e46df0d516545d574be63720303a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026466, "uuid": "e02c87af-5b48-4f71-a9c5-f3c8cd8fda2c", "comment": "Malware payload (Mirai)", "value": "f60e7f35d3707fd9baf90bd8c0e2d7138e72a49396bece7526bc004ab05c089974b249d4cc88d0cc80904e51bbc71b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026466, "uuid": "4bd8586d-d3f1-490b-98b6-5b53faf233c7", "value": "T1F6737B13913C291AC1F0A4B712775352B0D62A5E4494D78FBE320E8BFF262D40E6B9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026466, "uuid": "661c2811-98b4-4944-ad29-2802dd89ec94", "value": "1536:/rwKUPoLN4HfeRKAt6/I0mSwzLjN8fd6WIymQY2AUYci5hh1YG:/ryc4A5Xt/Z8Hqhh1YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026466, "uuid": "3149f8b4-ce6f-4cd9-ba20-5e2a22fb1e46", "value": 80500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026466, "uuid": "fa67ebd4-07a5-4e63-adac-ebaa4a272714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026466, "uuid": "f5023c5f-04c8-4ad3-9589-288ff34013a7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfa238d-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971598, "uuid": "2310980f-0568-4fa5-adf8-25311713ec7f", "comment": "Malware payload (Mirai)", "value": "05f2dcfeb143d30adbff118348b139d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971598, "uuid": "284c60bb-ad3b-40e8-a98a-9ae9696a3461", "comment": "Malware payload (Mirai)", "value": "2178e336bdc510b2d78af88b3aa36af462fefce9c5f8f52588db227cc8a21d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971598, "uuid": "25c870b2-73ee-4298-b7ac-1d88af992fe4", "comment": "Malware payload (Mirai)", "value": "0c37473229c9c68c5dace0f47241df052fbd3717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971598, "uuid": "7cb521ed-812f-4375-b76c-b37342b62e0e", "comment": "Malware payload (Mirai)", "value": "777b3a6bd24327c566ac9d5a091a5cbd86b80fc40c6d246212fff11b77a074e953c33532b4bd6d43a6349fe2080178cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971598, "uuid": "f89b26e1-f75f-43f1-a9c4-0b3566eeab30", "value": "T186735CCDEA43D4F5EE5609711077F7738A31F435413AEA87D7A8E932A852B01EA0639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971598, "uuid": "33432e18-dded-4500-9aa4-387cf41b669d", "value": "1536:1tPhWOaX4Bje5VaO0QroiFmlPgUySM0MbgZ2hnW67w3IHBFyV055i8MXRl:1tPAxX4BjwYhSnpSM0M0ol7w3+DK+qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971598, "uuid": "4c7dedc0-1b52-43d9-91ee-7fa37facdfa6", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971598, "uuid": "21a7a52e-cad4-4c1e-b688-931913c1f062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971598, "uuid": "28aa6eba-74dd-456d-aab9-d8906f7732d4", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ecff6f-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029915, "uuid": "fb560fdd-cfff-4313-9c7e-cdfd0b052d73", "comment": "Malware payload (Mirai)", "value": "e621baac40209e5d8fdb43fe9d30c6b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029915, "uuid": "63a1015f-8b69-4bce-93e6-51939028d3a5", "comment": "Malware payload (Mirai)", "value": "22f9510f05a4fad2664c48f32a255942a3d50fa9a6b7b0848727243a7b9e94bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029915, "uuid": "9fe58aa4-6e96-4847-8107-00a057765340", "comment": "Malware payload (Mirai)", "value": "a2d082e74f6f90b8351f7e7120bd60a160706f33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029915, "uuid": "7b7b1a83-a188-4ea6-806c-eff684c73d55", "comment": "Malware payload (Mirai)", "value": "e0b4e450ca1340757723b1d86eb4c91756ba1652b3bf2063d860d0491fb12aa26e1bd7d0bddc141ce17f26ed460316ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029915, "uuid": "3048be33-9ac1-4d18-851a-90fbffed29f7", "value": "T1A404BEA3B70B18D1CC2006F81BCB5BAD6A2311139D67C6E3AC5F36396E365DE25163E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029915, "uuid": "eafa09b2-567f-4572-a784-7c08472e00ec", "value": "3072:vM8dNPEaL+CswIbN6sCk5MVAq5JwP6vFb7nYkng3CJKWFz+D8ub01gQq:vMjaqd5MVTwP4ZDYBCJKWFE9Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029915, "uuid": "216fa98e-9c10-448b-befb-c942dc6b9254", "value": 181940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029915, "uuid": "a95c4956-ffe2-4937-a055-1ce2dc94f026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029915, "uuid": "74517fd4-a43e-424c-8f7f-dec3bfef6061", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d3edb6-e4bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015452, "uuid": "ed754344-6161-4d52-8ade-3474169f43ec", "comment": "Malware payload (Mirai)", "value": "f25c983f3930d715bf32aa1c2ac9c462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015452, "uuid": "66c76865-9a68-407a-a635-f9f5f80e28b1", "comment": "Malware payload (Mirai)", "value": "2313c8694dd79e725ec1a140052e04de1d85d95fc4dfe4d91cb5659a3bf8aa45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015452, "uuid": "1f41cde1-6ea1-4c3a-a240-8a841a7b8e9d", "comment": "Malware payload (Mirai)", "value": "269019e480304f04a87e898b65ae3b5bf4055dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015452, "uuid": "ee296188-ff1b-4a4d-ac70-83ebf4fe4ca2", "comment": "Malware payload (Mirai)", "value": "f416583e48fc75bcdce749cfd4dd8b84563a80899c8cfc74a17d778bb7b787e04b6a257eda92340d64499778f601fd5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015452, "uuid": "14a0cdae-6022-4baa-951e-bd2e88660c04", "value": "T116834C86A401DD7DFD4ED6BB84170F05FE29BB411F820F27B2A7FD97A971098481AD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015452, "uuid": "98f5f9f5-49f5-4b00-b543-49ba209a93a1", "value": "1536:lgesIKJh8ui1F0mAjYTdS7ovnZ1aqlAy325x8udbuP7xJ9IsohLKIqrrETPc:lgesb8uk0mAjYhfvQke5biJasohLBE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015452, "uuid": "69711bb5-7e9e-45e1-af13-d6615bfc810c", "value": 82172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015452, "uuid": "fe9fd3b7-4190-4add-b014-202693fb440e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015452, "uuid": "7f05ddb7-f2a7-4036-be5c-6ed63a48f28e", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b519adc-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971597, "uuid": "e6d141d5-dcab-40ca-b76d-b7c2ca531248", "comment": "Malware payload (Mirai)", "value": "c5938322729edf64171d1e8aba9231f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971597, "uuid": "88fb78c7-0b7c-4373-bcb3-13f980c396e1", "comment": "Malware payload (Mirai)", "value": "234aa33815a0e27dd4a76879465d9e98e4cbcb4774bc66c1f9d96c12b9b5d4a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971597, "uuid": "d63641d4-8393-47cf-ba05-f4102840e2b8", "comment": "Malware payload (Mirai)", "value": "d6be90675829691d5d98a34d72d27a4e4fe1286d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971597, "uuid": "dfac2feb-161b-4a72-8048-fe9a0942ae7a", "comment": "Malware payload (Mirai)", "value": "02c2e11e93f3987b5df74f27985b0975d47554851a80c37ec85813499fe0380391ec48df6adacb2975c54ea9cafd0806", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971597, "uuid": "c4963d05-a353-44d0-8936-790f56dcfed3", "value": "T1C0B32A01B3184947E6A71DF03A3B23D1C3EEEAD121F4A688760EA74D9276E335546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971597, "uuid": "285cb656-fa55-4b3f-a925-87c3c36ff39c", "value": "1536:yXd7OVQO1AYjlFsZ7wNyQQbQjq4hMqt3xXidlyv7ZFiq2iBzZHcnzlK:o9KeYRahtQZR6dMzZ4BnzlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971597, "uuid": "7e8d7aa7-4329-46e5-bc56-dac6ea709fce", "value": 112152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971597, "uuid": "ef910e95-9db7-4da3-b388-42cd14620b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971597, "uuid": "ed061a92-e457-4dbd-8119-597253cfcbbf", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630c8b76-e4cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767023981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023981, "uuid": "d1e53bea-df7c-4220-ba75-d3df0323cd22", "comment": "Malware payload (Mirai)", "value": "21aafa58b8493db0d0105c3196cb5b09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023981, "uuid": "df3f5dcf-b8f4-447f-91de-7a63934b28a2", "comment": "Malware payload (Mirai)", "value": "237f50648f123918ec7d2ebaf9e1e58e2bcc693bd57971957d4e1e32154014c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023981, "uuid": "2bdcf76e-c985-41fc-9126-79e41a451345", "comment": "Malware payload (Mirai)", "value": "94fb80b859b79ed1c4abf939a49f2375654845ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023981, "uuid": "d2879c3a-d19a-416b-8fb4-0b01ecd839de", "comment": "Malware payload (Mirai)", "value": "3e18aaa7dc408e2c81bc9d07997ca46a386614177190429e53efccc6e0949552b45f2cac652b44c4652d02cc3294cbab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023981, "uuid": "9af56cc7-c3c6-4867-a182-0606417cb2cb", "value": "T1DF534D96A801DF7CFC0AE67AC5120F06F524775696830F3BA6AAFC931DB2094CD25D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023981, "uuid": "8704922b-7ea0-4790-9a7b-08fdbee17cf9", "value": "1536:u1NamEOVqvndtiDPvOELyYJVGriEIC8uPqGxFflsXrlDPG:u1NapE0f8xLyY8ihaqolU5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023981, "uuid": "340cf0c5-89e5-40c5-98d0-bbe83c88a31c", "value": 64140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023981, "uuid": "2de25082-79e8-4cdf-aa34-751b412a727e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023981, "uuid": "7c078f9c-8a37-459a-a3c4-d5edc84e14ff", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a489873c-e4cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767023232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023232, "uuid": "b3cc2ec3-1f21-447d-a1b0-844ebf08070d", "comment": "Malware payload (Braodo)", "value": "3c96ed4663219cc0ad69bd7fd66a1dcc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023232, "uuid": "2b923ed8-6b51-4392-8042-8c9aeccc3c2b", "comment": "Malware payload (Braodo)", "value": "2399cdd2d6c0079bf25c832298a33ab0e9e41f12bb46fdfd5dbe2599ca59ff2a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023232, "uuid": "4f367737-03de-4d67-9aea-2317cae5288b", "comment": "Malware payload (Braodo)", "value": "a6818f810924f299944cae99c3062ac9f2406af8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023232, "uuid": "1c0873c3-0ede-4d14-b954-29467da83753", "comment": "Malware payload (Braodo)", "value": "14fc3509686deb63899cf7255beffb7a935c625f6686c18260a58dc45feabc366b0d6b64f1e5fbe054fee1decf374380", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023232, "uuid": "2e1ddd5b-f2d9-4beb-a180-a8675d0aee62", "value": "T1D105F265CB3B3FAD7D2D088D49BE6A4649CC1D322D21C4F2DDDB144B8228BDA5B7241B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023232, "uuid": "7c94824f-4167-4e27-a32d-8bae1a7e031f", "value": "24576:c37ikgocw3dFb3o3o3o3C3837ikgocw3dF33q:gomLYYYSQomH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023232, "uuid": "ea283bd1-f4c3-4055-b235-b124546050f8", "value": 824347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023232, "uuid": "82cc6a1f-6775-47f5-949b-c3edd884702f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023232, "uuid": "3445274f-a64c-43e7-8e1b-2086b544cfba", "value": "WindowSecuriy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b875db6-e4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034169, "uuid": "e5703fe7-6d7e-40d9-a043-f256172dd9d8", "comment": "Malware payload (Mirai)", "value": "d499a114f5c9c94e341e4c5148785954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034169, "uuid": "c7b7a43d-e25b-406e-81bc-f11a178864ec", "comment": "Malware payload (Mirai)", "value": "23c92016281cfa75c001248b0509084de0fb981f19d45b4493bd0164bc468760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034169, "uuid": "fb0bbe9f-1a0c-461a-a26d-0f6cb2346b5d", "comment": "Malware payload (Mirai)", "value": "e262b287cecfb3ef061c66872a79d2fb8e6ae8e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034169, "uuid": "6d2d05c5-2727-452b-b26b-38c8ff23f7c6", "comment": "Malware payload (Mirai)", "value": "b1dcad51e8a8871a6ef0c44f6184c0224d61c9e79e38ec7b8598ca3f267bad53af4da2c7f82f6e2966659b5bc512e339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034169, "uuid": "67d53cb7-05de-4793-a814-aebd90f083fa", "value": "T1C4530111C1C88E47E89FD9358C7D384F90BFA57CD258CDF7489018BAEAA07263C69517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034169, "uuid": "c529460e-2035-4eb5-9750-8c17688ee520", "value": "1536:lFWgQIaW+Pxyi9cR+E1xGGUJV+4DTRonouy8Hy0:/EIaLIqcR+HGUGSWout3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034169, "uuid": "f0f3dd9f-e75e-4f13-9c97-decc217b2473", "value": 62124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034169, "uuid": "c58547ec-0fc0-4992-b17e-fa65d6794ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034169, "uuid": "c568a21e-5e8c-4377-86d9-b07f7837edb3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595592c6-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026972, "uuid": "3c6ab90b-ca28-4946-a7d8-4b4770dfb93e", "comment": "Malware payload (Mirai)", "value": "272150ebb901ada10a8d2348e0c87f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026972, "uuid": "81e682d1-2380-4a10-89f6-a1580db855da", "comment": "Malware payload (Mirai)", "value": "23e577dc09b4303edc52196e76675e0ec3e6a9b0fa468978108b55eb7e1d5232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026972, "uuid": "cab67646-d650-4507-992d-e48241e50eae", "comment": "Malware payload (Mirai)", "value": "d020f563c759b0f1fe935aaecc7db98c802c716c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026972, "uuid": "fff875b3-b1ba-4001-9065-e40ac805fee3", "comment": "Malware payload (Mirai)", "value": "40a0564d1b761ed90cf97b1a4e979a4a347d10079053c937497e8104ce6220b0674414b7aed8804d11840bd97de1c7e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026972, "uuid": "e35cb0b7-2853-40a9-98aa-030dfaa86826", "value": "T16E54E70AAF610FFBE8AFDD7342E90B0528CC741B25A53B757534E828F24A58B19D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026972, "uuid": "defac3b1-d725-4cdd-8e31-a839d1c22239", "value": "6144:EVrTRRY3FVfSRLitMy3TopTnmr6sZGTg9uXgE:EVrTRRY3SliAxmrFGzXgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026972, "uuid": "6f30c16b-907e-4d2f-bc99-421db836d001", "value": 294188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026972, "uuid": "bc6364fc-252e-4d3f-8f8b-2be01dc401a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026972, "uuid": "cdaa4f47-026c-4ad7-89f1-7049cc2b69c6", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7495b237-e4e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767032171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032171, "uuid": "1807a090-1472-4112-8421-c3b809517a29", "comment": "Malware payload (Mirai)", "value": "dae4602a3330aa61579ee7561db8507a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032171, "uuid": "c30328be-e814-46c5-b2c4-e41e738e2214", "comment": "Malware payload (Mirai)", "value": "23eb12d7d6043c9c93d6075e8692003ea5e13e8f8cb9cff5855de4961c4a3c06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032171, "uuid": "74981e8c-d409-43ea-9856-7f76030ba9f9", "comment": "Malware payload (Mirai)", "value": "2834767a61000c0e13877f9ab6c4dbef0744714c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032171, "uuid": "37437d5c-3ce2-4065-a7e3-a6bdd009c7be", "comment": "Malware payload (Mirai)", "value": "15a30b83fac80c5bd6634eff28211cd66f506cbc50ff2ac9e169d94017a14cb0c6c6f87d4f71b71b15a18de751916f17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032171, "uuid": "da6c1e0d-c9ab-4242-a213-8190c1ed905d", "value": "T10D335CC59943E8F8DC0905762973F333A676F571112CFAE7D7A8A92ABC52601A50B3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032171, "uuid": "e961cb58-5e34-47aa-ac77-51253a250169", "value": "1536:gflDWgAUZmVAMaO4NJbRs4prKJaMteRTjjrc5ZRd:4lClUZm2MgNrs4prnpRbI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767032171, "uuid": "36635b70-2a32-4eea-be39-4b1cf8d9f84c", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767032171, "uuid": "fb24e78d-5d2d-40c9-b7d2-b5cbe5c05731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032171, "uuid": "67796533-a9d1-4417-8041-96e1b5b69fc7", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cb6c91-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026233, "uuid": "f1ca163d-ca3a-427b-adb6-5f1c5910478a", "comment": "Malware payload (Mirai)", "value": "41e0b1ac95864c647520c10e02d72a5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026233, "uuid": "497a0ae8-a348-4a26-96e4-c7e39be27936", "comment": "Malware payload (Mirai)", "value": "2415cd1c05bc4dc21cb74944b66af7c0db0c30a065cd2bb38b42a9245156f784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026233, "uuid": "ab20d1c8-fcd3-4f24-b56a-2a2d57b4a99e", "comment": "Malware payload (Mirai)", "value": "e93da3d71067e163190e51a06629a27f0148b37c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026233, "uuid": "499b95cd-e2d9-4863-9d91-f5a89c21f756", "comment": "Malware payload (Mirai)", "value": "8fd72d815382a3df32e2511e05b1cad35381c1b040e88b957bd29fe48078829afd2a17cc557f49624bdb3dac3d51f47f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026233, "uuid": "654a4027-6846-44e9-97dc-cebca8bd74e1", "value": "T1A2338D7AD17AED94D18C41B4A9358A351F63B104D2572FFB2A85C5668083ABCF60D3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026233, "uuid": "d8a20022-64bc-4b6a-b21a-f27bf316d624", "value": "1536:Ra3wtlORfqI/GjbfwYKwUHUM61y2GC+muM7R:RQrRX/UboYKw7M602GmuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026233, "uuid": "99d41f70-b109-4010-8e62-ad47644241be", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026233, "uuid": "f8488aae-ede8-4f8a-8108-047db0c5481e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026233, "uuid": "eb68cfb8-db11-49d5-8b1f-a8eef6f12ec1", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c1099-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030747, "uuid": "221b291c-5561-4a28-b328-c5340ed00a98", "comment": "Malware payload (Mirai)", "value": "9a856f48abb60c32ded71913c4419698", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030747, "uuid": "2e7130c2-2179-4053-ac05-480ee0437492", "comment": "Malware payload (Mirai)", "value": "2440baaf45955f43ca4570090405f43dc27f2622c93769abbfdb27cd5c06acea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030747, "uuid": "c17de560-e268-46e5-be51-95becac0bca7", "comment": "Malware payload (Mirai)", "value": "1a92a6a9094ce463fc60cc0e023772fc7d10826e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030747, "uuid": "1bc317c2-36cb-41b9-b01e-308b489389b8", "comment": "Malware payload (Mirai)", "value": "737867f575e910432474c522996bf1da059efb403ed3b211fc44797e8d9566132946f77cd24dc690ed9918495cf152c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030747, "uuid": "a6680b2f-d280-406d-ac73-25716c893064", "value": "T110346296AFA03FFFD89ECC3351A5CB0A159C550A12847FB62A34E114B79B10A59D3CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030747, "uuid": "a28b4045-a47a-43a1-ac5b-d3c52e16545d", "value": "6144:lNS9a6U6V9AaeURtttq/Ez/IcH7v+dI1HPCrHlkAU4FKwuKSlXvPX:46pCdX1PX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030747, "uuid": "0d516270-1c20-47fc-98af-d6cc2f86b695", "value": 243984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030747, "uuid": "0002be24-d32c-4c2a-8064-e1a34e4d4dad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030747, "uuid": "ca7115b0-f89d-46f7-aa6a-486fc85c70e9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00036f21-e467-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766979148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979148, "uuid": "e6dcd81f-56cf-4301-8e09-6b555d2492b0", "comment": "Malware payload", "value": "6327f26c135b273f29a3c35ea640aabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979148, "uuid": "361fe8fb-6548-481b-b095-fa54b1540a84", "comment": "Malware payload", "value": "24f7a8a6b2b8acb469c4621656ece08ece9c3031589a7e0ae4a3e257cb198ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979148, "uuid": "83ed4dda-8597-4cce-a91c-71f59a3f2917", "comment": "Malware payload", "value": "30846416139eba1fe007b74bf11c24725f8a8fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979148, "uuid": "828539bb-5f0d-41ad-b5d7-6167ead28757", "comment": "Malware payload", "value": "a11d1b3bf1b0f4639927f654caf0aae8755a4e220eb8f56186494f386198895dd49cc6a0cb408bf73b82e681b2baf70c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979148, "uuid": "e9277c0e-18ca-4c44-b2e4-a661ccdaaebb", "value": "T101A34A5B63B530F9E1B78238C5A50A49EB72B87507619FEF03A0429A1F272D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979148, "uuid": "56662300-f77d-4587-a4ea-ddf6d8d9df5e", "value": "4879dc0845db089b354f3866b594d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979148, "uuid": "e64a3237-a867-4ea6-bdac-b9f78accf664", "value": "3072:KMnVZ076D7yzC339hlw4IHErcT+p8QpNq:XZ02DACv24IH1+HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979148, "uuid": "100b5da7-1d43-4f63-93fe-283c305e37d5", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979148, "uuid": "34a22795-0573-4fbd-86dc-712807591ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979148, "uuid": "b55bcf60-3715-4528-93e0-2582737e34f7", "value": "WindowsUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d9b091-e485-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766992368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992368, "uuid": "9cc3ee42-dd1b-4b19-8e9e-ae180d4fb7d3", "comment": "Malware payload (Gafgyt)", "value": "287be97047ff4e8ef7a839d25daf1ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992368, "uuid": "5336a161-1d90-4919-8c25-3030e271e9e1", "comment": "Malware payload (Gafgyt)", "value": "254a44e3e358dd77d026554561e8b4e8c03a9328e60f0927026d6f8cff9e09ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992368, "uuid": "a925aa18-0fb4-4ed8-8053-89b41d90e1ec", "comment": "Malware payload (Gafgyt)", "value": "4f20a274fdf9b68750234f69801645ec68df02b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992368, "uuid": "d5975204-c0e6-4c5b-a167-5ddf0765bcb0", "comment": "Malware payload (Gafgyt)", "value": "ca2c2b322f45dd62229debc524751b03293dd366c6d7a667812a3f4874e58c1aa3397ae61acde1c99729d0fbbab6046d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992368, "uuid": "ae79a863-570e-497b-bbb6-b29a3b038d07", "value": "T1D1A36C02B5D094FCD4C5C1B80EAFA126DA32F66C3275B59F23C47F293E4EE512B5A264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992368, "uuid": "2fb8a3d3-b827-40ca-9945-90539239dc8d", "value": "3072:LbeYmz5F4pjx+AhxUe019W4AVMGF1W7Ez:LGgTuvhGbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766992368, "uuid": "c9294d38-f562-45c2-a815-ff9646dedadc", "value": 100416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766992368, "uuid": "88482694-a016-43ca-a85d-06ceddbe67d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992368, "uuid": "50afe7b2-277c-4909-96e1-211ca1e01eb8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589c5ad5-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766996476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996476, "uuid": "0c01796b-73d1-4993-8e71-5ece60f65ade", "comment": "Malware payload (HijackLoader)", "value": "4676a18eb59a5f3b3d6683d93d04b0c7", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996476, "uuid": "657854da-5a29-4be7-8c26-900c05d864de", "comment": "Malware payload (HijackLoader)", "value": "256164db14b7e2a758dee2ed639a6929e6df5d8becc53f24bdaa42583c9f0dce", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996476, "uuid": "12475f58-300d-4ff5-9349-e97aee4b5e1f", "comment": "Malware payload (HijackLoader)", "value": "272392f0ac9d35b1c7fdaed5e51a1920ad037521", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996476, "uuid": "cf7e0543-38ce-46b9-adf7-69b1a07e73cb", "comment": "Malware payload (HijackLoader)", "value": "da4bc980b731d9e9b4dd979a603e3fe93d35cce3ac07571d748cd2b950cd6623273ad6101cf2b957c6e96e6de89759e6", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996476, "uuid": "5e13daa8-0be1-4990-b0c4-14a844649590", "value": "T14017CF12B7A509F6C477C038C9A7AB16DAB6B8340B3047DB57A0976E3E337D0093A756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996476, "uuid": "96f38036-7c91-4031-9606-64894bc242a8", "value": "196608:akctItJtouO1iIuHve17+Khmy+0rJLn/P4N9TeP/m7wEMhrT76JQQEFLcLxaMG7o:lt7ouO1k8kx0NL/b27wD76RLYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996476, "uuid": "414bc0d6-c3a4-4d17-a36a-2e3d0c1dcecc", "value": 19916436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996476, "uuid": "5ee642db-3593-4522-85e3-ff532f279e30", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996476, "uuid": "a633f867-42af-41f6-a626-bb1c4d23750c", "value": "SecuriteInfo.com.Trojan.Loader.2728.23935.24860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382f432-e492-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1766997890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997890, "uuid": "b4ef8bd1-18aa-473e-a97e-59ab178ead53", "comment": "Malware payload (VIPKeylogger)", "value": "1896f5d5347ffdd8985b573daa7780dd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997890, "uuid": "70a6fe60-3e75-4ee4-b8f3-90164d8e032e", "comment": "Malware payload (VIPKeylogger)", "value": "260ddd305085d8d33fa95e4678b856e1e9ebded7e4d0f980f287862d668ca4fa", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997890, "uuid": "a2fc4032-b6bd-4422-87e6-2ade565375e6", "comment": "Malware payload (VIPKeylogger)", "value": "6d27a71289ef1f4de7b60c86c76d0405af429f65", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997890, "uuid": "cb24a496-e6fc-44ab-a05d-e2836d76e502", "comment": "Malware payload (VIPKeylogger)", "value": "0dac864317e79e76e3b9c95d5d76b937f0560513e2fba37fcc60700576c63a9b238c91cfd0a2ed3d3b83684946983e73", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997890, "uuid": "053e03ed-9b05-43db-815c-22830599796b", "value": "T1A9F46CE20EFA2E9CBA95FDBF8BD3DE4F058D95936D0CC9B4CA1A81C23620584D3C6455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997890, "uuid": "f044b2f9-604a-4be1-8ba6-caab06b149d7", "value": "192:ZNX9A5z+S/fDh3aE31LSS0nKBw5UnZYEFHr:DC5KSh7LSS0KxHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997890, "uuid": "d2b5ccb4-593b-47bd-99ae-57b7ca0a53af", "value": 742123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997890, "uuid": "8a0c25ac-42cd-4fdc-a342-9ad7511cf6eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997890, "uuid": "9422541e-ad27-4548-801d-da289374c734", "value": "CWP2026-NH PURCHASE INQUIRY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf62ab62-e458-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766973053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973053, "uuid": "95e67d45-3411-4c9d-a31a-ba5606974895", "comment": "Malware payload (Mirai)", "value": "69dc7277154648023107b4bf1b4d6621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973053, "uuid": "d7fd8dd2-e551-48c8-aeb9-e2a27d9f3bd7", "comment": "Malware payload (Mirai)", "value": "262757590937c5f8584418a8b53fb58f0232d11c5dacf91ec00ac98379fb4da4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973053, "uuid": "11b08da4-6b68-4c75-b8a7-c8fa33ba9af4", "comment": "Malware payload (Mirai)", "value": "5b596a66c6201ac35b9f86dbd23195541e86cf21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973053, "uuid": "4224f147-2d17-43e3-b309-7b368dde5502", "comment": "Malware payload (Mirai)", "value": "29e9a9f7676b1e2433245188243f364835e55bfc0ebcbe5a61fd08e33703e041e867d10585999a4da5a5f448c393b9c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973053, "uuid": "4ab8eb13-89c2-482f-ae4d-58f22ea04b0e", "value": "T11E03C651F8829A27C2D4137AA66E568E332073ECC2CBB61BDD614B107BD651F0D63F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973053, "uuid": "ceaf5468-1f3b-4366-b9df-5f536d3c3e27", "value": "768:Rgj1xisyfowG5tm80zy4uciGNSN824HobT9wSC895U4Peow2o0E0/N0wgkkkkkkn:R61WfjG5tm3uciOwsI7T95Uwhwj0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766973053, "uuid": "abfb0d99-aca8-49b9-839c-100385f8efe0", "value": 39088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766973053, "uuid": "73cd65df-4505-4d51-b0d3-ed7a38105148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973053, "uuid": "8ada1f8f-b371-4d26-95e3-ccf6d893bb50", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9611df2-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995377, "uuid": "bfdc4695-67df-47fd-a807-5ead3278caef", "comment": "Malware payload (XWorm)", "value": "d2b58bd73fcefd706e7f0da379e91f94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995377, "uuid": "3ee438a7-5cd7-49a4-a180-93bdff7b6651", "comment": "Malware payload (XWorm)", "value": "2629843814688dc1df1d62afcedc4e81684dea22e51701837400a765aaa07de7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995377, "uuid": "3f37e0e9-51c1-4f0f-92d1-f4ba4ac17031", "comment": "Malware payload (XWorm)", "value": "e02b99a7b49d8f35dc1a05ec7a3756a8d78052a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995377, "uuid": "a4124afa-67ef-4071-a984-ca49ed28ad5a", "comment": "Malware payload (XWorm)", "value": "f4ac6f9dcda21563f7c502789ee00959185e6d310b8aca69e75ee0c0c0429a7daea4c8e6099eab0b75f75bfbec60df0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995377, "uuid": "3a6e69a3-d151-4d75-95fb-cca8ca95c0ab", "value": "T18C6309EA321B79D70B3172D2F6021D58EF81E9D211FAA114B9EB372D47ECBAB1103546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995377, "uuid": "e3dacaaf-bebf-41ef-bbe8-4f60aea544f1", "value": "768:I8w/h62/jWs6oS+xISN0vgM1M1MmMmMfMcMpMKMVMTMfM2MAMQMOMUMiMiMTMIM4:I9l/AoSSM4UusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995377, "uuid": "00a4fa32-d409-4e0a-91a9-67fbfb66b4bc", "value": 70531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995377, "uuid": "7847f350-1bcf-4f32-a62e-ee20b49a889c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995377, "uuid": "3e49594e-e205-45a3-8db1-b8598ab422ed", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d478f0-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027041, "uuid": "33a6e7ec-aa89-4bec-be8f-251f8941c5b4", "comment": "Malware payload (Mirai)", "value": "e48d77512a8869cbc32666c23bfc7f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027041, "uuid": "a4f1fcda-db90-46b8-8c24-aaf4ffd0a2c0", "comment": "Malware payload (Mirai)", "value": "2657d54fa0df7e38d3b0e080b42f15415ab0d597c2af8937c917030e9ce8712c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027041, "uuid": "15c8c0ca-fb05-460d-80d2-02f738d1a56c", "comment": "Malware payload (Mirai)", "value": "940527f891ffb3590c4a548009fb224f56f2206d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027041, "uuid": "8247707a-9599-46fa-bf7d-f0157e2be2da", "comment": "Malware payload (Mirai)", "value": "5653b1b4b250c87767771a967043cb3298934ddfc69d70005a193a1cdbcbea63526854ae852b22d3929292d206a85237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027041, "uuid": "b3a2a61e-9fd8-4c3f-bd20-dbdc76f13247", "value": "T19C042806ED418F11D5D622FAFA9F414833536BB9E3FA7102DD246F6023C6A9F0BB2552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027041, "uuid": "23f01dee-484b-41ca-a265-3b3dbc56a2b9", "value": "3072:GENjdJknNuf+fkxsh2eao541JffaOpmzLMgC459pbs+6PVz6hh1yp8Mj:GKjXkUfUko2e/S1JffaOpmzLMglNsjP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027041, "uuid": "092fbfca-ba21-441e-9820-729b9c62cfb9", "value": 182580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027041, "uuid": "e3ef3042-9766-4242-8aff-90b133453d32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027041, "uuid": "2298a50d-cdab-4326-816e-6ed8943a9295", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bf50c0-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966437, "uuid": "8ef9015b-d008-414d-b03b-75fa7a9ff743", "comment": "Malware payload (Mirai)", "value": "e2d5d85c6517dd7f4377f81a7b8d0494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966437, "uuid": "3cf86cd4-e77a-4917-a631-77ff11dd207f", "comment": "Malware payload (Mirai)", "value": "26996e09c6b6f86ad456d4b0a3f06fa2d1f62218c99fbf52286ea47defc0790a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966437, "uuid": "1626c3f6-360e-47c1-8560-de86cbed5797", "comment": "Malware payload (Mirai)", "value": "5b665adec19d1b4222f50ae57f622b55c3fa0e0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966437, "uuid": "6d50ddc9-1e59-4a56-ae3e-d1e1969196fa", "comment": "Malware payload (Mirai)", "value": "221644298272a649402a3f660ec546d78606c1df2759e3d592b07f01f12f0f716b274fede3027461929fc90d30acd569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966437, "uuid": "97f05615-5d5e-4035-8814-65cbcd35ffa4", "value": "T16B933B42BC91CA6EC6D023B9B67E268C3312B3B6C2CE7253DD148F51778A55F0D76A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966437, "uuid": "153da1e9-9744-4139-93aa-02cfbec4b8fc", "value": "1536:L1fNER+irKqiE79KpjdBcrfMW0bp3yE9Y+cvN6XqS1ZdFF2IymQY2AUm6hh1Ph7:L1lER+i+m7BU139x36YT6hh1Ph7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966437, "uuid": "d8cf3c54-d956-4df3-bf68-77424c33e30b", "value": 92388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966437, "uuid": "93177d99-8901-4890-8b52-cb9dfd5357b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966437, "uuid": "4a5e376a-0a7a-41c2-a5da-3ae7b5daa4ac", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e788dc5-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982178, "uuid": "d5fd39ab-925b-4a1a-89ef-f2b9327dbabb", "comment": "Malware payload (SalatStealer)", "value": "b81a185441b5b12f53bc32c295df4ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982178, "uuid": "1c2e3db5-af96-41b1-a3fc-6231ba78e3ba", "comment": "Malware payload (SalatStealer)", "value": "26b6bfcd50086e53341a9b669a7d2607de1935eb93f25984585be959c6470f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982178, "uuid": "7d2d2a25-8fed-44cd-a158-937cf1b2ed40", "comment": "Malware payload (SalatStealer)", "value": "e3ab266117586b8e4c7864a59d176c1bf5d200ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982178, "uuid": "ed9c98b7-e604-4f71-9b39-149b18bd9f22", "comment": "Malware payload (SalatStealer)", "value": "b2b02d11ae0535df58134ff0ebc172da7f2e943429e28b1003315e356bc5d074c5358567af99d08b7410a93e988f38e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982178, "uuid": "12f37bf9-9456-47c9-84da-688462b4a2e9", "value": "T141C65A42FECB55F5E9031831405BA23F23305E048B68DBDBEB547A6BFC77682197A648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982178, "uuid": "ecf34e49-91ff-479d-9d73-8868e0235d13", "value": "49152:UFC+X1FubI5iG2Vdhn2pxGy1UpxjcNtcTXzlIFv6RbNV67op6sS74xa426c7hdc7:E3XXS1VvGS/fKf6VShdcZS6Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982178, "uuid": "5f6bbc7a-5a13-4d11-8135-4cbfe7e12b55", "value": 12094464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982178, "uuid": "e2235a6a-97e6-41ed-8ba7-70415f9fb02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982178, "uuid": "26dffab7-5e11-476c-b5bc-59153eabda03", "value": "26b6bfcd50086e53341a9b669a7d2607de1935eb93f25984585be959c6470f9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17266062-e4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767023425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023425, "uuid": "766eb128-cfc3-4888-a299-4f407dc5ba68", "comment": "Malware payload (Braodo)", "value": "21e78d2be934c1713d7dcdca6fe195eb", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023425, "uuid": "d12445f2-77b7-42d0-a8c4-bf49bc181801", "comment": "Malware payload (Braodo)", "value": "26f1276700c5bfb9fae4c739328805934c30a3c36fe22399feb8ddacd129e8c1", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023425, "uuid": "0f950d36-459b-42d4-98f5-d8f691035ad8", "comment": "Malware payload (Braodo)", "value": "48f8e0a89392d41f9438c70c670c4fd66da44635", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023425, "uuid": "aa0ef9d5-7396-4bee-9f04-c162660414ea", "comment": "Malware payload (Braodo)", "value": "130fd193870ba0a51d3f9b5bea82cb09f94de98fbe647a9f05c93f08ce9f78932d8fc5ad1334c863f991f66b10f78720", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023425, "uuid": "6c0c0877-56fc-40ff-a473-e8a511aede56", "value": "T136D42375F0A838B6E61AB3E9BE06143975CEC49C9307BF5B1075209C3CE2E7963D2466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023425, "uuid": "48711c27-af45-4593-82fd-a0a8c9ebcbfc", "value": "12288:Nki5Ofjdt5vEj7eWMdwnh7ggm3nYCYF1b81k/hbqostKoYfWYOVP:6SSjd9QBggOYjKkZkYOVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023425, "uuid": "a027dbf9-0363-4145-9371-388fac78438e", "value": 633530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023425, "uuid": "c9fc9f09-2781-4865-a61a-40a6cbd2e600", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023425, "uuid": "3f966846-dbaf-4ba5-9be6-90f3d6e0f225", "value": "Dental_XRay_Consultation_Request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d07bf7-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966920, "uuid": "06d9f84d-bf78-4e30-ad42-ff5c4a658ff8", "comment": "Malware payload (Mirai)", "value": "f47264b8fcb82389648b40c04022f4b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966920, "uuid": "10335d4a-9dd5-4e0c-b5f5-8b96c2145770", "comment": "Malware payload (Mirai)", "value": "26f12c437093187a955e7fa9701dfb3b3fdf94dac47395c5bf37e42817440584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966920, "uuid": "ed1aeb4a-8d27-485e-a643-3eb8012a9e99", "comment": "Malware payload (Mirai)", "value": "e117824358c177b8fe7428b00a0798a4226041e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966920, "uuid": "41c3749e-1c97-4120-b17a-7810624eacb4", "comment": "Malware payload (Mirai)", "value": "702c219e52007f992c3dca1c3865811438d1ab6c4501f46c9555bd7358f1f1936cd789ded367d651ee2ada8948a37019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966920, "uuid": "0315c4b8-bb86-44b2-b2e9-93bec068c50c", "value": "T1EF44060AAB610EFBE8AFDD3706E91B0128CD641721A97F397A34D518F50A64F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966920, "uuid": "a5ffbebb-f2cd-4fb1-ac47-0dccc66fb13a", "value": "6144:hbS6dDtWxA2D1BZnIEh8MebVQH+ygUK1p6EacKA5edH4nN:hbSaeDbZnIEt7H+yg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966920, "uuid": "17acdb86-482e-4097-8cbd-257563befb79", "value": 253448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966920, "uuid": "497d803b-d9a7-47ef-a656-c85975d28c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966920, "uuid": "7cc36949-962c-4abc-be8f-cf717e9aacfd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334207be-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029914, "uuid": "59b36730-1d62-400c-a608-1bd5093bb826", "comment": "Malware payload (Mirai)", "value": "59a5f7724bdf458daf84e10cb0d9e19d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029914, "uuid": "5234510f-2360-42bb-b936-1a4f5e1f2c54", "comment": "Malware payload (Mirai)", "value": "271f197cee7a4ff87b5d8a1a8bc04558c479a2f3b036fd7474db661bc7aa0f19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029914, "uuid": "2b2c83f2-f715-4134-8ce5-9c0a99d0609e", "comment": "Malware payload (Mirai)", "value": "e6af004150bab6ad0cc055129c13f3c8697fbb3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029914, "uuid": "6a337af0-ab09-4e89-8744-eed2aa067d8d", "comment": "Malware payload (Mirai)", "value": "ef6d0c29ff3a90ab958bd0a374bc7670cd15fbc0a666b4eec8271d833ad8e60c2cbb0ccc0d072a77f03922f1217b4542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029914, "uuid": "66d8c517-b696-4765-adc6-2a3f3b83a792", "value": "T16063023961C8B271818874B6F74894A5766CDD98B7FBF31011482708D857D822FFBBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029914, "uuid": "c4b93f8b-d08e-439c-a3cc-c89a84022c20", "value": "1536:nL4SZDblX13DL8N6+8oz8XU+7YKLm5MBlkG8ycJjB+M0SzP3:0Wbt1rKz8XU+7YKLmUlkZNRB+M0Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029914, "uuid": "61caf361-caab-4148-9589-ee84552df81f", "value": 69468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029914, "uuid": "e09ffba3-aab4-4acc-997f-8f72db807752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029914, "uuid": "09682f2c-9f76-45ac-9b26-fe7f7233ad05", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81f9bf0-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013011, "uuid": "3d6e376b-e0fb-42d9-9d63-240a3b24f980", "comment": "Malware payload (Mirai)", "value": "8b3c411e43bdf7807c07a0292f769ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013011, "uuid": "d118f1bd-1ecc-4bb4-8fd5-70647504acdf", "comment": "Malware payload (Mirai)", "value": "2785280f6549b84939342cae17741abffa7e74f6d5c3eb3531380066a2c50e52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013011, "uuid": "11cfe357-1fe2-49bb-bc90-804f62a4c827", "comment": "Malware payload (Mirai)", "value": "8ff63d1decd16b311c40ea48b6d104981116ccce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013011, "uuid": "224c9452-39e0-4411-9bb4-af2d079278ad", "comment": "Malware payload (Mirai)", "value": "e6ef17fa4e581fde49674de45be6e5fa91e30364b35c0395df9a55bcb4618e4140cad56899c8b1a6d28f7e296a0105a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013011, "uuid": "617cd502-1825-4562-8055-95fb07122cf1", "value": "T1A1334A99B501AD7EF84AE77F84230A19F1313B5021920B2F57BBFD936D722985D12E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013011, "uuid": "707f75d2-07cf-4a3a-81d4-6c4ccfa17e6a", "value": "768:6deWU6urXQGMe1w2f3HozvBNOpJ8unZqdvPXS/mspg36Zr2tkh:AnUHQGMkHozvBcn8unZqd3S/ZpwADh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013011, "uuid": "f7d49f8c-5499-4e76-a640-c3895a732f05", "value": 51256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013011, "uuid": "9b758c83-fc4f-4a27-a099-edaca9cbf095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013011, "uuid": "c3cbbdcb-afad-42d9-81d7-ae8ed268e7dc", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488fc37c-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766988289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988289, "uuid": "744d3d8b-c44d-4d3a-8372-379f94ba046e", "comment": "Malware payload", "value": "4351d41e07e00fc5dd7b1e90028cb53e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988289, "uuid": "44d1d69c-c79a-46f3-b34b-a67fc5c65473", "comment": "Malware payload", "value": "281dec8091b911b1e393aa41f19334a5f62929df5d04292507519bd5a40fac82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988289, "uuid": "e5072c04-bb81-415c-aa6c-bedee67e5452", "comment": "Malware payload", "value": "6169b936b0d1c7f4c57b22aba7c1b676feeb33f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988289, "uuid": "1628d760-924d-41ea-8e1b-df3c507cb417", "comment": "Malware payload", "value": "4c5d0b5b6847e045ce8105cb7e3766b19eb0eb0b7f3ec0638eb9ed7817b08d7a618c049a3d9d0b17d819c12823bb6df8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988289, "uuid": "5ad5cede-035d-4203-a85a-1405d07e10bf", "value": "T1C1C36D5AB70D0B53E3C609F0263B17D683EA6AD130E5EB492649BF0882B5E375142FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988289, "uuid": "8b4941dc-c370-455d-ae54-971d9a50ffcd", "value": "1536:DKTHYH12yDRbCPd+0ro2P5kNfMCWHAelm8w4+/UqAJRkNym4pi0rFAmVW0XTi5Wa:Y4oyRbAI25XCj4m8wRMgyo0rFa+T5rHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988289, "uuid": "158852bc-1680-4dd1-9c02-f5be82698df7", "value": 126940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988289, "uuid": "ad80cb3a-c993-4ef7-abe2-5f461388fa61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988289, "uuid": "d6a5013e-edff-4422-aa9e-83c38c861c3a", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cb3c73-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011346, "uuid": "b291abcd-dbe2-4799-b113-af93d2abae95", "comment": "Malware payload (Mirai)", "value": "76a712031f0e21c9d1ed7d51cfe5c838", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011346, "uuid": "c9022226-0747-40a8-8d1b-df6ddf0d292e", "comment": "Malware payload (Mirai)", "value": "282e9b713cdc888d9e9ee822e0294bed5bdb417e0a22fadfec5de7078ba7b4df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011346, "uuid": "c9068b57-ecd5-4085-9d75-3da160176951", "comment": "Malware payload (Mirai)", "value": "6ea321b249fb367dff6c1fd506725c923ba7f8ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011346, "uuid": "f1bcaa0a-d22f-4dfa-b028-6d0c978424c6", "comment": "Malware payload (Mirai)", "value": "b6515e8710c770bd193adac04250c54b458820775f72ff929a344a15af29d6f720491558f8f98197fb1f5ef6a706608c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011346, "uuid": "d8b4147d-b84d-47af-a30e-82b03098ecdf", "value": "T1A983C386BF43DFB7E41320F112F75B624A32FD3A1C26D5C1E329BCE18A615D0A616369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011346, "uuid": "062dfce1-439c-401d-94ab-40cf78cf29c5", "value": "1536:c/e5f2+UIrffUha21MQ+E4m+nQ9S7r5fi:8eVJjsht1MQr4dQ0JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011346, "uuid": "3d9fff77-cf52-436b-98c5-658ca6a9e3d9", "value": 81748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011346, "uuid": "9db1aa34-f4aa-4517-9657-d275bf863b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011346, "uuid": "140ed4f5-2a49-4dbb-b011-9104065b6391", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e666b2f9-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028067, "uuid": "f0ca9bb5-8558-485b-8bb4-3c988e79a82c", "comment": "Malware payload (Mirai)", "value": "11fdcb8c23eb287847ce21646610ee87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028067, "uuid": "1f47ee13-b7b4-4d9f-9aef-da2c7293ff30", "comment": "Malware payload (Mirai)", "value": "2856a206023ee6145733ae9fd3b386919d98cff315686ab540ecca1f2a1eb224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028067, "uuid": "d457979c-5d2c-4bdc-b8d3-be5668929f70", "comment": "Malware payload (Mirai)", "value": "b40b8b8cc914fd47d813bbfab45f6694084ebbfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028067, "uuid": "365a64cb-11b0-48a3-9b83-062e7f69ade5", "comment": "Malware payload (Mirai)", "value": "0da128719fce3334faf3438da7f8d96dc37f8385d74f36a0ba5e7eb6bce57c5c251fcb8ec32388bf2fa186685d8c85c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028067, "uuid": "7758bd13-7fb5-40cc-a831-ea46725e7c16", "value": "T1C643F846B8918F25C5E412BEF92E118D33272778E3DFB212DD105F25778A96B0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028067, "uuid": "8d208a64-b680-470c-98cf-a6d6a58baa4b", "value": "1536:3dnSJZrQV+CvRK0s8YssLLn+RP7aIniCdeu0M5u:OMV++tsxjLLOdeu0M5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028067, "uuid": "697c0f4b-e499-490e-a913-9a64ef253c98", "value": 59868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028067, "uuid": "93a554a7-6fec-46dc-a90f-30a802047d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028067, "uuid": "86f9126c-615b-46cb-91b9-62451929cb20", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d17be83-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (FatalRAT)", "timestamp": 1766966714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966714, "uuid": "8a42d787-9ebb-41c8-bc34-4d824d76bc7d", "comment": "Malware payload (FatalRAT)", "value": "5465d2597470fd994bcb0f28d0c06622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966714, "uuid": "37b7b904-c613-4775-bf8c-674066ca8ecd", "comment": "Malware payload (FatalRAT)", "value": "288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966714, "uuid": "0465ad46-dfca-4b7c-acfe-b7fd4ec41992", "comment": "Malware payload (FatalRAT)", "value": "1830c9d2a7255e80aa41879e22324ad1f9fd04c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966714, "uuid": "e6106bf3-37aa-4f89-8106-0d74ad0769e9", "comment": "Malware payload (FatalRAT)", "value": "ba44f4c5d99fbcda3047984f40f55d82206d6d2e95014d80afd9e950272da6c563bd40d0be49c33258f30fd9ceeccf66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966714, "uuid": "f139f2cc-2b21-4dd1-b689-019e4bee1f84", "value": "T14EF52237127C214AE5E8CC3596237DE171FE23374B42AD78C5D99DC42A32AA0E683F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966714, "uuid": "a76dca05-03a0-4009-9e9c-d38aae3eb8d6", "value": "9b201090749bae06a761156dbad9c4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966714, "uuid": "b8abb769-ec27-4d6e-bda3-7844751ea7a8", "value": "49152:jpaOwfkulpMeRdC/YDvHFHvh5glntvnrXt1R6fSl+jEpLIriw6GaRDeO3lD9ilVk:daOwFAjCvH5Y/nrHR66UxDsDe+0lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966714, "uuid": "7208ad71-6e20-42c6-a79f-67ea54ba771f", "value": 3510272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966714, "uuid": "16011309-c52c-45c1-b120-26b4780e7f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966714, "uuid": "5af9df72-2e6a-4103-a9e6-1f4b9ac73c2d", "value": "5465D2597470FD994BCB0F28D0C06622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16069dd6-e4e9-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1767035019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035019, "uuid": "86713add-d4fa-4aee-bfce-fd054ea9ea3a", "comment": "Malware payload (GoToResolve)", "value": "fb288b386ba8bfc2b01ac5c79121078b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035019, "uuid": "194e7a31-0154-4252-a363-9167461a79c8", "comment": "Malware payload (GoToResolve)", "value": "288b49144c9d2ebbb9c4131587ea416a805d389f0dfdd0d4f30273862baf4436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035019, "uuid": "14294a0b-ce4e-4092-ba99-1bd1a386dde5", "comment": "Malware payload (GoToResolve)", "value": "67ac3d8b4417c01e785a0283ea62a988bda566a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035019, "uuid": "6bffb195-71da-4d9b-bf62-ad40feb7646f", "comment": "Malware payload (GoToResolve)", "value": "676a43ab443cfec085558a1b4295a617e269c3dec858bdd8b8c449fd27776c6a5e76f89d199e89632035e04d0e54c015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035019, "uuid": "eb0fc941-2aeb-4df6-8485-d19ece6daa98", "value": "T1B93733217157C032C99221B2A929EFBAD35DAD205BB519D7B3DC5F29A7301C32B32D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035019, "uuid": "af3101b3-570b-4f40-a32f-1a93fc14700a", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035019, "uuid": "f0843694-ba35-429b-8fcb-b24f855ab768", "value": "393216:q2mcrgZIm4fQoPl9CDyoC0CiLHOBp3IigWt3TWh5kCeSGhR5yZ8+4k:zgKsGCDy6rOvYigsjQ5khhho8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035019, "uuid": "22cb05a5-0c09-48fa-9543-92f48d9f11c4", "value": 24443880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035019, "uuid": "5554ec77-ebe0-4699-8aa4-a4dd56ee8e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035019, "uuid": "cdd1d976-34d3-40de-aff4-841dfd5fa2ce", "value": "doc-wp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1a513e-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982394, "uuid": "84a5ac88-8532-4c23-bb2c-ba1a77c69109", "comment": "Malware payload (SalatStealer)", "value": "ad133f0eb9a8aab5b5bdcdc04f453bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982394, "uuid": "abe4df3b-a195-442e-98df-382452e66a89", "comment": "Malware payload (SalatStealer)", "value": "28b7bc50a96a4bd9f32e35d06b672f3d11a301c0fa7985967fc7c52a266c2ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982394, "uuid": "eeeae6c1-43a9-4e19-99ca-adda5de0b7c5", "comment": "Malware payload (SalatStealer)", "value": "e58296354f90060d599e10ec9f5bba1f5ccbc65f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982394, "uuid": "db9c1a11-9c56-482b-8a10-6b9fe5117b0e", "comment": "Malware payload (SalatStealer)", "value": "97ee0a6d6a6db631f06dbf3847e5465f9840bc50e2a430ce02444e4f36dfd814cf4cb067cb3c06f2ad761858eba56066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982394, "uuid": "b42984c4-efd4-45c1-80f0-8f2bf5243265", "value": "T12FC64A01FA8B64F1E9075931416BB23F23305C048B28DBE7EB587E6AFC776A11936749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982394, "uuid": "c200db8c-440c-4515-9d5e-66ce34aff1f2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982394, "uuid": "0dd53506-72b3-432e-b89a-e5c02adc95fc", "value": "98304:vGipWl2oamv8QOIo6VjGZiCVQBw5xEjaQbz6Gw:clVOcqZxVQWsGQbz61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982394, "uuid": "64947a47-57b0-4149-a338-f8c827a8bb65", "value": 12473856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982394, "uuid": "1b6c8b9c-231f-469b-9404-14190889a43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982394, "uuid": "d9260f26-4033-4442-99f5-ebc11b9e10c1", "value": "95152b07ec812c325d561400edd8e6a230e02ef965674a54f2084aa6b3be8c14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46320e4-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026239, "uuid": "d4c58f08-1814-4668-b706-315386815de4", "comment": "Malware payload (Mirai)", "value": "f3b10c0e38c5a14050d421377a4e1b6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026239, "uuid": "7afe79c1-a73b-438f-95d8-012730a0f604", "comment": "Malware payload (Mirai)", "value": "29a0d38997518dab68bb062452a8e8c59db0bc540c2e993555aa60a270fd667a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026239, "uuid": "4a33feea-3d2d-423d-ab94-48074b6eb063", "comment": "Malware payload (Mirai)", "value": "be5492c22de2796ca25565dfee63c88cd008b162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026239, "uuid": "acf36def-ed35-4bd5-8e85-1f8eee791a04", "comment": "Malware payload (Mirai)", "value": "4fbb030afbb362241b98e58b51c37f6e84ac3c577977e472efde365a4f9410d47e32fede70a315d267c255dce45c59f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026239, "uuid": "39152392-ce9f-4801-80c7-f05ce0703304", "value": "T1E8041B82A743DEF3D80301F121F7AB324A72F83E143BD985E375ADA19955AC2951A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026239, "uuid": "f52f9aeb-3349-4171-9c5f-fdca9dbd5186", "value": "3072:ochjeCWOh9WLUPAsg/YAo1dQ5ROA0nlMmvxjL5Ta9nYEAi1Iv5XDY8QaXac2N0:FenOzIU4x/FC25AAPm6ATDrQTv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026239, "uuid": "a12bb7d4-595e-42fd-9dac-d3415d4f32cd", "value": 179672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026239, "uuid": "34561028-b995-48d7-a9a7-44be0ca03b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026239, "uuid": "8b7fae5a-fe63-44cb-ad58-7deb800bce46", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bb5077-e4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767023417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023417, "uuid": "07f214c3-ac18-4eed-ac8e-85d515f3a0a0", "comment": "Malware payload (Braodo)", "value": "12567b9c3a00f0f2d48074bc26284574", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023417, "uuid": "cfd5f825-523f-4326-b66b-41109f7a6022", "comment": "Malware payload (Braodo)", "value": "29be753f83dab382f546b3c5bd38691adbbeb82cc2003fc8979922ffe297dcd0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023417, "uuid": "23388344-d3e0-47b9-8d4d-d3f7f65a1b91", "comment": "Malware payload (Braodo)", "value": "4f8e73c13007708da7e11e896bcbf0c8b3ad98a2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023417, "uuid": "8bcccee3-24b3-4bba-a6bc-d3b204f46b37", "comment": "Malware payload (Braodo)", "value": "61d1936dd2e4b1f53e516966a93a911604654b5970ac4fdf2f65951783b48b0dff5bbefd4c38f06151f571d1d3154edd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023417, "uuid": "264898b5-ef0a-4c0d-b04b-7d156dd2ef4f", "value": "T1C3F4F2519B6A2FCD3D3C1DC805BE5A49488D6D333D32C8F1DFEB24478229AD546E292B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023417, "uuid": "a3f80769-2747-4d43-a18d-28ce984f997a", "value": "12288:e/fws2mA5RiRGkRdquQi4OOrnHD/fws2mA5RiRGkRdquQi4OOrnHv:e32PERGkRdqNNDj32PERGkRdqNNDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023417, "uuid": "c52bd76e-a48a-498a-be73-a4639b8a76dd", "value": 737029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023417, "uuid": "673880af-c9bc-4d2d-a5aa-e5a9628a7836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023417, "uuid": "1bbf78f2-4457-4667-aeae-052dce077d4d", "value": "u-p.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331be092-e4af-11f0-a129-42010a9c0007", "comment": "Malware payload (AkiraStealer)", "timestamp": 1767010157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010157, "uuid": "da96c668-aad2-4957-b90f-ac3bc5ef78dc", "comment": "Malware payload (AkiraStealer)", "value": "f771a22e722ec23ff12de02b73ff93ba", "object_relation": "md5", "Tag": [ { "name": "AkiraStealer", "colour": "#52CD33", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010157, "uuid": "27ae755b-a880-4224-b638-90fe5d3f5b3e", "comment": "Malware payload (AkiraStealer)", "value": "2a1065663ce4c7d0da94ae5b25cecf0a30b04cc14fd4ccb2d6220fd1fa28e01c", "object_relation": "sha256", "Tag": [ { "name": "AkiraStealer", "colour": "#52CD33", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010157, "uuid": "197b1e4c-6be1-484f-a9c6-b1c33ee26a5a", "comment": "Malware payload (AkiraStealer)", "value": "95f0a88beb6ebdf307003ab04390e3e32baa6ec4", "object_relation": "sha1", "Tag": [ { "name": "AkiraStealer", "colour": "#52CD33", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010157, "uuid": "4a4f7bae-d16c-43f8-991e-a43675d92cef", "comment": "Malware payload (AkiraStealer)", "value": "4eff07c71cdda2a8c644af01a653260b929c9825497abd173b62e3dc6a2eaaa8757c7f944fc9a3baa85ce711eff1cd97", "object_relation": "sha3-384", "Tag": [ { "name": "AkiraStealer", "colour": "#52CD33", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010157, "uuid": "6d8359ba-a08b-4f57-9feb-142f438f1bec", "value": "T1D91833D0CEF06160C532B337B840793C3AE85E4EAD8580B54E6FF45D359C2D5AAAE71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010157, "uuid": "b7b35444-ca02-403f-8b09-deadd0ca08e3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010157, "uuid": "c5f8746b-372e-4e8d-b32a-a67d385412b1", "value": "1572864:SYxcOLGCLFKT4frjjVGe0s5N9TTVizaqpYlnaqunBEQXTmwRWDGA7:1JJhKk0ezBTViznWZaFnBuIub7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010157, "uuid": "ddcaf157-40d7-4b6b-a2c3-0e1a0898a81a", "value": 87415607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010157, "uuid": "97ec371b-8153-4efd-865d-e8c02e155525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010157, "uuid": "7ffb722e-8f9c-4eb4-ad11-4f22bd74c514", "value": "Seed_Balance_Checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823ded37-e45a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766973783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973783, "uuid": "fcb9368e-42fa-4c84-92fd-51a5bfe09299", "comment": "Malware payload", "value": "8e336e680ee91fba49a5a6b66b5328b5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973783, "uuid": "bbcb49a7-7138-4b79-8dd7-de09aac0e5d4", "comment": "Malware payload", "value": "2a66920cedd53666b3715055ca534d5afacfe6b1ef5f8cb0bb129c8c93511fd0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973783, "uuid": "f1288895-e7aa-4e9d-9bf2-257a271eb315", "comment": "Malware payload", "value": "0f845983885a086cdf55e586a40be0faf10a34e5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973783, "uuid": "5476f8ce-f8f0-4e6c-bcd8-c08e4967cfcb", "comment": "Malware payload", "value": "bd7f792c0730d5156def371128f547686a15393c11e46c4cd673e70ce58396147a723be731ebde59c8a36f6a5476ea32", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973783, "uuid": "2570086a-5817-4d1a-8faa-8cd05b62348c", "value": "T1A5C633556BD14155E530F73296B61782C2B8B9039633AA4F1ACBD87D8FA3230B631F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973783, "uuid": "580b9000-2b04-4b50-ba2a-2c17550d81a4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973783, "uuid": "3a8c1733-0d40-45ea-8785-d75a37ff8b76", "value": "196608:RmB0odudbygAWfdxNNUSqT8Di6pzcsH5V9JvAFKNALQ3KRYekaWwk+hXq:gBEdffdBQTG9zfH5V74FKNkQ3KCeNWwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766973783, "uuid": "0f2191d7-ba6b-42d7-ba3a-b7dfd96ec207", "value": 11979264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766973783, "uuid": "8c89dd8d-bc57-4605-a668-3b0dd0e4980e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973783, "uuid": "bcae3bd5-7d3d-46c8-8dea-993173a8944e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52712289-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029967, "uuid": "6e230426-ce41-4abf-bebf-558fa04cd973", "comment": "Malware payload (Mirai)", "value": "3d5d2168a234bd0a94422d9cbf52c4bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029967, "uuid": "28c3cd44-da84-4ab7-858d-a96c8c1c7bec", "comment": "Malware payload (Mirai)", "value": "2ab6a8dd09bbfe676d26ada8f21c3f4f041ac94ef429617927c90143583849cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029967, "uuid": "9bf12872-581d-4d94-86ed-8662a24e03b9", "comment": "Malware payload (Mirai)", "value": "9bd34167bcd8fb959a0f3c306213e6beac0e25a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029967, "uuid": "513512a8-f186-4d0b-a514-2b13c608d9da", "comment": "Malware payload (Mirai)", "value": "cc2154a7a6b583d3084687f54d3c5119751d3a01191d61a2e3c1f0932960ff1e12173e291411a1be3b42c834d0c6fcb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029967, "uuid": "7f3a5893-9a6d-41e0-8e81-a9d297cc69a1", "value": "T172140942BD418F53C6C722F6FBAE018C37167B6AD2EA7103DD25AF6037865DA0D3A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029967, "uuid": "b6696f83-0648-41db-9079-2a231e445adb", "value": "3072:zUCLggwjph08Ufa0mwCIZWSl4J5cStKYbRA4+6hh15Yn6xO:zLLggwjph101NQSl4QSxb+4LYn6xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029967, "uuid": "7e216166-b238-4be6-9f37-73cec5a75f36", "value": 193708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029967, "uuid": "4c51c56d-e499-40af-b22b-a21c3879f0a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029967, "uuid": "63a93c39-6259-4f1a-ac15-9a52bda44023", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509b9587-e512-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767052727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052727, "uuid": "51c85c7f-9a8a-4878-91f2-32676816ccc1", "comment": "Malware payload", "value": "f7576c7a5a5a93040db117d0eb49342b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052727, "uuid": "e6b8dc3c-4b86-4e88-8701-cf25a0533ab8", "comment": "Malware payload", "value": "2b800b162417044f93451ae3710239cf108d12ade41088ca07798b20df8f549c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052727, "uuid": "87135ea1-afe8-40f1-a7a9-34ab47db0ae7", "comment": "Malware payload", "value": "2bd3f0d2171c1161a7dbd31c8c137cf5714abd24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052727, "uuid": "1b99b73e-8efd-4c74-9949-c1c0203fd2ee", "comment": "Malware payload", "value": "ea28be26550a0aa85e8f8a9c0a98604f2637a8681a5b57a1359475a405feb4cd2ddacdae7ba7672baa57eb921798d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052727, "uuid": "fd7e17ac-e14f-40fd-a761-13695b2b42a1", "value": "T19DC31995F941AA22C6C256BBFE4F428E37165798E3EE3203CD155F6033CB95B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052727, "uuid": "f311a154-f807-4f0f-87f7-6051a09eb859", "value": "3072:TlIrMP3G575Ij/QX4crAvmUR7b+UT+ORqZnT4:TlIQPmdIzQX4ckvmUR7b+U6iqh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052727, "uuid": "c5ebe5b7-c69a-41b2-8c92-f81348c25ade", "value": 120556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052727, "uuid": "1bf21c9f-e300-48ae-8a99-082cebb1071f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052727, "uuid": "b1f08bd2-8052-4f36-b71f-6e45a52b97e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4404c488-e4f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040250, "uuid": "ddab60fe-181d-4835-bd5e-78e0c89cf8cb", "comment": "Malware payload", "value": "b7ad6ff7315e2826dc81bfec32ed3453", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040250, "uuid": "dee99769-d464-444a-af7c-6c53dbd4f2de", "comment": "Malware payload", "value": "2c5d1d736ac09abf9e9cd1eb50e9fafdcd3128d94e2d2600bad8c5d89274f230", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040250, "uuid": "2e3ad81f-eba0-4879-b475-7b6244c418a1", "comment": "Malware payload", "value": "a0653eaaf297f6ffcec6c7611dc7dafc3dd41c0d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040250, "uuid": "ec33fed6-4c59-49f1-b28e-412d7c77f62e", "comment": "Malware payload", "value": "4ff05b19ed56b89a2d8cccae23306e1be88d894eb83b8114836e01dbbcad60eaa7b229ea85e28dffe26640b6002557e1", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040250, "uuid": "04a7330b-abdf-434d-873a-b3751cdd220e", "value": "T13318129EFE84D413ADE3D8D4ECC2E9D3580349579F972AC02A3EC0FA0E77760A856654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040250, "uuid": "5fec6eda-5d76-4d26-89c2-b7e0c0a6c430", "value": "24576:6gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gH/gHP:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040250, "uuid": "b6e6e90b-3a61-4e4d-8306-7879abd55c40", "value": 92404728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040250, "uuid": "8cd7cf12-1849-48b7-8c7f-ad83362d8387", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040250, "uuid": "ce53a4c0-a670-4041-9a3c-6dbce37c2a18", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3493d846-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029916, "uuid": "f12e8200-dfc2-4b52-a66f-a550fa3ee5b2", "comment": "Malware payload (Mirai)", "value": "222bfd1ac09f2e0999537dddb9af6c7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029916, "uuid": "1743280e-d5a9-4f97-80ac-48ecf0115a7b", "comment": "Malware payload (Mirai)", "value": "2ca67c5fd319ed30493fe1bd6b38f449026d2522df788de1f8ebf2d2a42bb40e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029916, "uuid": "5d3fc591-d364-472a-aeb2-65ab86097ae0", "comment": "Malware payload (Mirai)", "value": "fe1b8233da16b3849ef64832dca08cc5c8fcb1b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029916, "uuid": "10b455b1-afec-4fdb-b920-4ea3c6109af9", "comment": "Malware payload (Mirai)", "value": "deb2fa40d9d5d3b44feacc974634c2af21a0d91913b5c859643504b301c7df661e1ac9951ff9b32efdd70331619deb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029916, "uuid": "11aee2af-666f-4164-9f65-033080758b64", "value": "T11F73124F6212DE41CC5698BC0AED57CC2EFE2CE0790109A63D9BD990EC635345962FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029916, "uuid": "c12b20d1-23e0-4bf0-8474-7d2538f064d7", "value": "1536:TykxYOFqQCL5oTsPaTCyPb0REaNtbWAnByt6dX1QWyzifkRN2G98mVJuD:llFqQCL527wREqHByt6dmdekjumVQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029916, "uuid": "40a87a0d-2e18-41d4-9536-0b3ddbceccaa", "value": 74476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029916, "uuid": "79fa4c5b-2464-4075-9934-114880a34359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029916, "uuid": "880e9361-7974-4688-87da-e7c21bb20033", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed64f5a-e50c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767050308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050308, "uuid": "dcacfafa-b8f8-4097-b79f-3d7127905a88", "comment": "Malware payload", "value": "0ae922b1de18f6924e6fb6e085235882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050308, "uuid": "42887322-6125-4389-bf34-6c7cea0a31ec", "comment": "Malware payload", "value": "2cc4e87c83a6fbab7be0064a6fcc8af23ad1e93dc1ae4b0d814cae9fe602d918", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050308, "uuid": "4353f729-eb9c-45ce-b34b-01ca651f9cf2", "comment": "Malware payload", "value": "01002d6900fdbf50ce8c725c722665fe0edb13a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050308, "uuid": "f75dc37e-b31c-4599-947c-7ef83898f36a", "comment": "Malware payload", "value": "f7728ece80f02dc5658a5e9037782c03cf2d7149b186e089f7193a64d034eccfbbba1cad0bb0146edbb0b6907a24d634", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050308, "uuid": "7c534ef2-4633-46c9-ba5a-61780b7d9a3d", "value": "T18523284578819A27C5E423BFF66E018D332567A8E2EF7217DD222F15778A82F0DB7601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050308, "uuid": "799fdbc4-61b7-4ab4-8cc6-abeb0a8e3348", "value": "768:ukkSp8JcTYR/knOWEfjFFyQwkUdSa5L7lzlNlXEzq1yu2:CSKJiEfRFLwhdSI7RPYu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767050308, "uuid": "5d94f444-98a0-4837-a01b-47280adada8c", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767050308, "uuid": "047494d2-c499-4342-adec-2b858fed3cc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050308, "uuid": "698ce8d4-ebfe-4cdd-a236-2f695258d11f", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ab2b88-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995392, "uuid": "f8936ce3-c7b1-40e2-bfa1-b658e69c6986", "comment": "Malware payload (XWorm)", "value": "e3b0fced37b0f43367c4ecb6994652fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995392, "uuid": "1626ebd9-30b3-43ca-9779-2a214ab822ff", "comment": "Malware payload (XWorm)", "value": "2d57fc27c5264eee4a224fc4ffbfdca1940cf268343c753c2ea6e6e90da979e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995392, "uuid": "d1c048d2-a5d7-487c-90a9-e4da3331190d", "comment": "Malware payload (XWorm)", "value": "a558979ad8b2d728030ca8f92b80f5499bf1ee65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995392, "uuid": "9ab0a9c6-3406-4b85-9d83-7f6a19505c72", "comment": "Malware payload (XWorm)", "value": "476d2b10e45b7b3fba6bebeede30c8e84fe05f37f92e100280a64e4e7f6e96dc7f980068a655abdda4247bf6b33d70ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995392, "uuid": "da4b2611-8a7f-4531-896d-f8acdcf34e5c", "value": "T124633BFBA81728FA653087734AF05D416036B507DEB952E84C66BF04C0F07997E9BD2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995392, "uuid": "06cf367f-5ef9-45ca-9607-0d83bf1aba9a", "value": "768:I8w/h62/jWs6oS+xISN0vLzVNRNBdkfScBYrwz2y8kTAlGB:I9l/AoSSMjR/usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995392, "uuid": "c1cad22f-4f34-413a-a55e-49cb4a75aeb4", "value": 69631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995392, "uuid": "08c6547f-9a12-4743-a0e7-691a54615a2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995392, "uuid": "201d702e-2529-42ef-8e02-3d6c2ed4bc4d", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07486e55-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1766993333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993333, "uuid": "66026e07-f559-4fe2-a91e-39addf92ae85", "comment": "Malware payload (XenoRAT)", "value": "ce56d1fc6dfbb852c1d2dab22ac1aa92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993333, "uuid": "f1866c80-7df8-48b0-8c8e-64a86a1c0e7d", "comment": "Malware payload (XenoRAT)", "value": "2d9ab882ebccea30426ed3fab1530dcdcffe908c2afd5dd38d8dc4a35ee7847a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993333, "uuid": "19641034-8f94-4da4-b303-21621ce2a66c", "comment": "Malware payload (XenoRAT)", "value": "22827d4134b1763855848dbab5c9944a9ca80763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993333, "uuid": "32292180-642c-403f-ae78-33c7d6c9a1a9", "comment": "Malware payload (XenoRAT)", "value": "ec4a8fcbf9d1ce0caabd75904b49b50402d14b12fb37fb2f5583391b0ca768d139c91bcc78680aa78e3a99d042fecaf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993333, "uuid": "f8a6058c-3c23-4a20-be89-9cc54e8af3a9", "value": "T190162387312BFE1FE95BC3F86E6169AE51D12E4B4E833C482B12F2344171DAB78B1465", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993333, "uuid": "530ea473-0f06-4aab-a2d1-8a187806e8bd", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993333, "uuid": "5f174d50-10ae-4fae-9421-efc94a3df996", "value": "98304:ZzA6x1W9PDWn6AsHLicKn09MS7LlI8M5eBDR8GK6Qgg:ZzA6x1WxBAiuce0yS2TG+lLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993333, "uuid": "a6b861c6-edeb-493c-be1e-4312f03f1e40", "value": 4390400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993333, "uuid": "4dd03756-b2af-4df8-8a1a-84067e2d96b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993333, "uuid": "0aaae076-f21c-4768-bf82-c3f5d2f7ac23", "value": "2d9ab882ebccea30426ed3fab1530dcdcffe908c2afd5dd38d8dc4a35ee7847a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bb9ad9-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967982, "uuid": "b3c3dea0-8774-4405-8345-4b1078ae7ce3", "comment": "Malware payload (Mirai)", "value": "43c793bd94e2d72bc3419547548b8477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967982, "uuid": "3e58dd56-1635-40f5-86b9-a62052329cf1", "comment": "Malware payload (Mirai)", "value": "2db4f927fdbbce3198026f9e398e9e432974892967682a541d3c611e187e23c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967982, "uuid": "fac856aa-0e21-4ec5-9e12-c1cfde969583", "comment": "Malware payload (Mirai)", "value": "98ef068429efa1c3da99600df28ca9304448c641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967982, "uuid": "ec58040c-a5ae-4bf1-9d26-2211f681f956", "comment": "Malware payload (Mirai)", "value": "05ab3b3f292248c05e7c3e1a9e8fa961966a71cb00910942daac15d443c786c8a0f53b667995cc0e44c30d0b444a4911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967982, "uuid": "f8c77dad-a531-49e0-9090-a1f8d57dc625", "value": "T197933C4172694F43F05699B1FE3FABD0DB9E5A902168B70C240BFE8881B6D335487F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967982, "uuid": "17a3cfa9-0418-414d-afaa-3ac92d073e0a", "value": "1536:fGsAmfmIuYFAcJUg1sOuqhSKziy8nF8VR15V30:fRfmIfyAsTbK8nF65F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967982, "uuid": "bd1e3146-f6e3-429b-a427-d853a5b88900", "value": 89292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967982, "uuid": "3e6514da-4d45-49ee-8746-78135a16cc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967982, "uuid": "75388539-4373-425d-b671-3a2139d0cec3", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506dfe83-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766995174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995174, "uuid": "77c37e04-e075-4741-befa-7f0917d84879", "comment": "Malware payload", "value": "19a7df66077b3176f6d007e15f11e772", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995174, "uuid": "05d184d3-de1d-4db4-80a0-65072d94f51f", "comment": "Malware payload", "value": "2e24b5cc2f59752b8d50b17faaca221df3f35ad7b7eeff4052648bd16d9120d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995174, "uuid": "aaa6c33f-4054-4eef-9e7a-8d1e7917c817", "comment": "Malware payload", "value": "67d7bc735202701cf6a2bd975b7a4fc331f9cbd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995174, "uuid": "8e42bcad-e3a4-40da-8397-67a945fcdee3", "comment": "Malware payload", "value": "980db5e809b09e783368bafbf0e37257d8483311736a65ee0b8f887c16841efffa7081b1cdd874aa403444f59c02fc9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995174, "uuid": "a5d35b3a-3d0b-4e30-8415-400c6765271e", "value": "T1F06308C64B81E6408CF6F3A41F1CD75E26550F5F8A75A3B2292DF630526B8369CCB18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995174, "uuid": "5f544239-0e89-4edf-a3a1-9a54eedc52f2", "value": "768:I8w/h62/jWs6oS+xISN0vJqWIXU6fAodmhf8KmZm641QbtWu8OLTgkKiLwCzwB6m:I9l/AoSSM7h+usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995174, "uuid": "721fdc2e-4e54-4c1a-9f7d-f3a1aaaa560a", "value": 70592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995174, "uuid": "10bd8e96-c7c3-4feb-a717-2eb3d17cc2e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995174, "uuid": "1f7201d2-93af-409e-97ba-b8cb453d9e2a", "value": "invoice-1645080830.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add2d4e7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995331, "uuid": "4363aed2-5717-4084-bb42-14315df45adf", "comment": "Malware payload (XWorm)", "value": "748b90ad85cac8b9f4e5708a89b5d8ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995331, "uuid": "5815871d-340d-4bb8-9404-89df89ff49e4", "comment": "Malware payload (XWorm)", "value": "2e524d0ab76c25fb0e357ce2e14b0a80cccf63219caf45b24d6dfcbcd5177895", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995331, "uuid": "b225a96a-5e8f-4ff6-b251-782b79a06db0", "comment": "Malware payload (XWorm)", "value": "caa1fa433b8f5e150af4b45a6172be3c2848a749", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995331, "uuid": "87383d8f-a2af-4b76-88b3-32d03cf61556", "comment": "Malware payload (XWorm)", "value": "bf98cbaf9963eca60b6b889adca6b494b7692591e76fd2ab95e5de3acf94d0c2e81016cf755123d07c2f287a85c212c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995331, "uuid": "b6576d96-a627-4bfb-8a43-b76d0f98cefb", "value": "T149632C45AE4297A9722DFD018C27E77212E3EE2C4C5D6095248FD352E32B94B23793F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995331, "uuid": "094cc381-5a8f-4314-a50c-f3c5f1d6fcec", "value": "1536:I9l/AoSSMIH7vW0il7Z4IAEQ6oLJCL0Lw0Qi6KHkvWxKr7kNT9m1mujv7IRLdusq:I9l/5MY1usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995331, "uuid": "37ebd713-4651-4e68-833e-f48864063859", "value": 69644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995331, "uuid": "eae65acd-dd80-4867-8b9b-162263fe130d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995331, "uuid": "413285d7-e759-495b-bd2d-f0f104abcd27", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b378bea4-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995340, "uuid": "e41c6d3e-c1ec-4b7b-b710-1e4ee9fde076", "comment": "Malware payload (XWorm)", "value": "f58b226e6d2007f06c99f2956251e2a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995340, "uuid": "6edec7b2-0363-47d9-b0fe-0cb54255f0cb", "comment": "Malware payload (XWorm)", "value": "2e7fb070b19ee41e42fd7834f294e3b555a47a77209e03b791d60ab80c9f17ab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995340, "uuid": "1a196d31-c54b-4f5c-bdc6-cb8fdb128bba", "comment": "Malware payload (XWorm)", "value": "2d3b27768fc604b3286e6ce74967b36d5b1714c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995340, "uuid": "6230511c-27d7-4c3b-857c-84ba052439d9", "comment": "Malware payload (XWorm)", "value": "17fb5c6553af8af95a6a89d82ea9cd0c8c9160bd222c7c0111340c12b8c1674b87ce7ee1db2c254f854b02d6101c64b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995340, "uuid": "cbe0c75e-a0e1-4fcd-94e8-843b3a35f10a", "value": "T1C0731A9D6AF521A016F0D12ACD7455D2CCC2F48F5793C8F0D16AF4858A2EB895FAC28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995340, "uuid": "f4f627ee-20b9-4676-be9c-57f947ecfb31", "value": "768:I8w/h62/jWs6oS+xISN0vgsBnLdAiDmxsQwqkRi6350mny+nr7wUwNrwnAIQj9In:I9l/AoSSMP9yr9DusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995340, "uuid": "57bbb3d6-0b38-4318-891d-f52c48ba82d1", "value": 74390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995340, "uuid": "24f6a7be-a8db-415a-bf5f-59127701c4b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995340, "uuid": "be1804ba-1826-4acc-b8ec-d7641e208944", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc074bef-e4fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767043941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767043941, "uuid": "2f45e0e2-8841-4adb-b03b-9450a03061c1", "comment": "Malware payload", "value": "1b05b1d83d884d9e4662b52d8d0da408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767043941, "uuid": "4f9b11d9-daed-4271-97f1-ff51ef918e5d", "comment": "Malware payload", "value": "2eacd6a469a49aed5deed4891158195eda16103a31746b893bebd739472116fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767043941, "uuid": "872f6624-c7a5-45df-877e-86af70969a07", "comment": "Malware payload", "value": "30a41d2baa589078f3c93f020d364dcd2e944de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767043941, "uuid": "660d62b7-56b3-4f59-adc6-66d68dc91bab", "comment": "Malware payload", "value": "0a627489654dca802e61333f0207e1b735e347ff96422f0e0ec08eafb3548d80ec0cd54b0100a6ba92c223792cf8e145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767043941, "uuid": "6ff7e12f-8e67-46bc-b860-13bf9263e6a5", "value": "T19D959E19E6A4C1FAE1A291B4C9934901E7327C5A4730E7EF03A4BA7DDE33AD04D39B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767043941, "uuid": "5ef9bb45-2b84-43e7-a56b-53343919a901", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767043941, "uuid": "95e6b36f-aea5-4d09-bc82-937fa67224b7", "value": "12288:lhoVY2+LfWvRSECKG4iRkTt4ftxn9M4C+VdvUF4V3LlA9V+:7b2+CvRSEHiRkTt47n9MLV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767043941, "uuid": "2da7ed44-5f14-4fd2-b081-6b16b150d90b", "value": 1981980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767043941, "uuid": "0cfd8f98-be36-4152-9789-89b0f5b67b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767043941, "uuid": "12bd2568-b38f-47aa-97b5-0b935714392c", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38773dc2-e451-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969793, "uuid": "a0b88b99-6af0-478e-b6ee-aed07dcfb4e6", "comment": "Malware payload (Mirai)", "value": "a6390b7826016d14f7dd483aa43e043f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969793, "uuid": "ba5841d5-68cf-45ed-9337-733eb285de5b", "comment": "Malware payload (Mirai)", "value": "2f4a3fbb39522319945ece952bb63d26721ed30d53d55f87a8612bfa3c4729aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969793, "uuid": "2d3f5e2d-24cf-4f94-8cdf-63acf53ac5bf", "comment": "Malware payload (Mirai)", "value": "09078724e4787ffe0bc2b7d9ae1541bf838bee65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969793, "uuid": "9c9b0e02-ef7f-47e4-be28-2f593a917815", "comment": "Malware payload (Mirai)", "value": "cf196fdba40288d7cb5be456070e8568b6d295f05f2b745603e30d095c83bccd78b5fd2b9a46eac04d55da6c315a5542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969793, "uuid": "36bd85c2-c351-416c-be2b-0fc00964d908", "value": "T1C8144A02730C0D47D2672EF02A3F2BE583DFD9A225E4FA45654F9A898271D37158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969793, "uuid": "da38955f-2bbe-499d-ab55-a791f4c7d0cb", "value": "3072:vn2sjHWjvbx99on5cp1tI4bMh6hh1zyFsp:vn7kvbx99on5cLtIy3yFsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969793, "uuid": "d31a29a3-f712-4ff6-a0a2-4e5f0f3eb80a", "value": 191388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969793, "uuid": "59260013-aaf3-4e89-8328-8eea0e843445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969793, "uuid": "f96abd9c-b464-4a60-8f02-f92144d51cb8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a30b1c-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031317, "uuid": "62481ffb-77eb-4a90-88ed-3bae4504ea22", "comment": "Malware payload", "value": "7c1b316f5fc63fdad8e9a6978e07c533", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031317, "uuid": "dd693988-7214-4e6d-a9bc-bd7980db3fc5", "comment": "Malware payload", "value": "2fbf3a3dd65869e7f55ef3be76cfa385febb0f07d33463bb6beb77cfe10939d8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031317, "uuid": "e6bb28c5-8a4b-4ede-a611-c44249cd9e35", "comment": "Malware payload", "value": "82ea4e0bd4e1edbd6bd5a0e9fdf49e478aa833c3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031317, "uuid": "f8d2f8f8-3677-4c85-b5a1-13abee89c818", "comment": "Malware payload", "value": "2300ee78b3e43f3c96146d3b5015ce8c6a645978534a31df7f76f184430a99dc33455c302c3c3a33c534da0f47e0d6e2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031317, "uuid": "34d03ce0-fd70-473e-b5fb-9db46abb7159", "value": "T130E1E896ACF324196417509DCFBFA25830699057874ACD9CFECC66A8DF0C2A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031317, "uuid": "7663ffb6-9a4b-4f3e-9145-b78a74dc3063", "value": "192:OZYIE/CTK/el0llHYoHsfOBro2Tc/OfSmy:OM/rYoHsfO2/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031317, "uuid": "dfe5ec03-2971-411d-80e4-80c0353de96f", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031317, "uuid": "4d4dd035-7610-4379-bf98-68786ee759fe", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031317, "uuid": "365e446b-a088-4840-a541-135220d1d571", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4f777d-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986817, "uuid": "9bc01dc2-538c-4a96-a266-db5902a98f75", "comment": "Malware payload (Mirai)", "value": "bb314f95e0986136cfb0570d17fe1527", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986817, "uuid": "5ae7fbad-906d-4614-8876-572d1e1d93df", "comment": "Malware payload (Mirai)", "value": "303fb9b2962e43d8891c8de51ee2fd6c2e25c6ef4a98fe4295cf7f766fb9599c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986817, "uuid": "5774a46b-7416-4e27-b7ab-2a1e9483a68d", "comment": "Malware payload (Mirai)", "value": "30d3ab98dbc61823b373229c5be61322989951c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986817, "uuid": "1ba9b728-44eb-414c-b39b-0e46b232f429", "comment": "Malware payload (Mirai)", "value": "a0da75c266362b2f5faef98385b73e148d7e4d49e0807679ccc55c6e2e0639b847fa2c4fdf08e12e53c581ec94da41ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986817, "uuid": "d41addab-f6be-47f3-85f3-f06795fc13e2", "value": "T12023F756BCD28A2AC2D022B6BB2F558D331263FCD1DB3267DC151F10768A51F0EB7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986817, "uuid": "424a4b2e-4659-4485-a64a-804282af9749", "value": "768:mH/tR+W+y6m99mTaHvTCePp3fbWLIjFWRohAhTcSPBt5xpSavNGp:k+W+tymTaFfb1j0phTcaBt5xlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986817, "uuid": "caeb43c1-ccc7-4bb7-829f-6774e3eba8b9", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986817, "uuid": "1cfe9e40-f37b-4a39-b2aa-7ada52cbd0b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986817, "uuid": "9eef39eb-eca8-4ee2-a92d-d6e0c3035a96", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e23d8f-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967239, "uuid": "953cb739-5f72-4643-b350-d9701194fff6", "comment": "Malware payload (Mirai)", "value": "8b68464ae0e1d791de4b68a3351bd871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967239, "uuid": "39197433-d4cd-4862-b494-59afe8db0da2", "comment": "Malware payload (Mirai)", "value": "3042a24a499423f7bc8cce7d34d9224bbb986ab9f48b325cfbd43ec8150bada7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967239, "uuid": "67b09abb-af3d-4c60-b5e9-4d3ab42a043f", "comment": "Malware payload (Mirai)", "value": "516efa9cd3383aa1f78191b2fa333971176dd8fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967239, "uuid": "378ca562-3d32-4715-bab5-5b55f99edbe4", "comment": "Malware payload (Mirai)", "value": "ecbf9e24d39cd203c862cd6b608d64d7e315c3e1ba72960131f2a23e48c5a5302ffb0d6d801d9a23c602fbfac79dc444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967239, "uuid": "f8e5ba15-64cd-43a5-abb0-98986c0a76fa", "value": "T17443F855F8818B22C5C4027AF92D118E332367E8E3DFB2139E116F607B8696B0E77D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967239, "uuid": "71b1d0cc-8457-497c-8183-f7db4a96eedb", "value": "1536:5Jn3ofBLWusv0VreaxAgOG/jg/qzzIriZTdeh11:iB6uI8FJfTdeh11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967239, "uuid": "d93e2954-39cc-46c4-aedb-fa0bf9c7f94b", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967239, "uuid": "82f9ef60-3395-4a18-9d8b-55e1baca5a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967239, "uuid": "2f324f31-ad90-4600-bc50-efaba93ba62d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae94f53-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996695, "uuid": "6859f9bf-92da-411a-990c-72c890e8c0ac", "comment": "Malware payload", "value": "336971611f3f22437ceccc9638f414c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996695, "uuid": "e4fee5a7-c4bb-4dd1-8083-d7ed231a961e", "comment": "Malware payload", "value": "305814a993b7cdff855c96493cc04787bd98a382e4ef41f922f4d54e551be8a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996695, "uuid": "348b29e3-59d6-4ed2-889e-4c6be43741ce", "comment": "Malware payload", "value": "37585499f2e3bf52429efd1a5c3316e9d7c4bc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996695, "uuid": "b5298b7c-7441-47d6-a574-d4fa4a7e22a8", "comment": "Malware payload", "value": "3174b00da0103224b5aaa960f9a4477b4b0ace7bed6e69280d3300a2b5871ef2fbeb95f074925660c389580cedeac565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996695, "uuid": "801570fe-c8cf-4e2c-ae2e-540504e1b0ad", "value": "T1A256F126A3E805A4E47BDB34CA55C333DAB0BA564735E54F0A4DD2062F33AA19B3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996695, "uuid": "9501441c-db47-48de-8a1e-50a9ba96f096", "value": "53bb449421a3ab9589685b31fb162bec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996695, "uuid": "513760e5-3f6f-4f49-bdbc-5bb203458dea", "value": "98304:3h4SpZmvVTR/5hRDzMuDCLXcpenTwcRNY:R4SpIvVN/5hRDzMsCLXAenbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996695, "uuid": "3b711f82-2dfe-40dc-a551-2718c9f11b1e", "value": 5998324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996695, "uuid": "13b7ec21-ab88-4cde-8592-d8ae264e433c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996695, "uuid": "579fdc78-3dec-4620-ab58-2a342e3b59e5", "value": "305814a993b7cdff855c96493cc04787bd98a382e4ef41f922f4d54e551be8a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5894a0af-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026970, "uuid": "7a0e850a-6054-405d-8d7f-1b4934bea96e", "comment": "Malware payload (Mirai)", "value": "95ecb988df957d9785b6e21593da162d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026970, "uuid": "2ee1fd1c-9c80-4bc7-a82e-7fa94f5ff2f1", "comment": "Malware payload (Mirai)", "value": "305e72e193a2076988200ced88d56a3af2c40c811750a8f6f5b2dc008f949f3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026970, "uuid": "074e3d39-0a4d-4cbf-9a3e-b3a82c34d402", "comment": "Malware payload (Mirai)", "value": "54c6444e71ad8470f3e116bb50719f8a4e17746b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026970, "uuid": "cd2b0f00-20e2-42ea-9c82-7159ea913cd3", "comment": "Malware payload (Mirai)", "value": "0d06ec8302be8e06788ca259495fadd3977ca7a0ced8a424e52dbd4f160858271de373f9a45a97f0c46815f12cce220c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026970, "uuid": "872b3f99-bb8b-489c-a9e6-9d1b5b917098", "value": "T11854A61E6E228F3DF7A9827447F74E30965837DA26E1D584E1ACE5001F6428E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026970, "uuid": "771cba59-c1ef-48f8-9af9-c4b47c1cc285", "value": "6144:2jjtDMjGgLi2FT6dYj5Kfug2uwRO5LI78:2j0jeYlKGgvbI78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026970, "uuid": "d67cbb61-4e9d-488f-914b-2f2426cd1825", "value": 290092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026970, "uuid": "13685426-b948-41dc-a3ba-7887f84b4c50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026970, "uuid": "c2d432a2-befa-44d8-9378-370d3cbd945c", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82e28e2-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995429, "uuid": "41fd6abd-f5dc-42b3-95c3-8c2d4c761e90", "comment": "Malware payload (XWorm)", "value": "8dbc04c235b40f1d6cd252555ee7c67c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995429, "uuid": "630e932b-605a-41b9-8e6e-53ea21cd0837", "comment": "Malware payload (XWorm)", "value": "30c999e41be8181f5f7a1afd58c692652cbdc1a0beec181a8e1b8cf7f2f22078", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995429, "uuid": "a9f28975-8c67-4c43-9267-7c2d42eb0106", "comment": "Malware payload (XWorm)", "value": "6267890a2a5785adf951d15994b993be767dcd06", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995429, "uuid": "6c7b602b-1a9a-4fad-a375-bf5560f45a24", "comment": "Malware payload (XWorm)", "value": "d4ea96036a439434c80dcf993d30c69f3144b1f0dae4c4d79970f7e300663975a860224d40f2925d422fcf047262bf55", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995429, "uuid": "7d8f8b64-ea7a-4fe1-a729-d0f4eb44903f", "value": "T1CF630967398CEBCEA601AE12DB5B21D5FA4121578F1F56CA1B87AD07EA12F1133F0076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995429, "uuid": "44b9c009-dde9-4767-83de-82a82fba2974", "value": "768:I8w/h62/jWs6oS+xISN0v/mw019dkfScBYrwz2y8kTAlGB:I9l/AoSSMwDusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995429, "uuid": "ea976c6f-dd1e-420f-850b-309d9ddd7a74", "value": 71558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995429, "uuid": "ad1ffe98-09b3-4729-94a3-efa0b66e48ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995429, "uuid": "0c9ad2aa-f842-4f1a-b1e4-6153d5e6f00e", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c82c8e0-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968163, "uuid": "68785563-411a-4332-9c82-032a5903cb34", "comment": "Malware payload (Mirai)", "value": "b02c36c5473669968f7adb3631d4454c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968163, "uuid": "44b0d09f-8258-4a09-84e8-c1d19c6e7dfe", "comment": "Malware payload (Mirai)", "value": "3123bbb8f89c98fb4b134ab3cbac14eff2cdea301e94b52858bbf3aa8b993052", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968163, "uuid": "4c12ea6f-4202-46ae-9637-8f0f70461ba9", "comment": "Malware payload (Mirai)", "value": "e6171cb7ccd3b4eccde1d3803e9986c9a81cd27a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968163, "uuid": "09940f02-4595-4d60-8523-fde783a9889b", "comment": "Malware payload (Mirai)", "value": "6aa2c62bbc5131a8ef8e78ffa0d3d504a1fd94f8292821def2c6b5f12b5ee51511a95c5701719fa848b5f66910fe7174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968163, "uuid": "91e1b39e-f627-443e-9d98-633339e8b446", "value": "T12EF38CB3D8252E98DA64C4B5F0F0AF795B13912590935FFA69A7C2B18047D8CFA093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968163, "uuid": "d45e0178-e244-4e52-acd4-8bf7ade22c69", "value": "3072:wAdAfZG6V+w8EF4sb8cYrYxet15WhPcWe36hh1v1xErnH:wFGHnEtb8ctYkhpeo1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968163, "uuid": "13ad6e2e-f42a-4379-98f0-10e43710ab22", "value": 170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968163, "uuid": "d3daeea8-ed96-4d7f-a715-8149a8ac3525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968163, "uuid": "cd294e5d-8a72-46c1-8b96-a60fd7dcb89b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af14144-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968160, "uuid": "ad0c9d63-0362-4f19-8429-fbc00b47e960", "comment": "Malware payload (Mirai)", "value": "42b80b1f8f0542518481c96bad0d23de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968160, "uuid": "f50b8b3e-f50b-4b9a-b06a-d0d349cbc155", "comment": "Malware payload (Mirai)", "value": "31a8517d1165dc8b8335f64a85339f901ac3b8b12ea53b05cd7c4aea841ee787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968160, "uuid": "c11cecca-db17-40d0-a806-ab6f453b2096", "comment": "Malware payload (Mirai)", "value": "8db70482bba11e9cab6378cd0de026035c7e9f85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968160, "uuid": "5e9fa94e-d8e2-41ab-bf57-07937f2c6eff", "comment": "Malware payload (Mirai)", "value": "7c1fd5fef3297f67802d93c3d81676bdcef0e902e3eece5f84c8646cf31b74bcc01063d8b981f48ee136e73e080bee8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968160, "uuid": "7cde3ac7-d663-4d85-9fcd-9dee46604b17", "value": "T1DCA31956F8818B16C6D512BAFE1E118D331317BCE2EE73139D14AF24778A92B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968160, "uuid": "9ef8e28f-83b5-4b4f-b79d-aa3651d5d1dd", "value": "3072:MEzGm1pOQLyianr+VXSGPYGP7syaIhjuvpZs/z3mAuZy:MEzGmHOQLyiar+VXSKYGPgyaIjwZyi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968160, "uuid": "6f91578f-475b-406c-8a26-a5860549b4df", "value": 99968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968160, "uuid": "0edee05a-80ed-4fb6-ab3a-fb6722259901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968160, "uuid": "ef3c032b-6419-4122-8e84-1c684cecd78c", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45494135-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968956, "uuid": "d53acd14-8555-4840-8910-2839714e9809", "comment": "Malware payload (Mirai)", "value": "6e69e6d7a82b2596b7691e74b07219cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968956, "uuid": "5e6ec04e-81c4-4514-84d4-e2f7e3f4e224", "comment": "Malware payload (Mirai)", "value": "31fb253a13c2cddc66480f4cd3a44c793434d2d29d868bd03ed00b2a4df9a944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968956, "uuid": "67099350-1273-48e0-acdc-1675d18c36f5", "comment": "Malware payload (Mirai)", "value": "70134c0bd89139d6ca648e4accec322186525473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968956, "uuid": "2c881ea1-c719-4181-9aee-f1ce06f317cf", "comment": "Malware payload (Mirai)", "value": "b14f2f56bac01e278ddde149fce1c6826b263872f3352fcc85f0885be3b81f115315f48c33b38c22cdfd896827b0d9b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968956, "uuid": "59af360d-2c9f-4b0d-9a8a-ced119d444f3", "value": "T1CA23E807F54285FDC84AC274076BB93A9C3275FD1239B2E63BE0EB222D96E215D1DC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968956, "uuid": "76373757-bf11-45dc-aaa2-335fd2914b77", "value": "768:v2aJNyog4eOOw+TFRCRNb3aaVgdmpv9OCurAF9GZda8oie4tpdP4CcysQTbps:5JIoxeOOPhRCRNb3TVgwpVOgFQZEipd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968956, "uuid": "480a3812-0257-4793-9145-ce29079e8398", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968956, "uuid": "82eb31ae-4999-45e3-ab61-5d90d4cb7421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968956, "uuid": "0eac2a8a-e969-421b-9218-ba9bb5cddd29", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c637cf-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766996260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996260, "uuid": "ae89a36e-9a97-493e-b64f-540e0366cddf", "comment": "Malware payload (AgentTesla)", "value": "c65d4ab63a0e4e644da9de8f7aded5c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996260, "uuid": "bdd36be5-9447-4ef9-9437-8ca976dd77fd", "comment": "Malware payload (AgentTesla)", "value": "325242fee391b8576c44b041a4a93a72a66e339d60c6cd17c66c88acd201b046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996260, "uuid": "dafa356d-0339-43c1-8dfb-59910e70b56d", "comment": "Malware payload (AgentTesla)", "value": "29056f0c7669f65c1fb7b6d1706dac9158b1b526", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996260, "uuid": "e03a3874-d2d0-4fcf-9c9a-c42457aa11a4", "comment": "Malware payload (AgentTesla)", "value": "8762d5be2336e2080bfce369f97bf55e352c872ed650c031c89310e7144eb85852e97c41d95dc03b148211ed2fe13bdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996260, "uuid": "a2c975de-aaa0-43e3-8b02-4263412f678e", "value": "T10075E062B6E1507FC2670A758C6BC7A85C2F39302A24994D37ED6D0C4F296613B36ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996260, "uuid": "7d3bc846-6811-442f-9cf8-79a07c17ad73", "value": "cd7dcd607f39159e7c7473c5f1fbe0fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996260, "uuid": "5e44445b-5245-4e35-95bf-40c5354c5b03", "value": "24576:9z0CJh5UBcWi7cOWnEUKEJO0IMC2l4RZX9jGPnzOeh1x1VZB:9zdUBIoIMCn9Feh1PbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996260, "uuid": "a5d08a31-20e1-46dc-95fd-f18ad79618de", "value": 1699328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996260, "uuid": "1243d1b6-51cb-4f7d-bcbb-632760b23ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996260, "uuid": "be72578f-d347-4e71-9d6c-072165362fc3", "value": "PURCHASE ORDER# 231759 2188128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa278905-e4ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767036556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036556, "uuid": "a121b4b8-4a9d-485b-bf2f-d3e57ac94623", "comment": "Malware payload (Mirai)", "value": "c148c09bdbe139aba67219f193caff9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036556, "uuid": "c6e4461b-9318-4cb2-9873-0f4c321dbabd", "comment": "Malware payload (Mirai)", "value": "32fa92f358341a7479df8eadec27c7a11ba40225fc1d2c59c17712e4767b4a67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036556, "uuid": "0ad0d34c-184c-4091-9038-82e1375cee4a", "comment": "Malware payload (Mirai)", "value": "6f9a8990a82c512c905ab9a51d31fe5ea97239cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036556, "uuid": "2de86944-66f9-43d5-b1bb-6a0ef432d0c7", "comment": "Malware payload (Mirai)", "value": "a5305e325933bf4105f47d3047359429e0e8b09023421375ccbdce5da1a35e96b44d23c1ceb3b98c96726e4f8dcfe79f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036556, "uuid": "0d676797-4ef1-4a7f-86ad-0197f15ec4a1", "value": "T1C2D30945F8504B23C6C612BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036556, "uuid": "eac4c97d-f9ea-4726-b620-a9588e3b0f9a", "value": "1536:UFKdzElm18uZJNb4AcFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTW:UFKp50zU8e947Lb71izSftBdRalKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767036556, "uuid": "bca9a85f-5646-4836-8724-f2d5e5003694", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767036556, "uuid": "111549df-3803-4931-9387-a27ea071bb03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036556, "uuid": "39a31041-2151-4949-ab2f-3241392cc60b", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c129edb2-e493-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766998370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998370, "uuid": "b8a3f060-e1f9-4b1d-900d-1512d621aa7d", "comment": "Malware payload (Mirai)", "value": "e7d92e53b6fd59d96241ba125831d352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998370, "uuid": "fa381fda-c548-4fb6-a3e6-3957631051a5", "comment": "Malware payload (Mirai)", "value": "338d2e2ad40290de646481fc635505fb6959d5b30132a06e079297071cb4f34b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998370, "uuid": "5fd196f4-cd50-40bd-bbb2-c3cc673636d0", "comment": "Malware payload (Mirai)", "value": "0c734c9676804f5af574d7452038e78561a07edc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998370, "uuid": "996de074-7c81-421a-94c3-b76ebc4d4086", "comment": "Malware payload (Mirai)", "value": "671a2248a1447598ee48724a74b84de1c45e4352a59067417c56776e8131799ddd52cf824ca51be68af1bfbfe0833e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998370, "uuid": "6acbb0a0-8548-45cc-9bb7-9e24f10ffd5c", "value": "T106C2D1B6E5632FB4FBBF6DA01CC08BD2BF20AF9953928E8472519A5155482A3B314CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998370, "uuid": "35c08080-6dcc-4460-be06-22b7356de1aa", "value": "768:b7mn4QhxsdiimKr7lW3tsafL4uVcqgw0z9:bLQDsVR8z4u+qgw0z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998370, "uuid": "6fdac0e8-cf67-40af-94a2-afacd89683c1", "value": 26456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998370, "uuid": "29e287ef-8581-4d3c-b960-c2cdf51a3167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998370, "uuid": "ec2c96d0-b33a-4782-8155-bb76024c4638", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd885ef-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986580, "uuid": "58baebf8-e7ae-4795-a034-48feede9fad4", "comment": "Malware payload (Mirai)", "value": "f15f84d20188971a2d5357cfe47b64f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986580, "uuid": "3694e092-3722-4533-ba00-2b08763747b4", "comment": "Malware payload (Mirai)", "value": "33c04773c0f649618a6b7b1abb3752f3f1b9324ba8cb1004ff0ad2c228047c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986580, "uuid": "0b704d27-5d84-441d-8c83-87b027ce2166", "comment": "Malware payload (Mirai)", "value": "cd251fe9758371538b065377b22f160346fd1ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986580, "uuid": "93c585ed-0508-4057-bbb8-40e2c7d996e9", "comment": "Malware payload (Mirai)", "value": "6fff1eb2fba242c72003030d1517f117c925a181a8bcb3dfe52fdec3153847f9d9234fc98d78095ae5fb25cfd0a853a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986580, "uuid": "93847c44-dbcd-439f-9453-d1de4f8ca6f5", "value": "T1D6533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986580, "uuid": "a62a75a7-86e1-4440-9311-0efa8366e9e9", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaalm:VMLSBq14Se4GHLTBygfGXAgIVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986580, "uuid": "441d5fa8-f2b5-4a52-8b59-a9c61f935006", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986580, "uuid": "9bda5e0a-f882-42c7-9e55-83bc8b4a6343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986580, "uuid": "d035122d-ee15-4a24-b974-7e7813206cc5", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ae7f68-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767029682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029682, "uuid": "a3bce120-6971-4303-8f56-b77c3f338a48", "comment": "Malware payload", "value": "87c23896c99846550cc2484df9fa142b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029682, "uuid": "67486d69-c674-41b9-b4c8-8c0cbe23e788", "comment": "Malware payload", "value": "33f6bff83a6ce68bf321847b66f432840af51cdec378b2cda41ab1f2f0e0ecb1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029682, "uuid": "86c2afd3-4b63-4dcd-9bf6-804045ed6a13", "comment": "Malware payload", "value": "8e181a0a37a3c44a6ef47439832c592de353f991", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029682, "uuid": "f3276435-0866-4748-8fd4-e4d923568357", "comment": "Malware payload", "value": "c5cc14954ebf2e2972524fd760b0a2ff3e17b941c460acbdcccb67c407e434c698cbf4ace82a74434233d22aedc6b1ae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029682, "uuid": "8c76a575-fb3b-4f20-9d6a-d408be7d383d", "value": "T1C8222EBCCAE5BCC0874B32D079DAF6D100DE93136A6F595CEEE884650B44259FBB948C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029682, "uuid": "ff9eb9f7-019a-4476-874d-f7989f22032f", "value": "192:T5UlurTAY/L1vDQGT9DHC+vz5NqQMcCYjwh9QYtZIFA8FQO5rnwzCRXaSR6SNFuK:TuUr0wxvEGJDHhecNch+YtmFA8FV5bcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029682, "uuid": "b76cd733-f165-4f86-8a01-05ef6fa17469", "value": 10471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029682, "uuid": "cc43f299-e36c-42ad-bf4e-fda4f81df191", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029682, "uuid": "f5d9ab8d-07cf-478c-b9ec-3df0d34550cb", "value": "Taxs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9b2eee-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995387, "uuid": "9c641ceb-7cdc-44d8-9a8b-d913e8ad56df", "comment": "Malware payload (XWorm)", "value": "a43abfb4469886970aac8d38e15d3f15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995387, "uuid": "44a33fcd-db18-46d2-b541-db524046bd1d", "comment": "Malware payload (XWorm)", "value": "3435e06b1343662a98305d7e86227a225a243457fcd044e9510dc9fd1f7ec213", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995387, "uuid": "9c2629c8-c87d-4154-8b92-0f96ddc4b4f4", "comment": "Malware payload (XWorm)", "value": "f78471e40bbaeac6c2d74846648ca0f4e8301502", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995387, "uuid": "1488b0d1-81e6-474e-b097-6a458548af0a", "comment": "Malware payload (XWorm)", "value": "d3ee038b06cf1c3232f0508f9b0b0e9d4ecc26155e8feb82df90bfca6ffbcbb56dd7e657594acbc01298b71518cb0b24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995387, "uuid": "2d205f50-f2ac-4ac3-b224-8b7570c3d121", "value": "T1F573F8B34F7CD117A7EDE5DBA4EDD8282D41310749E9E405A98633DBD7332922321EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995387, "uuid": "d233c961-09e6-458f-bfd8-41b96cd01b0b", "value": "768:I8w/h62/jWs6oS+xISN0vavSAmugNPdkfScBYrwz2y8kTAlGB:I9l/AoSSM6xYlusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995387, "uuid": "790290c9-d076-4654-b7bc-3bd6408d4861", "value": 75376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995387, "uuid": "a90b4a68-f04a-4e70-aa31-7ed7ccdb2699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995387, "uuid": "5b94e874-db3f-4525-bb0c-9450c52732cf", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5ac733-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016217, "uuid": "7d03fed7-a8ee-4006-9489-dbc9bf3ad77e", "comment": "Malware payload (Mirai)", "value": "9839527651b83914895c9c9df6ebd8dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016217, "uuid": "1c02d676-13d2-4566-936f-c2b88ae2be87", "comment": "Malware payload (Mirai)", "value": "3496b646ef0224992ba78da05524713dee058eec64bc92e70acd28e3232c4086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016217, "uuid": "d9bc953e-8863-4bbb-9fdd-3b57aa526fee", "comment": "Malware payload (Mirai)", "value": "919dbb987ae29b0806b5a7ad2fdf557c236934d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016217, "uuid": "52504562-1f35-4809-8707-ea69c18793da", "comment": "Malware payload (Mirai)", "value": "17ab1124c3fc7bf0925b57b7cbcb4e9019906cca71e87e72617baf7255757221170ae3bbfd595139c74203ff11baabf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016217, "uuid": "751ad149-4b66-4ccd-982f-2d85a76e86a6", "value": "T1E2332A2179762E17C4D0B8BE21F34764B2F6271E36A8CA597CB20E5EFF10A4020576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016217, "uuid": "e8e7e8bf-4ab4-4682-9f73-87451585163a", "value": "768://oYWnq9pUroPCBuXy5VcjzlH1IgXsS69WO+MKwwzKP://5WnSpUroPCBuXy/o1IQv6905zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016217, "uuid": "2a4803c4-88e7-4553-bab8-d4fa8aa2d579", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016217, "uuid": "47d2f875-6ffc-45ea-b2b0-a4cb51cf8b7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016217, "uuid": "75ab5b44-f403-4e97-afe7-e1c26d2b4362", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d730bc-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016468, "uuid": "619d3e8f-31bc-488d-83a7-842ee6ffca06", "comment": "Malware payload (Mirai)", "value": "40f8ff34a24923e13e824fd8de54c8b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016468, "uuid": "20db4aec-9137-42d3-8676-7843161a6b17", "comment": "Malware payload (Mirai)", "value": "352bb34bc4a87f69fc0fe4b5c34cc715d5e7ea51d3d554efb0e0cf625567ce99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016468, "uuid": "6114be4f-b514-46c4-863c-cd056e990143", "comment": "Malware payload (Mirai)", "value": "308b6cd646e6a4fc1f2510efdfe775323bba8a79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016468, "uuid": "fd6bbaa9-71cd-4d70-a1be-0921592cfa2f", "comment": "Malware payload (Mirai)", "value": "b0ee62500e63c2c089648bff86a9399e8ad846dd8b738065fbc2e6c67c48113c8669ba31cb88d0149b60268dcfbc4d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016468, "uuid": "2e107443-e66a-487e-ba50-bc5cf0d848cf", "value": "T19E04392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016468, "uuid": "035c4597-992d-4b4f-bfc4-7060440ce99f", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wPUXS:7eJpJUVD1A8n0YNgEJi5aMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016468, "uuid": "a132d713-9223-4aee-abf6-29c11efa5f8a", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016468, "uuid": "e6b2791c-c60b-4911-9dcb-e25c9e4b6ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016468, "uuid": "fd8f89e1-7181-478b-bf4f-8323e3389a67", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5660a2e2-e4e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034698, "uuid": "ba46ad5b-49b0-4363-b19f-4d8d029e5d66", "comment": "Malware payload (Mirai)", "value": "9e0f54a4f63452cf60ed34a061e58c15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034698, "uuid": "a254e6a7-5771-4744-9a6a-fa18e6373943", "comment": "Malware payload (Mirai)", "value": "35318dcd225ef9fb341a86dc73b7146a0a26caa431896dfda59e6270e0ea26a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034698, "uuid": "4fc00a59-57f5-4bd0-b780-6bfeffe564a4", "comment": "Malware payload (Mirai)", "value": "5ff240cd1e43af676f45d88c1a4acb5ee51a26ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034698, "uuid": "e84b920a-b936-4258-b3d0-a365fa584192", "comment": "Malware payload (Mirai)", "value": "026eea8598e9d15cbb82a36ddaaffbb405da6cbec7fab9c3a097c5b9bd0d26b0339a42b7cc3d9aa01ba745a52606097f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034698, "uuid": "2ae394b4-0b48-4529-b4a5-bf11bec28d1f", "value": "T1E953020160EB97584F8F46F9E29BAD0B065ADC5C81F98675FA80367F7D18B113E348C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034698, "uuid": "fb61479d-78fa-4c36-b838-8193376f17a2", "value": "1536:yrrDzHR2QPYPkiiyS9ugZaEqLOShFXBO/RzJPIxtnouy8GyO:ysQNzZZaBXhMJQDout6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034698, "uuid": "ef0687d9-67c7-4ba1-8ce8-292ccaa254cf", "value": 64716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034698, "uuid": "6415bbd1-62bd-4630-99c5-641e124d90d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034698, "uuid": "5779825c-6b56-43a4-b7fe-b0fd17323a7c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c0a29f-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030194, "uuid": "d89d386a-1b0d-4063-b5e7-720afb1abeb9", "comment": "Malware payload (Mirai)", "value": "6b7b20da3773257993cddcd4b6978032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030194, "uuid": "f3394051-cf72-47b0-b48a-4ff9095bbdaf", "comment": "Malware payload (Mirai)", "value": "35867569ffefe630013cef13754f240a1405c90012ddbebc8d48586d389e4df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030194, "uuid": "094ae5a7-c798-46aa-b3c5-48acd1984a41", "comment": "Malware payload (Mirai)", "value": "ef563018470ba442665232ae289febb16e19774a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030194, "uuid": "99519e3c-c720-4e98-93b1-c44fb6444309", "comment": "Malware payload (Mirai)", "value": "580d2f0ca9b0824751a20bd5e14c40d2aa5065d1e2b78aa3a50f6bc0910b1237c7dccac2ecf38f133ff213100a28e870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030194, "uuid": "f42cdd25-6a53-4339-b0cb-fc80d4a6d9d5", "value": "T199D36DAC2E8E3DE2D3C7E37DCE044E21712B74B4C66152F2791203EED29ADA695F0951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030194, "uuid": "682d068c-913d-472a-b6c6-3ee8be29c82c", "value": "1536:LCFQRLS4LqL0fhoCU8ePCpgDjZzk4EW1rSV7UEFfRO6uAihplce46VU:VSYaCteLHZzk4E2ri3O6bcpWe4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030194, "uuid": "55b1ba65-c463-4587-b683-35c7240b816f", "value": 137056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030194, "uuid": "15ea2e80-d91d-413e-a760-7016f78cc786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030194, "uuid": "aa42ff9f-8207-4560-884a-8b6d882a5441", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232c3f0f-e47b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766987797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987797, "uuid": "456c7098-a185-4df9-8eb3-39715d1afc85", "comment": "Malware payload (Mirai)", "value": "ddd6bd8b039b8a54b929dd1b30b4d040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987797, "uuid": "b46e0996-47b6-4003-b23d-285b52f4f1c8", "comment": "Malware payload (Mirai)", "value": "35b50d316e097c7642f305d6c4dcbda35b88a07b0e41de3cb32da3033caf5e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987797, "uuid": "efeb0ccb-63e9-450d-bd92-e6a4857d12b2", "comment": "Malware payload (Mirai)", "value": "841024e88e8482998a0dfc73919cac65a3d2105e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987797, "uuid": "2c9c226b-94f3-4085-af2d-358bccffca82", "comment": "Malware payload (Mirai)", "value": "ca59805bc62f7c3c56e71dae100b69b995eaa0cc2c2d0143981d40aa60cfcab9df9919eb9b3329b25a4a7c8688c072cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987797, "uuid": "6cbfe471-f78d-4477-b986-b774c776cfb4", "value": "T162C37D02A328480BD5F71FF027F713D1A367A65156F1E2C2760597494676F329A0AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987797, "uuid": "3c851736-4597-4d27-866e-fff993126c1e", "value": "1536:EkgHib5KLB5PMXDzevYPxQmikjE1sCohH59q4d5epLthLtYxFveCOuH/bE2:tgCFGtMXuvYpck4Ke4d5eJKvvdOuH/bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766987797, "uuid": "752aaf93-4dbb-47c9-8fbd-d70628b70688", "value": 124456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766987797, "uuid": "2cf6853d-45fe-4974-b57f-b9af96e42a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987797, "uuid": "98cd8552-26f0-4bed-892d-a0406f65119b", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1373b812-e4c0-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1767017405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017405, "uuid": "2753c0c4-40df-45ab-9777-52fe4811a835", "comment": "Malware payload (NanoCore)", "value": "6d4bb3e74fdbbfb07cdb42e1dcf472e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017405, "uuid": "3cedba82-5c45-40a6-8638-ba5d0aed0442", "comment": "Malware payload (NanoCore)", "value": "3754676df0025fafd46779673f09048b727b01e636295d2fdf8695f5a884ef33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017405, "uuid": "56ac4b67-68be-44b3-abb6-ad848f21669b", "comment": "Malware payload (NanoCore)", "value": "0230b0c10953dfcb36ead0e36761eea97d6998b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017405, "uuid": "65d0b2f8-6510-44e4-a388-4d78f353c466", "comment": "Malware payload (NanoCore)", "value": "b0799704e9c818b28c43db98a1eea2f56699a7388fabffd3389ac510a60e237427f8f5447fdc8766f0f49eb463b7927d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017405, "uuid": "3693a4e2-e1fa-42a1-ac38-8e8d8fb5d46f", "value": "T12444AF2927478E2DC29E8676E0D351114BB2839766B3D3DE2DCC51F11E423E67A0F98B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017405, "uuid": "f634227f-d28a-44de-a1aa-b5a995e90381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017405, "uuid": "35f07ff5-3d6d-41fd-b2bf-272937563197", "value": "6144:rHZVR3LDxy9bNMjas/CANYtgEu2CILiyeHpx:r5V1DxUG5RNEgEuSL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017405, "uuid": "427da29b-073d-4593-825a-5fbba913963e", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017405, "uuid": "628a0756-024f-4e0d-bceb-c3301d6d1673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017405, "uuid": "b0bf393c-a135-4d5b-859e-9617ffa34e3b", "value": "6D4BB3E74FDBBFB07CDB42E1DCF472E1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a61e774-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995137, "uuid": "54d66228-4e88-4e88-8db5-1b9ba1f37f15", "comment": "Malware payload (XWorm)", "value": "bb60a00fefbae2e628df2e61d1a67cb6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995137, "uuid": "cd96be04-ab71-4b1e-981f-a617d77ebd13", "comment": "Malware payload (XWorm)", "value": "37e41e2c28ae8727e81f042cd21c99ace4afb9f6da14d64141137980cd837a42", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995137, "uuid": "e945c36b-a8cc-48d7-acd3-33187f34d0c7", "comment": "Malware payload (XWorm)", "value": "b5720a4067fc5ae21af290983b3bb3258ed193ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995137, "uuid": "9abe0a98-dace-4ae6-bc00-6a499c1e0e72", "comment": "Malware payload (XWorm)", "value": "71c10d2fd883eb0b2691b933b81b8f4fa3387898643d4c8345a87ee89c99cc444bf351f4e715e8eb0156ae21ec3815f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995137, "uuid": "6f588fdf-6f18-4ced-b4ff-d9b1eb16d56c", "value": "T1A56329E3BF21B54D64F9C184BC26F269364A2921402BFE99F4F583130FBA8157D27B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995137, "uuid": "0bacb2d9-37c3-4dae-90ba-04865ce63bcb", "value": "1536:I9l/AoSSM2LsnxjL8LJye8diesd+MeZoPOagFptqqcQO5foaxE6xV2+ZRhPxyPxg:I9l/5M2LsnxjL8LJye8Eesd+MeZoPOaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995137, "uuid": "278e7e78-4a42-4e1b-b846-30631419f405", "value": 72471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995137, "uuid": "98bf5bbb-e6c4-40f8-8d2c-420bc683756f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995137, "uuid": "a2788eab-136f-4c3d-aabe-2fb793074927", "value": "invoice-1645080830.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3f0d94-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031008, "uuid": "5cf1da3b-21cd-4608-9379-adc41d5c4436", "comment": "Malware payload (Mirai)", "value": "79e6fee9e8d9ee76bb57ad94e0374c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031008, "uuid": "fab7531a-6e55-4bda-a0b1-6009df82d378", "comment": "Malware payload (Mirai)", "value": "37f68f048a47830a8832d5b018f57f27bac421a3f05875fe2fb7b16e6f7e54dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031008, "uuid": "7e3d136d-1a80-4b43-867f-9ebea443a073", "comment": "Malware payload (Mirai)", "value": "17c2af098e5a303bbf7c7cbb56cc3cafc4dcaf0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031008, "uuid": "971db839-5b9c-45d5-8731-79019e40c0aa", "comment": "Malware payload (Mirai)", "value": "4e4423447c6f7eda0d4e821d25bf396ddcc6e1e3e287f590ec6b7f5e6c990260ffe4105ac7676c9e614dd34fbdf1b3c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031008, "uuid": "9ff4a7fa-a505-4673-a792-505ee45e70d7", "value": "T11EE37B63D83A6E58E228D4F4F430DB7C5B53A55581871FAE98B3C2B98043D9CF9493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031008, "uuid": "3682e515-0488-479a-8894-be670ff57510", "value": "3072:/I2hATcg3yS8p4hLpKlBtTCU4kDL9WKNSbK0n:/I2hAwg3ySVyBtTCdoIKwpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031008, "uuid": "fad58e5a-8377-4466-8152-942d9767338c", "value": 152992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031008, "uuid": "3dfa17b0-e87a-4991-9b50-05ef80766587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031008, "uuid": "01688d90-60c1-4ba8-b679-478b6c355aff", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1049a675-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995496, "uuid": "84fdd7fe-772b-483f-ba03-0bcedb34bba9", "comment": "Malware payload (XWorm)", "value": "4e2fb9c1afae160075b5b7d819bb3a86", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995496, "uuid": "fcb0fa7e-8075-4c62-925f-0567c73a03f7", "comment": "Malware payload (XWorm)", "value": "38cd46a0ec1ee971cd9fa7dc2fd4bf809a3ab4a0d4672919c7510bab3fffaa93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995496, "uuid": "610b067d-1108-4403-b972-5f787e5955e2", "comment": "Malware payload (XWorm)", "value": "47d3efe07cc30e2f1640c17e87a31cc78ff14186", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995496, "uuid": "631e483d-3a1e-448b-bb08-8a4b8818b4dc", "comment": "Malware payload (XWorm)", "value": "45d5d9e997f655dcdce36ad16886b6bdc520c030c5b562a834e5a19282e57520b91405dade6b9ef15e16582ad19bd89d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995496, "uuid": "af20fe00-d664-483f-97c4-3a86cf129975", "value": "T156633B12F5B79935221EB861F5DE10D5480EB89FF96DBC3204DDB819FD0C682A47EE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995496, "uuid": "cc001154-18fb-4637-8b22-267c9dde572e", "value": "768:I8w/h62/jWs6oS+xISN0vNlpw8lkdkfScBYrwz2y8kTAlGB:I9l/AoSSMt7yusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995496, "uuid": "28e26da8-7501-4fec-9c23-294b6c2e5d73", "value": 71567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995496, "uuid": "259f3d57-a3fb-4fa4-a998-6a5d88e040fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995496, "uuid": "8f07baa0-6e54-4b0f-9fdc-3ccddc892575", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116fe355-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (FatalRAT)", "timestamp": 1766968439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968439, "uuid": "21b311f3-43c9-4967-ac0e-f90d89ae95a6", "comment": "Malware payload (FatalRAT)", "value": "cfa72468b4ca558f134becc93cb358fb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "thevacuousswanky-clinicaveterinariahope-dns-cloud-net", "colour": "#A7A6B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968439, "uuid": "ae1de79f-3355-4f55-ae4f-2f80bc68f814", "comment": "Malware payload (FatalRAT)", "value": "390dd7156785ef7c2fc83135038f7bd492d32f72311c0a80280380ca7f79f11a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "thevacuousswanky-clinicaveterinariahope-dns-cloud-net", "colour": "#A7A6B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968439, "uuid": "58564459-1d07-43c0-9a4a-50c87e3b1dc2", "comment": "Malware payload (FatalRAT)", "value": "30a04322409f01796f31a71be651746ba9144379", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "thevacuousswanky-clinicaveterinariahope-dns-cloud-net", "colour": "#A7A6B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968439, "uuid": "3243cf91-1864-45f4-9410-25ed2480c01f", "comment": "Malware payload (FatalRAT)", "value": "dc57bcb091cc6d890aac56e7391cda2277c529837197cb9be49eb0ac6f7a93d99226fd9ef1ba0ce7f8e1ac8adc984c01", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "thevacuousswanky-clinicaveterinariahope-dns-cloud-net", "colour": "#A7A6B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968439, "uuid": "93460c8a-9f5c-4c0a-8820-aed85d4ec8a6", "value": "T13935125FA8022F04C325D9AB5F8ED8243C6702BFAD929F277526B593DFC0989B03545B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968439, "uuid": "3302bea0-f104-4825-8700-9cc4494f2e3d", "value": "24576:p9p4fgs+5VZJ2845LokyLhvcCIkvlMPzW7yag3IvWX/j62lK:p9pKcr54hkLtIkqzvaDvAjblK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968439, "uuid": "406e53b8-f5b0-42e4-94a4-e2ec797b82f1", "value": 1147126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968439, "uuid": "19bec459-e897-4fbc-9753-711df14b31c5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968439, "uuid": "6cd179f1-04ea-462c-969a-a0c94a8c91ed", "value": "70bd6036d7af3da68cad94bfcb04d0efca575ca024d4172760e901d7de571c33.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c2074e-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969173, "uuid": "5fb0e6f1-a7c6-4d87-a885-7bb9c3b8eb7b", "comment": "Malware payload (Mirai)", "value": "31a087b08723b49f7a7e437b3dd01aab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969173, "uuid": "e40b5336-daa4-4169-a847-bec88ff9b41d", "comment": "Malware payload (Mirai)", "value": "394025d63805f3a8c174f9e508a9a5ec627d96758cd960f06422521944a3d8c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969173, "uuid": "0dd76c20-242e-44dd-b49c-81240c40ecb1", "comment": "Malware payload (Mirai)", "value": "e215ad39937c6a55993ffacad3e5d65e0df27075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969173, "uuid": "341d1889-a452-4c13-9ea9-b9c1f36239e6", "comment": "Malware payload (Mirai)", "value": "1e34d691d2e433b04d339575723524dbbdbc3c965dae844dc80fbceaad809b823a109ff48da248e4f731aac9627597e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969173, "uuid": "415da190-3d4d-469f-b5f6-2a50861cbe7b", "value": "T1E9336C86E782D4B2FC5249B1653FA7239A32FEE95611C683D75D6931CC6A430831B3BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969173, "uuid": "8ddaf200-95c2-4b9d-8277-6bc01bab24b8", "value": "1536:IU6YTrRHqCWSC9pvULxyk9dyNI8gL1HIhExZg:IcJHAS7lyk3ye8ghtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969173, "uuid": "0cca544f-8d7b-4766-8cca-d84ccce25568", "value": 54212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969173, "uuid": "febe78f7-7dcd-499b-95c8-92391475e4c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969173, "uuid": "38e3da7e-5893-4577-836c-22120124e30a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75317538-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966889, "uuid": "0c015a9c-4bc9-4ad6-9c9b-67f81dbaf033", "comment": "Malware payload (Mirai)", "value": "ab78cade1d70138a5eb9bbd0830ee70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966889, "uuid": "6f09aeb2-345a-4f3d-b62c-61e57dc2f3b6", "comment": "Malware payload (Mirai)", "value": "394b3f3d3add6abda02d955691b52014ead677cbbecb15b62365f1091d5c5667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966889, "uuid": "043c6eb4-e58b-4b3c-bba0-cea9c190e92d", "comment": "Malware payload (Mirai)", "value": "56aeffb7e6b1c521b0d850d1041883b4f1e65362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966889, "uuid": "3d77a96b-b2f3-438d-b052-d21c8321dc88", "comment": "Malware payload (Mirai)", "value": "4645390786a7a10634024a8694c97809f797510e4e3ecf68a800ec29afdd26023acf2fbb19a8506c4e5b444494cde310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966889, "uuid": "800d02fd-78d5-4a26-a2eb-572d8a904166", "value": "T16083189AFD819B11D5C156BAFE0E224E7313077CD3EE72129D24AF306B8696B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966889, "uuid": "65e3570d-e877-4b90-92cb-ba7bd4dffd1c", "value": "1536:mAnGKOJ6JtJYUaF30fKImFDMZi9VIyvh9+QM7bKY5oYTATZWXgz:cK3PJYUaRmGVIyvh9+QMCYelw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966889, "uuid": "5d5579a8-29e1-44fc-b98b-9a9d4acb4348", "value": 88564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966889, "uuid": "66371b3a-045c-45df-8d15-0a94aefc9935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966889, "uuid": "5890b399-8c8b-4f64-8636-de73f4000897", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f14e47-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767027939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027939, "uuid": "a326f412-da39-44bd-955e-25f21c2a8618", "comment": "Malware payload", "value": "6636ecff1082873a3aac869d62399cc0", "object_relation": "md5", "Tag": [ { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027939, "uuid": "b269d3a4-0d7a-4a89-866e-0c13e627bc5e", "comment": "Malware payload", "value": "3a15e0ed7f7a7419108511f28c80f1d7670860d8198335d57f4a1d350ff0715f", "object_relation": "sha256", "Tag": [ { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027939, "uuid": "bbd31395-62e4-4e14-bebb-1fdca6fe1ae9", "comment": "Malware payload", "value": "5b6fb7ae385fae516f9b31e6f7b0422d256a41a6", "object_relation": "sha1", "Tag": [ { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027939, "uuid": "d30033e8-5519-4f36-8789-4130c6d5ef93", "comment": "Malware payload", "value": "76ac742dd38ee3480c0d9b58efe3236d3d64508296bd8eefd0dbf61fe43d7e3c9b3b707267124b9724db65246b4e08de", "object_relation": "sha3-384", "Tag": [ { "name": "nav-eszja-com", "colour": "#456D09", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027939, "uuid": "45f07589-277d-48f6-94e1-8dbed36035a7", "value": "T10012451F7E02E3B5853289E88F69A50EF4D92167411A4C38F85C94C66F35399EDF02DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027939, "uuid": "20d68a30-b350-4039-aaae-4afa75ed7836", "value": "192:qzovn/pq/JTq/vMY/6/0/c/zVL3/Uw/2/RjWyq/e6/0:qQ40eVL8jPrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027939, "uuid": "381deb8a-5c05-4311-a4e7-ff6c843409bd", "value": 9162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027939, "uuid": "df475aec-271e-4919-832b-15cf11aebcc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027939, "uuid": "820b014b-18e2-4861-ba78-69978de94af5", "value": "eszja_1.3.0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad2df42-e4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034168, "uuid": "56ac1d5a-ffa5-472e-8ad3-29092179b6ed", "comment": "Malware payload (Mirai)", "value": "467706be1ba9e05ff0001fe280f598bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034168, "uuid": "2a1bfaa4-99a7-4865-90dd-e514cf366f38", "comment": "Malware payload (Mirai)", "value": "3a83566822d0208164b4dce5565e9689d2910ef6318c31a7ceddcd71cce92df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034168, "uuid": "80db633d-8185-4a6a-b9c4-c7c3ebc296fe", "comment": "Malware payload (Mirai)", "value": "d5bd44e9a1a61c3ac33b7b005caac38a7135b6a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034168, "uuid": "43a1ce35-c691-45aa-9740-3b84a36438f2", "comment": "Malware payload (Mirai)", "value": "a5d8653a30a76242a05b1d3c14aed305157c4289f2470fc0660d8dc48c596e73a42b15062a9deb1feb372573854519f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034168, "uuid": "57cb59a5-4e65-4dcf-93cd-0cef28b35467", "value": "T1DD836A13523C2A1AD1F494B302769352B0E6369E1590C79EBD720E9FFF163940E6B9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034168, "uuid": "f70bf6cb-0ea3-4f7e-a4cd-beda2a5d22fc", "value": "1536:ZgqvfyAL02BElmJJ+eWuv1jfc/xg1ZI9Tq8IWIymQY2AUYci5hh1+nN:ZXaV2BEL9TXqhh1+nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034168, "uuid": "5e201f79-1d46-43da-b2ed-abc5f0ca53c9", "value": 84252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034168, "uuid": "d350674a-321a-483d-bd5a-898af29829b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034168, "uuid": "c092efbc-a977-4311-9e70-8a2896b27459", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307181c2-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017025, "uuid": "c0a47160-4e84-43cd-a74a-7e1bae84cad6", "comment": "Malware payload (Mirai)", "value": "511f1061bc329db047462663bfe206ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017025, "uuid": "2bbc8238-8936-4279-9f1c-50dae58eef44", "comment": "Malware payload (Mirai)", "value": "3adef31fc8e60585e93dd95b56510f6811675917092b859111fffa1f3c01cd01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017025, "uuid": "3f013ffc-bbe9-47c4-a7ab-b08fd723da14", "comment": "Malware payload (Mirai)", "value": "7304fea1cd2e0cc663ae598736398ebfb8374037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017025, "uuid": "fc03fdfa-0ff0-46c7-aae8-d7e275c50f1c", "comment": "Malware payload (Mirai)", "value": "156dd42687d12a2e00477320da9911241d38548de12c808de4d3c17e75df916f6b27615d65f1bb9d0d775b05181413ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017025, "uuid": "61b185d7-149a-41a8-b67e-d5887191b466", "value": "T126835B2279752D2BD4C4A87B21F34731F1F2574A31A8CA1A7DB24E4DFF246502247AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017025, "uuid": "01f45d8d-7738-4a1b-9fd1-a84207ddd650", "value": "1536:au0NSfw+pgV88sN7S7S1ZqEiFm38+FXG4wBEo+ASst527IQnTt6eWchwW:Zd5u8c7NwhXGPK0Ss/0oeW7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017025, "uuid": "61c7f9bc-76c4-4c69-a105-4ab833a76548", "value": 85672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017025, "uuid": "a41a6e9c-b6e4-4674-9e6d-26cfd4b307cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017025, "uuid": "833d1f7b-082d-4eef-80b8-6d6c85c6985d", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a797a4a-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968240, "uuid": "c74698ea-a478-47a6-859b-4409d5bef0a4", "comment": "Malware payload (Mirai)", "value": "a9c23cb9ce8439f5fba52af53f5cfc0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968240, "uuid": "ed36ed26-033f-464a-bbe2-753883536005", "comment": "Malware payload (Mirai)", "value": "3b5a6c10c6053164b2a26671849efc3f8840f0c3a2b5892c51b0dcda47879130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968240, "uuid": "237c3c88-34c9-4996-8393-bcac59e96e0c", "comment": "Malware payload (Mirai)", "value": "93681a059b997e23936d07324c6ba22990d6e34d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968240, "uuid": "dde87474-3866-437b-ad17-2305779862e9", "comment": "Malware payload (Mirai)", "value": "f04ba3f85894d2549dec979e292461b425d219ab23caaaa03dca717d179eabcf70fd6c2aa346ddb39c9a836f36b17070", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968240, "uuid": "18764d62-ff24-4a12-b299-3156cf3d2e29", "value": "T1B3E36DC5E783C4F9EC5205B02177BF329A73D53F142BDA82D3B95A32EC51641C62A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968240, "uuid": "e6da38b2-6047-4254-8d4a-806a2e59ba4c", "value": "3072:zoQLASEbz6eIIFeDKAPRA36lRG/lmFhHhLqDJhIB1af:vLALP6eqDKmE4FZhLszf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968240, "uuid": "8b04ec45-b0a1-49b6-b9f8-af8056ce56c0", "value": 155176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968240, "uuid": "7a8cebed-b008-433a-a073-59d6b6e940cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968240, "uuid": "92646929-c9a2-468f-bcd9-d4f70c0e0b02", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8fc94c-e451-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969770, "uuid": "6fdd58dd-d81b-48a8-8f89-856f8b1ab74d", "comment": "Malware payload (Mirai)", "value": "9e95c40d3302f7cbd826e863d7f1a7e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969770, "uuid": "5b8ffd9e-e5db-4242-b2bf-680bd40c6647", "comment": "Malware payload (Mirai)", "value": "3bf2c5ba2a9eab958c927c36932c42c7825a437b78fc44c56aef46a48c8acbb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969770, "uuid": "39eeb882-438a-49b1-97b7-89e6af82157a", "comment": "Malware payload (Mirai)", "value": "bfb70706acbeca52fa9ce3887278e6c595e4f469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969770, "uuid": "409bbd4e-55f7-4a27-b0e9-3e029db558e1", "comment": "Malware payload (Mirai)", "value": "bc23d33358c9292fa255b120cd57793d88fd6a094ea1459883fc61f7aab7c25bc44682e790289c4da77cdc294fd5fd69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969770, "uuid": "69e5e7bc-c391-4fb0-9226-62db841ef5a7", "value": "T185D32851BD829626C5E623BBFA6E028D332663E4D3DE32178D215F217BC691F0D77A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969770, "uuid": "35de946c-8628-4b17-8ceb-233631dd9832", "value": "1536:NG1lYM6u4RowkVyGeI5AhodB8kK6IZxnwuktDkWjDd+/QLdeg6umRD5ZB6bxfQgC:NG1lYm4RHuPdanIXjDdpYfum/z69mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969770, "uuid": "1176afaf-c769-498d-a369-e4d3defbeaaf", "value": 132552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969770, "uuid": "38ef26e1-3aef-40ad-954c-6e5f9705b6d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969770, "uuid": "7e1c01da-0c40-4146-89e8-ac3b5e679228", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a12792-e4f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767042137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042137, "uuid": "c6753b3b-8afa-4b68-ab41-9d20ca8c7ecd", "comment": "Malware payload (Mirai)", "value": "3d49cd241853f71e875f5090c2804740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042137, "uuid": "14fffc6d-b912-4e81-9c5e-9b5c59c9c188", "comment": "Malware payload (Mirai)", "value": "3c09e11c249cabb7b06be927662570ef231536c79fbea2fc748469c303531b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042137, "uuid": "6869a62b-3128-4174-811a-335f1d33007f", "comment": "Malware payload (Mirai)", "value": "14988b6ce612cca7b1b9db7dcbb3d201a69ced41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042137, "uuid": "6bb0e558-f287-4d44-9080-f908204fa860", "comment": "Malware payload (Mirai)", "value": "795701f3b43a593d3a7141d58772d5a047690af5d391dd3ff10786cfc47375c087b24a8401d778fc41be64f0755dc7c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042137, "uuid": "f9fe1383-6649-499a-acb9-ab135279a361", "value": "T1B3D3E80AFB601EFBE86FDD3701A90B4625CC650723A93B757634C928F64A54B4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042137, "uuid": "79e40721-a6f3-40a7-a20d-30e4bbfe2f57", "value": "1536:JdoSPz0gkGlTR6MKahesj4NsiUijRrmvLJlpNRICAFAZwlrfyZOwlCryYWnzbYj:4SAgkGlT8MKHs8OiU9bpNCKFJTYWnzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767042137, "uuid": "5691e2ef-d047-48b6-8044-c819f3b873f6", "value": 138584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767042137, "uuid": "fdaf1518-cca4-43bf-b4d1-ca62ea21e5ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042137, "uuid": "45243574-7b6d-4244-856e-2422547f2171", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516d5faf-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972412, "uuid": "04def0ea-44f2-4d57-88f2-de9749137ced", "comment": "Malware payload (Mirai)", "value": "857ce58c516cd5d34854c769cb625451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972412, "uuid": "15631a98-d53b-4e91-bec9-6ac39197e1c8", "comment": "Malware payload (Mirai)", "value": "3ca9387203cfd7845c2a9455b938320c819967c3bd3a23ad4c537f7c40b8e0d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972412, "uuid": "1fe181c2-a8f3-4327-8c09-2e3de2bbc02a", "comment": "Malware payload (Mirai)", "value": "545cdfb96e794b8aa434c9e41677cf27c1109ed4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972412, "uuid": "0a894ff0-098b-44f5-94a6-61bc1a56f362", "comment": "Malware payload (Mirai)", "value": "6e832506a01921c5a82370d0db52dfcfaec90338ffcacb39380a2f509a2a71d7af55a6bf582ae93e4d4dafdfa3663d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972412, "uuid": "4437a0c4-9b0f-45b2-95ed-15733d927d62", "value": "T17BB34853F404CD6FF84AD7760683C735B53233A29BB306A2B652B937B9392E04D16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972412, "uuid": "fe59af1b-affd-4728-8a12-34e09bf555eb", "value": "3072:cy8kLz4h+AlAdxJUdpLgGaDHUiihxNqA4:cyjHxAlK4xqHUpNX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972412, "uuid": "68e68cea-7516-40ee-bb3e-d391a21cd2a0", "value": 114268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972412, "uuid": "17e7e146-a536-4a2b-88cd-2516b722440a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972412, "uuid": "5dbc100e-c6e5-4a29-9d48-d60ac0bbf7b3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0126910a-e4a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767003631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003631, "uuid": "49fff2d6-b5ac-4e47-a944-dd46d1e7ddad", "comment": "Malware payload", "value": "2eb933d559c31066afbc930757b884a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003631, "uuid": "599ee6a9-344f-4f69-b48f-33560f20bab4", "comment": "Malware payload", "value": "3cd2ca1a45a96733269d60397d84b451e4b4f0b7f7cdc3c152bf9e88db773199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003631, "uuid": "75498efd-4268-4ffc-bc9e-5d5f4b9d2920", "comment": "Malware payload", "value": "cb7ac5e5e329336f1c4ac70918d4c11040745c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767003631, "uuid": "2c3e9149-5b23-4997-a787-04ba00b8f042", "comment": "Malware payload", "value": "a08ddcf71a3997a4913d131fb8615280eed4ad532a1223ab85eab00edf6314200611ddecf78b9340feae8dc5f79d0085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003631, "uuid": "6d5c1798-ff2a-48bf-bd5f-5c611fa882b9", "value": "T192B533017BF884F1E2AC2C7851A126A296B9ADA2073641D3D7513DC295B32F0E73F7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003631, "uuid": "3ca02dc1-7986-4968-a159-bff0ade2e4b1", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003631, "uuid": "a5da5514-ee96-4717-a155-f903f07ae7b7", "value": "49152:xgwRWCatzqbMLZRRmz4RC8QvCI9BsNapVi4BMY82IrE3rz2oSeYL:xgwR2qbMrRG4RCfvCI9BsuVi4WDrazOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767003631, "uuid": "905d7462-c45d-4dd0-b882-9591dd9f3549", "value": 2347965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767003631, "uuid": "dbd1985b-ad88-4c8e-bf8b-abc68c905dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767003631, "uuid": "2fa58870-3914-414e-a256-b881edcda116", "value": "SecuriteInfo.com.PowerShell.Dropper.54.16770.29263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfaa72d7-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017292, "uuid": "6b49e265-a962-4e45-913a-3abe786bf822", "comment": "Malware payload (Mirai)", "value": "78e27f4c445d3a74c24c288083a8d3b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017292, "uuid": "ceb231a1-ba12-4e44-8e8a-b0956c252025", "comment": "Malware payload (Mirai)", "value": "3ce2c41119aff96f26c83c012ff463824d2735d59254bcbaa29266739b45b13e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017292, "uuid": "faa93363-c6c8-44ca-a126-cc88db2c9cc7", "comment": "Malware payload (Mirai)", "value": "84cf0dbfd361667fc63afb86685af0e9d3600b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017292, "uuid": "78f101b2-ef19-4a4a-a4aa-08ebaa9277bb", "comment": "Malware payload (Mirai)", "value": "6c2482aea6ca7695f4240a8f620f62d61fcd2b0cdf167c32eb74dbbfcf39342c8e5838c0a261e9d49e5d272471a7fba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017292, "uuid": "77da3823-8ab0-4b81-87c6-1c4d1c0482c6", "value": "T11CB3D81E7F228F6EF768C63547B78A31A758339227E1C641E16CE9105E6034D681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017292, "uuid": "afb4f3e8-08ac-4082-82aa-9ef65a5c9758", "value": "1536:iInlG8K2ITYUbUUl2xMDDTYlBf8WwsPlm2vG2SvG221Ln43uL0ZqeAjzY/auQ7Rb:xlG8KhTA7Bf80n43uL0Zh/auQT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017292, "uuid": "b6a36d19-6856-430d-8958-ad0fc53ed5f3", "value": 112344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017292, "uuid": "9a65341d-eba0-4752-a586-353e97e6e432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017292, "uuid": "33695bc1-98da-403c-976c-c1839b30c334", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb022f4-e47a-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766987334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987334, "uuid": "afaba2d6-1b26-4e3f-9726-2c498171aa8c", "comment": "Malware payload (AISURU)", "value": "ae70d69dab4c44747656f48785ee3a45", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987334, "uuid": "b95bfa85-ed60-440b-8775-d79348f13905", "comment": "Malware payload (AISURU)", "value": "3d0cf1d0f39440d54f1025583017c733647ac09f43397268a0d138f981b5127d", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987334, "uuid": "309b6de4-bea0-42a5-926a-e63303eec65b", "comment": "Malware payload (AISURU)", "value": "fb9bb613addb85183d6f93a9462c38cc0594624e", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766987334, "uuid": "1d7f028c-a389-4b0c-8d6f-fb1227198912", "comment": "Malware payload (AISURU)", "value": "19dac1d1b32b6876d7a0f73c03e43ff9482ddaea2337ee550bfdd51932e102f569cfc8ba6e632fe3856c2c3a59a69c30", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987334, "uuid": "f15b6c0b-eedc-468c-9d02-2f428da015cd", "value": "T1E8D3AFDB720B4951C47302F05BD78BDE3BA363128F0BC9EA2D1D667E24795DB290A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987334, "uuid": "4f544f58-cd72-499a-ac88-f563bb56c8b8", "value": "3072:tWpDgQSM5/e2dy3SsPIaQrg+vnewXzuGIcg19nEq:+IM5Xddsw3vY1nSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766987334, "uuid": "4092b290-13b1-4667-9006-a7355a791a00", "value": 140700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766987334, "uuid": "e5ca97a2-3f04-42d7-bee5-374d0d25810e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766987334, "uuid": "7b12e1cb-6684-44f9-8168-30ee02cab927", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185d27d6-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982195, "uuid": "cc7a5ca3-7f2f-46ba-8bea-79853914bcfd", "comment": "Malware payload (SalatStealer)", "value": "1f5ab3f2c9d5c7d9bad628f6e27d6cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982195, "uuid": "62f4846a-8747-417e-b631-4eccdba0aa1d", "comment": "Malware payload (SalatStealer)", "value": "3d49873a062ad9025cac1051a2512f2660393d41330b64cea9b2dcffce2d6e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982195, "uuid": "5adc6ab3-b7c7-46d0-8cc0-8d941d426313", "comment": "Malware payload (SalatStealer)", "value": "7f249f1ecf07860c27dd3482a59759686f7cca22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982195, "uuid": "e8a26f1a-107c-4fa7-8377-75bc81d49b27", "comment": "Malware payload (SalatStealer)", "value": "dcaac449b5f1f8dbd4e13509b69570bcc0ff3ffdb2273ef8e2fc7a6eb0c12fd5a382c55b8a507d276a2ac60d80b2e4f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982195, "uuid": "9fef7199-bf72-48da-b570-2d721014bf52", "value": "T15BC65A41FA8B54F6EA031832415BB23F63305D049B28DBD7EB547B6EFC7B691193A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982195, "uuid": "c0094006-e9ba-406d-8703-ceddf22bad6c", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982195, "uuid": "95a9b679-51d8-4194-a78e-d20dbf20e312", "value": "49152:yBBzPirrY/lraUaDrBaNX4fkGrsV8C519dcy2pEiUN0iD1i3YyFFu1Icx0b83017:2tPUrnU2xpq1+GjR1yRHI5vJ1+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982195, "uuid": "f6304ee1-bc81-4c43-bf99-60a496e761c7", "value": 11655680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982195, "uuid": "9612a769-8388-4068-acdb-8613a2b42003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982195, "uuid": "999ececa-4e0c-4420-b944-cfd59d19a237", "value": "3d49873a062ad9025cac1051a2512f2660393d41330b64cea9b2dcffce2d6e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207fb2a3-e4fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767044056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044056, "uuid": "2cd5db1a-35e1-4084-85c7-f16b3fb65188", "comment": "Malware payload (Mirai)", "value": "9cbe6240500cd90d21b7986aa85e5ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044056, "uuid": "22e0f243-7079-4bf9-b589-4781c7a32327", "comment": "Malware payload (Mirai)", "value": "3dbd9b88305869802a842a440ec8a349135ece6d2ce3dee38f5ae9dc73c89516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044056, "uuid": "661e559a-4a44-4298-bd0c-a60ae43b6fa9", "comment": "Malware payload (Mirai)", "value": "e27ef846e8d90c7910775ec5f132f2e19f6a2d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044056, "uuid": "6d53e109-e7fe-4bed-8380-fdabedd44cb5", "comment": "Malware payload (Mirai)", "value": "d9fc64fb1811e0327dff273b5307bb79a7fabd593c4362ee30de0244602d106ad9c674a8aa975133b9238ed9e965ef62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044056, "uuid": "290c9290-e752-4023-910e-8349edcd1f22", "value": "T17EB33813F400C9BFF88AD7760283CB36B53173A58BB346627642A63B79393E45D16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044056, "uuid": "add58380-6ea5-46b9-9dbb-16e0c0105794", "value": "3072:UQ1ZWo7tKG6eOjlbFV1vnYqDYALMdK0E5yrmNPQ:UQGocvFsALMAzyrmBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767044056, "uuid": "d3369d67-37d2-4540-912e-b2fbb885a739", "value": 111036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767044056, "uuid": "77dc5f2d-a366-4d99-b0ad-ea83ca223e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044056, "uuid": "01978287-2c23-4af2-9186-a47319af2f8b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19bd3be-e492-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1766997887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997887, "uuid": "12690d46-a9d4-46ca-ab43-a472ad91e40a", "comment": "Malware payload (VIPKeylogger)", "value": "d67b49cffaeee170b4472222e272e6b2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997887, "uuid": "a747d1f7-d5ac-4c15-98a6-e97ad300b07e", "comment": "Malware payload (VIPKeylogger)", "value": "3de5e9a71d2c8d974984ad250a23f2e1880813a052f6292b952c4aea571e0c55", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997887, "uuid": "b2f2fc04-4f53-415b-9a40-a298fe5c99a5", "comment": "Malware payload (VIPKeylogger)", "value": "c2f0ab26361490361e0cb28b80480f6982cbd4ba", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997887, "uuid": "e2bb7c1a-4c6c-4518-ac86-ca12bd2cacf1", "comment": "Malware payload (VIPKeylogger)", "value": "f603a89cc718346f0cbae07fc32993b21f6d25871b3368d3286188d41496da946c3910baad493e8de9afc158e0f78eea", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997887, "uuid": "1b5f8b6a-161e-4b7f-960d-40b9c1329ad8", "value": "T109F422CA965A7B52109AAC7D340FF18B044E6A4214F25F6C31F1D0DE9E10DB0BE6E9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997887, "uuid": "25cff6fa-4199-4119-9cf4-b36466600056", "value": "768:HkYtA2D2oMAJ/QA9gjczfbYkhet2rPLNtG3GlAWTE5wkB1gmObGQX:IQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997887, "uuid": "01ff493f-8828-41b1-bed2-6f7ac0ed21bf", "value": 779562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997887, "uuid": "b668656a-a0b9-42b4-9e8e-83c490b06033", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997887, "uuid": "c5fdfac2-54e7-4841-bffb-87b8ae6f4df2", "value": "Shipping details_93937dhl_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f64f838-e4da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028646, "uuid": "a58b799d-ca9e-4fc9-84c0-ffa51dcac11e", "comment": "Malware payload (Mirai)", "value": "20701c982a1b4c81e39c8564d1fadd34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028646, "uuid": "b05c9a18-a4d5-40c5-96d1-7adc4beef1be", "comment": "Malware payload (Mirai)", "value": "3e19459a20546f7807bdbeb290bb5a49a5bd150ac56beca568cddc77e8f362ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028646, "uuid": "47b580e8-87ff-4935-bda8-c6b8756ce0fc", "comment": "Malware payload (Mirai)", "value": "0042ca8ef577389c81e08735a746cd2fe957bce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028646, "uuid": "55eeb659-7a03-4d2d-9689-6d7c2c9f4651", "comment": "Malware payload (Mirai)", "value": "846c7ed1b9e36dc7e959fd57e5075ce3b22460cbea73d7e39e7a707e4aee2a50cbd87365decafac9d44c9cfa23220af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028646, "uuid": "f0afa920-9447-4c87-92bf-86ee409bfb00", "value": "T19EF38EC6E783C4F6EC1245712177AB329EB2D03E552BD982D3BD4A32EC51940D61BBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028646, "uuid": "4690350f-c4b0-4a15-aa2e-4a6486107ad8", "value": "3072:Q3iZ5n5UDWcZOCqMqIKfyTDXMECXUAYMqHFTjhhGB1qj:5v5KlZmIXFR5HVjZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028646, "uuid": "96e9fca0-7455-431b-b677-37a8e880e4d1", "value": 159080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028646, "uuid": "f3826d55-b7db-4a5b-ad38-45ff79d568ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028646, "uuid": "2c88f1a2-6da8-438a-aaf4-ec8ff3e9f77c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4832c4f1-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986570, "uuid": "2ce55005-19e8-493f-a7e4-0959ef0489f6", "comment": "Malware payload (Mirai)", "value": "8f8127791ecacfffcf9e0d332f44cedf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986570, "uuid": "c047809b-0eeb-4329-93fc-5e3087e46eae", "comment": "Malware payload (Mirai)", "value": "3ecf8e241c810e22889c6335f6de9ded2414057d5bef1cccea50dbee3677d1d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986570, "uuid": "51941685-6782-4fbd-8f00-fe92c5050f76", "comment": "Malware payload (Mirai)", "value": "e9a94cfd3be26338895dccee368985339ce3713d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986570, "uuid": "134231bb-adf3-4ff3-a8e2-f3cbd9eb7cd1", "comment": "Malware payload (Mirai)", "value": "7de3e50875541dfff1881bd80f440d6d8aa258abf36d139de7483bddfd354e91e8790529f43159042701b374ee020e79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986570, "uuid": "3094995e-66c2-4062-a8a3-fc6bbc0ccedd", "value": "T16C538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986570, "uuid": "e2e56332-53e2-4023-ac26-53ed405f13d9", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986570, "uuid": "21a28862-6ac7-4d84-94e5-84e8def04090", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986570, "uuid": "8883b2c2-4cc2-4f4d-9248-695df669dceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986570, "uuid": "4a3a28b4-1ef0-4015-a260-89ac46d7a3b4", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d467ff92-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986805, "uuid": "c83e7c9c-1a4e-403c-8229-c809bbb92be1", "comment": "Malware payload (Mirai)", "value": "24c8919599aad6f2ece7dc02c51a16a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986805, "uuid": "70dbacbb-9432-4eb2-89e8-7604c5753f34", "comment": "Malware payload (Mirai)", "value": "3efb06c61232bb8780c9b6978c76399d97f44bf341ef07f90c39aa263400fd21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986805, "uuid": "2f8c90f8-8fc2-4807-a4cf-20d7f27e6854", "comment": "Malware payload (Mirai)", "value": "6144d9aa81418b76723a44fe284049b5a3edc4a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986805, "uuid": "1c127034-11f3-4118-afd6-7989042bab2d", "comment": "Malware payload (Mirai)", "value": "9851086acb6fb38a7cf882088cd107a6878783398f216063bc75a4996fb62b048200d7e1b49c1b6a0ca97dc7978a89d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986805, "uuid": "d8035b8d-5781-474f-82b7-dc9f8d8dcba5", "value": "T16EC34B46EA418B03C0D62776BADF42493323D765D3DB33069918AFB43F86B9E4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986805, "uuid": "3f701871-6fea-46d7-8edb-303b32275ac4", "value": "3072:dHarYUEsVj7Za1VgUTiUTYOxNRlO/bcf8o8M/9f0gw6:darBEsVXcVX+UTYOxN3O4f8/M/9fm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986805, "uuid": "0f95d473-9270-4625-8079-5716a2665672", "value": 129326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986805, "uuid": "03f257d6-10b4-442e-b1c3-6099d3f6e37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986805, "uuid": "5eb0b58b-05a1-4c45-a1fa-a98f810e4be5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470df253-e487-11f0-a129-42010a9c0007", "comment": "Malware payload (FatalRAT)", "timestamp": 1766993011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993011, "uuid": "980ac379-473a-4f9c-a60a-34ed94441283", "comment": "Malware payload (FatalRAT)", "value": "700779c9e2096e60e008a50b172583ba", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993011, "uuid": "09ed5aeb-75f6-493b-bb6d-4db493ea8c56", "comment": "Malware payload (FatalRAT)", "value": "3f30eb517d144720c9ff76b22b67f24888963f550e4b2ee86a9db57a1979b245", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993011, "uuid": "fe2ccd52-d8b2-4566-b77f-3e32bcb5c454", "comment": "Malware payload (FatalRAT)", "value": "6cfc982327420c254f8d10c5dce459ac729cf611", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993011, "uuid": "94002151-910b-4dfb-95f1-11a10aa47ca6", "comment": "Malware payload (FatalRAT)", "value": "3b7ac50b3b109228d09323a20f51a428f5392faca38924fb6221838ac42dffd31c86d4ba4892786e0608877efb6d2688", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993011, "uuid": "f1de554a-b084-4b39-ae51-ea0f8184dc82", "value": "T1D2066D22B78C753AC06A4A3A477F975C993B776135168C1F83F0085C8F276912A3E67B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993011, "uuid": "d48afad6-6166-4913-a564-b4c375cab905", "value": "dcc8bc96722b15e6357f993e6b3ccf0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993011, "uuid": "f3caed66-6f8a-4721-adf2-db8eff2e8bb5", "value": "49152:JhIsJgagM27Ygiu+QOfdKujwISuU34GPgyHRi4Pdh9qw4ATITW02vwwGoi398+NG:JhI8dAxyoi4PdhB4XP7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993011, "uuid": "ac21b74b-0f72-43bd-9492-7d56dc22bf98", "value": 3685888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993011, "uuid": "51577ff2-8341-47c8-9dd5-cf82cd80cc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993011, "uuid": "5cbb62cf-6f4a-4e15-a6e9-68b7cabc18c7", "value": "70bd6036d7af3da68cad94bfcb04d0efca575ca024d4172760e901d7de571c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b909be6-e4b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767010708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010708, "uuid": "5823c460-d024-4e05-b357-73c2e5c61c35", "comment": "Malware payload (Mirai)", "value": "0d0d52de9fdb8250db20160dd1818a34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010708, "uuid": "1ea72264-9175-4e96-820b-dae86e7c3e42", "comment": "Malware payload (Mirai)", "value": "3f3ef0b4e5f9fbe8d7662879ef7cbca1532fc996e0b1769ded7170e701c26825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010708, "uuid": "f79a5544-afed-49aa-b68b-6e2884b51157", "comment": "Malware payload (Mirai)", "value": "e72c42f30848258c25b6e670b9f5b0dcba25f44b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010708, "uuid": "f58620a5-0cf4-4b12-9ce2-f7339187a146", "comment": "Malware payload (Mirai)", "value": "5669e2e332ae562b34caaf9ee6f43808ef715cae9406c93057dd496a03700d3ed00756ed98f39a4d4d0b058022b74d9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010708, "uuid": "19f02cc8-11fb-413a-8d36-d1258fef17c8", "value": "T1FB145A05FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010708, "uuid": "17af9056-101b-4abe-8cae-5c98695c1d59", "value": "3072:ESZAGIiEgACYrerYqlNSwppHaecY4NXOUaN:HZ15BTYCrYq1QDY674", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010708, "uuid": "a29ee8a5-d011-4b9a-9407-af7efe626048", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010708, "uuid": "c448af47-0230-48af-88ed-337597395a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010708, "uuid": "1c0a5160-3528-4fa8-913d-548cee8e59e6", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111e4078-e4b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013536, "uuid": "dba42d2d-913e-47f0-b92e-861a19f2f374", "comment": "Malware payload (Mirai)", "value": "bdfca2558d5bd004c86cb394178519c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013536, "uuid": "84da32ae-a689-47e7-b14e-5d869c2933b4", "comment": "Malware payload (Mirai)", "value": "3f4df2ca3488813384a89742c123e26cd1b3e32b74bf1f0fa06a9f5555c0f28c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013536, "uuid": "9aff01e1-3919-42da-b82d-95c77c91f75c", "comment": "Malware payload (Mirai)", "value": "3cce57bafe22c2fc04a1e8f048f45a55ae0fd81c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013536, "uuid": "18768ef8-1947-476f-8751-dd80d144a0d4", "comment": "Malware payload (Mirai)", "value": "de47a7cfc40c362b66c165a23e6d0fb079dd582c60a085a999f51a890c55cda1768699477535cf6864cbe8587b9f61ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013536, "uuid": "002df754-9c18-4a47-be56-8a6d3dd9fcbe", "value": "T16DC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013536, "uuid": "6c993a73-62a4-41ee-ac31-2d1c49f85956", "value": "3072:3atpsoRNjmj1VGCr75MoS9SrPwVrx5tiy4w:VoRNjmj1VGFVrRiyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013536, "uuid": "864e8ab6-ee11-4647-90f5-bd12e46983da", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013536, "uuid": "a4533700-71ef-4d4a-96bd-a8948f017a09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013536, "uuid": "351ac678-b890-4bf6-b73b-509710179d25", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53a414f-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995424, "uuid": "a29ca229-7a5d-4492-8444-972e5d459793", "comment": "Malware payload (XWorm)", "value": "132afbe76bceee9d3f8678cbc009e312", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995424, "uuid": "9c7a87df-65f0-4601-8f98-71636698edef", "comment": "Malware payload (XWorm)", "value": "3f652eab23e767a7027b53c500f5927bf0e1b44d21b8ca15d09f2625d808497f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995424, "uuid": "c5287ab0-d84d-459c-ac40-229e60790659", "comment": "Malware payload (XWorm)", "value": "96958dd91042acf0253010ea5480db03b7142551", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995424, "uuid": "6d4a7ca4-b92d-4086-8cfa-0ead7f89f3c7", "comment": "Malware payload (XWorm)", "value": "85c3dfcfc4c478d80ff58411d9863906b567fb1894ffc19d35280b2815ca117f0fde3f45b7914190c1337cc770e535f6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995424, "uuid": "0f125f00-ceb6-47cb-835d-79e627f5b2df", "value": "T1D4633C56BC330798782E69C78DDD2D9AB767ED40DD9CCE170A2834B15F3EA1A0278248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995424, "uuid": "8f67c272-bd83-466f-8de2-60ed4278e026", "value": "1536:I9l/AoSSMFqn/qnWqnDqn5qnaqnZqnyqnHqniqn4qnzqnOqnyqnaqn5qnpqnLqn+:I9l/5MQCpGEtkFK1z2hFtE0uR+dYfNYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995424, "uuid": "3de58ed0-37c7-4249-874e-bd26c40510ba", "value": 72444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995424, "uuid": "57bcb88b-1ff3-4f6c-9683-a508eb8bf0f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995424, "uuid": "bc0017d7-1c93-4653-9b71-e05a9ff31b45", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a0a525-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767025977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025977, "uuid": "8ad6637b-a0f0-43ca-aef8-78ee2bd713d7", "comment": "Malware payload (Mirai)", "value": "cbf89ace729b70bcab09312a0a7969f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025977, "uuid": "4a12ef50-8405-4ce4-8748-334add182634", "comment": "Malware payload (Mirai)", "value": "3f75b334f20000cb48f958482b149d6c8b06b7f428090fcc839f2b2c8ce2f628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025977, "uuid": "6e06b365-05d1-4cf5-8bc9-7fd21e1c125a", "comment": "Malware payload (Mirai)", "value": "054829e4ee15e440d98c9c1944e0f8dde0286351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025977, "uuid": "58b403b8-20d7-4880-8ed9-4ccc8eee46a2", "comment": "Malware payload (Mirai)", "value": "d7a1cd8496b62d79fc486d752760baa0773df5a2e90ac0d782a81ef82cb658834683241c94f6857c87048d0f2018fede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025977, "uuid": "cb908a9a-dfca-428d-9b3d-c31c37992cb4", "value": "T1B9230845B8819A23C5D423BBF66E418D332567B8E1EF7213DD216F15778A82F0DBB602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025977, "uuid": "ef13bc2a-f1e5-41de-ba17-96887518cd65", "value": "768:IIkuJPFdDOqeioMoWlLc0oS5RkotjGN19zK5jKNlBBgEls1ouW:wuJNdAWltoIR1tjs7zUClOKuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767025977, "uuid": "ce9c6ffc-8fbb-477a-9adc-76332db619c7", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767025977, "uuid": "278c9334-9fb1-4844-92cc-21bf74f423e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025977, "uuid": "cdc8f91b-fbe3-4bc5-952d-557576b3f1d3", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85220ba2-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995262, "uuid": "1699f75e-885d-4749-8e4c-c0e6c00c78eb", "comment": "Malware payload (XWorm)", "value": "b5e91ea15bfdbf226992572425d6aeb4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995262, "uuid": "c43d2258-2fb2-41f8-8bec-c6e48b4e3d83", "comment": "Malware payload (XWorm)", "value": "3fa34657b44d4ed0b699ab420de3247b74ccafb1eeed33b7ed677c52aaf201f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995262, "uuid": "de3dffa6-5a1b-4e19-abe3-8f6e4470ae3f", "comment": "Malware payload (XWorm)", "value": "30b6be54801febda25c604b4db73236fad4f63ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995262, "uuid": "08b37e95-734c-41f1-9038-ed10efc1fdbc", "comment": "Malware payload (XWorm)", "value": "73e6a24441a235bcaac37978c97a32bce3ad8027b782a5781931731aa92033baaa84fc05c09fa555d6205c5d37f7ae59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995262, "uuid": "e82a1dea-4f0a-45f9-8b79-181a793a4700", "value": "T148633A723F4AE1AA7CB37948EC8E549A1616642F109BC0918CB576271726F5B1CF33EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995262, "uuid": "c7b3ed36-6dcc-432f-bfe5-cdbe2317b9a5", "value": "768:I8w/h62/jWs6oS+xISN0vrfPKeDGImM/5bgEtZ4GTEDpKwpVEnoPCa5f9+NHnRTW:I9l/AoSSMEousrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995262, "uuid": "6b81fc35-b20e-4411-9b55-1badf6e97554", "value": 69628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995262, "uuid": "8384e60c-f4a4-4464-8d9f-a3b4261eb287", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995262, "uuid": "ce290cfc-f001-4596-82ad-5b81681e43eb", "value": "invoice-1645080830.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e977df-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051310, "uuid": "7b644489-8f00-40c6-b3f2-0f69da680bb6", "comment": "Malware payload (Mirai)", "value": "1cd3af49721bab21cc195f45562c6f72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051310, "uuid": "bed706aa-64c4-4f01-bf63-c53d21e9570b", "comment": "Malware payload (Mirai)", "value": "404c156454a1bb029348dbfd6897eed77f24a2b704c1516fde8c1c9c7b3e98aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051310, "uuid": "4c45373d-f345-47cc-81fd-5a524f228b3a", "comment": "Malware payload (Mirai)", "value": "6891ec0f8891540da142dfb54e24213f1543ed21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051310, "uuid": "31eb107e-2ae2-46bd-9ce8-36dc04d005dc", "comment": "Malware payload (Mirai)", "value": "bd3b1cd9f23fac46a83ad9164e3ee5e2ccbb2dbc23873bb0f9a59097b8ab0798ec812422da6c932a223e1f6018d5ab65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051310, "uuid": "af47d6db-62a5-49fe-9210-b53059b61148", "value": "T126732A46E753E4B2D50315B011EBEB798E30FEB31520C91AD7B0BFE19E215C2B59632A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051310, "uuid": "ed6f3340-1782-4846-9950-17996233a906", "value": "1536:i58gzqzlZkE2x6ACEhjWUz318Vaoma46xJy/Qttu7r:i3WZk0XE/yVdvGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051310, "uuid": "127afb54-e983-4ff0-98d8-ace894710499", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051310, "uuid": "005c5824-0de5-4ae8-bc0d-03ae4a66a199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051310, "uuid": "41ca788a-5fc3-4c76-880b-846280676b43", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f4af7b-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995482, "uuid": "2f9827cc-a103-4dbe-abdb-68f8305b99ad", "comment": "Malware payload (XWorm)", "value": "84d9bf13397455e42d27daa8c8644231", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995482, "uuid": "e4f19b82-b40f-4856-bdf3-5bca4ec3fb8c", "comment": "Malware payload (XWorm)", "value": "40b69b4d6ebaea338f82b6045ac01edf96c5ddbf4c656a28a836cf5b1ac7eeee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995482, "uuid": "4ea650a3-8cc8-4528-9a90-5b6ff5407122", "comment": "Malware payload (XWorm)", "value": "6ff75e3e6ba3b34197a2506de3505d6eb5ce0615", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995482, "uuid": "2f83dc38-e619-4956-a819-2d1be48e9dfd", "comment": "Malware payload (XWorm)", "value": "92a3ac6621b4c6dd2d73b0258a4ac7597dfc504de81611b9fc8ea025bdeaff6a8b8f6db8e6d85211139b2944b591ab6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995482, "uuid": "b2fb7b21-7cab-4b1a-9fe6-5802cba39c1a", "value": "T1D7731A426F17D2F78818528EC25ABAC70D6BC66C4D27309F3D03EE9D348259ACD2596F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995482, "uuid": "12b4168c-5cb7-481e-833d-e5b5a610798a", "value": "768:I8w/h62/jWs6oS+xISN0vCQOQoQlQrQ4Q8QfQOQEQdQUQoqQGQGQGQWQZQ9QKQ7t:I9l/AoSSMqwusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995482, "uuid": "ae525214-9fa4-41ee-9989-fc62bfa66c79", "value": 73427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995482, "uuid": "c9d0c7b3-f672-45d9-9b3e-e57832a29b84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995482, "uuid": "20ec6bd2-915d-452c-b74a-9be6d5d3c994", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363cf711-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969360, "uuid": "d81b8e6b-873e-4f9d-acff-4eca372a406d", "comment": "Malware payload (Mirai)", "value": "6a78f19191fed6c08eeffdaeb8ce2ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969360, "uuid": "a262a7c5-d910-42e0-9bea-910d9db8d031", "comment": "Malware payload (Mirai)", "value": "41933b660f7de13482811b6f0390c0b48bef5493f70035b7338bc5ffd240936a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969360, "uuid": "5e396377-cf01-4f68-a8ca-dc0ff839fb94", "comment": "Malware payload (Mirai)", "value": "8cc441e61f2ca1ecfbb3bd96ed238f690ece75e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969360, "uuid": "0cd8f3e3-ed26-4e0a-9037-9582e0445d05", "comment": "Malware payload (Mirai)", "value": "71224f061226cec0d17ef0b25c9cbcfadad8895f1a446a0eccdae2cf62a3fdcd4872970b44e5c557602a5aaa9087bb3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969360, "uuid": "7f781691-9a3f-41e1-8aa3-0f2372a20e28", "value": "T190B3E70ABF610FFBD86FCD3746A94B0125CC590A22A83B397574D818F25B64F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969360, "uuid": "f174da5c-828c-4a78-8ed0-52708194db2a", "value": "1536:dPUF9w+86EeJ65Xc0HtDSc8rdX2befE1bO96w+PPXZYU9V5PHPG/aiuZ7RHs:dsF++86EeJOxxzbOMw+PPLB2/aiuZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969360, "uuid": "a4a568e3-420c-4715-aa22-9a95d8a4595e", "value": 110776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969360, "uuid": "fafee839-fed9-4346-bf7b-d632d521e74a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969360, "uuid": "b93d81eb-06ec-45e3-8cf5-dee39c73790c", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d6d20b-e452-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970170, "uuid": "874cb430-54d7-4e99-8916-4acb047ca1e8", "comment": "Malware payload (Mirai)", "value": "7a6bb4bba2d0572e5c070dd5581b4085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970170, "uuid": "efac9a05-9ac5-4cc8-9159-4a46fc2b22d0", "comment": "Malware payload (Mirai)", "value": "4198ae598b0a6d604f0238b4045306aae22f5a12e91ffb4010ebde9152f18817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970170, "uuid": "29c453da-a5ff-41f5-b9c4-cd777d606c29", "comment": "Malware payload (Mirai)", "value": "8f0c31594d6ddade606342b6553bfabe87219867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970170, "uuid": "aaee322b-c1b9-4dc3-bcff-f21b9e2a80f8", "comment": "Malware payload (Mirai)", "value": "fb166d550704faeb23f9cd1d8e04573e84f68e9b4f95820137ae90228fcd53aedcade44f2e6894b90fa45d8acd7a8def", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970170, "uuid": "cecb23a3-84b9-4fb1-85e9-bc7e56b568d2", "value": "T13BB3D60E7E229F6DF76CC73147B79A21975863D227E1D681D26CE6001E7034EA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970170, "uuid": "d233bd5d-bc2f-4140-ad6f-48ec17600723", "value": "3072:MsLeWia7yuR1Ot/jsLL4/yXCQTm5EuZT4:M8eWP7yi1OxsLEO1T8b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970170, "uuid": "ab0c15f8-be39-4b0f-989a-f016c7709c29", "value": 109432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970170, "uuid": "a356f9d3-6726-418f-91e0-4a470de08a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970170, "uuid": "9b4d13a5-6110-4d57-8461-df76a8ee01ec", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c765bc-e4b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014480, "uuid": "dd507d35-95da-4a7e-a2ab-b221887c7c52", "comment": "Malware payload (Mirai)", "value": "11e4cd75f35da2e8463e78f9b5509bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014480, "uuid": "aeacfb11-f4d0-469b-8af7-65b3164dbcd2", "comment": "Malware payload (Mirai)", "value": "41ab0821c2ed56bb5773253ef964ee730e4e5c6d9fe2b1c2be6ada295c0e0fe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014480, "uuid": "af4e8797-3f12-4a97-9492-0e7d9c824449", "comment": "Malware payload (Mirai)", "value": "47e14b812c0b66fa2a9bf1481096bf37b28500f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014480, "uuid": "d11d94d1-6d44-4494-8b9d-f61cf30f341f", "comment": "Malware payload (Mirai)", "value": "a06f616d84c37c6aa7de6957f5e16aa27b8a0bf86ed488cec99c973bc5284bf758299803f4ea93f02bd8159f75b635b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014480, "uuid": "1571691a-4908-4d80-9a8a-247df841da3c", "value": "T1E7536C41B3084A43E55B0DF0793F2BE1D79FDA9011A0B386794EAB8D81B7E32544BE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014480, "uuid": "c0bbad87-7b84-449f-9caf-f67aa952a976", "value": "1536:GSZfjxyR6l703o8nEsLRelM7gH91T2bVRJ:46ygsli+AT2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014480, "uuid": "d71fdf0e-05bd-4cfb-9512-f5d0a024b157", "value": 62740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014480, "uuid": "f1dee485-4278-4135-95c1-8158aa70a16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014480, "uuid": "086d8523-0b1b-48b0-a063-58e75e6997d5", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2103e520-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982209, "uuid": "41f95573-2e8d-4cbd-8075-2656e24d1cfe", "comment": "Malware payload (SalatStealer)", "value": "c531816b6813973cb6a323714c769407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982209, "uuid": "4125696b-6bc0-4570-84f6-3691f46abb4a", "comment": "Malware payload (SalatStealer)", "value": "421a664abf5618a21232e7d01b3306284833a1bb3cf80f87b593f5d19d5d9e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982209, "uuid": "78a0abec-2a29-4ddc-a9c1-82872768d5e8", "comment": "Malware payload (SalatStealer)", "value": "655505fd73b7ec382fbbe41c869c07ab40046922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982209, "uuid": "2dd66a09-e97b-4db4-9b3f-07c31e195c2a", "comment": "Malware payload (SalatStealer)", "value": "86770fac6c8ddf3defeee9f1ed2ea243f95a4c0d631b58f93b465aee4de96006610c0b8d1b783225dca5b07d1dac4109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982209, "uuid": "c38cd4b3-e72a-46b5-958a-bcb4020a067e", "value": "T189C65A51FA8B54F6E9031831805BB23F63305E048B28DBDBFB547B6EFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982209, "uuid": "b657a997-5e41-4123-a97c-8d9109b00d43", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982209, "uuid": "01e4a59c-4c6a-4a24-b914-db3835c7e379", "value": "49152:/UuSCaJaMm1bQUWIyYYBhxDEbcj6MAgEzHKsHA40mURNkkRQ1OFVwpxdPuWL6DRJ:cvCip2WWe4Jb0FGoLFVhBoPQ+L1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982209, "uuid": "da9dace9-5976-4d6d-9676-dd8d0f4b29fa", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982209, "uuid": "55ba1abb-af6c-4ba4-8838-135b519eb6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982209, "uuid": "3704eceb-b517-45c5-a74c-d4b4dfbd0596", "value": "421a664abf5618a21232e7d01b3306284833a1bb3cf80f87b593f5d19d5d9e72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249bb523-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766967613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967613, "uuid": "011c17bb-78b3-4f1e-89d7-b5b23e3d33db", "comment": "Malware payload", "value": "abca8970b22f7f4b8ae67e9e92cb3a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967613, "uuid": "ca2b5ab9-7f12-4a89-af9e-8f4b3fbe6680", "comment": "Malware payload", "value": "42fa6ac5b6df6de6f09ad335670d772aeb101cec04f5081284d9063a3e782189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967613, "uuid": "096fce67-f70f-4346-957a-b7c1d6767669", "comment": "Malware payload", "value": "cc857f7d71bf5f05e95576e6815d678eb2f84197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967613, "uuid": "4454c694-b5ae-4a19-a5f4-ee332b3f26f1", "comment": "Malware payload", "value": "29581d39978e25422ca5662bee6874cc05f8aa1afa7996f3f1890f6b40dbd4afd707cc283504aad6e7f5b8a572d37b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967613, "uuid": "60d6f972-8208-4eb4-aa80-4f1f6505dd9b", "value": "T1E7734D037328850BDBEA07F013AB53D1537A6741A7A1A18B760E635505B5B72AE0EFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967613, "uuid": "d9439bd1-1d59-4114-9bb4-c78c1b336850", "value": "1536:CXspunRmCpl/Nl0j3+1RAFolUNjkMFK9P:fuBy3+1hlUNjFUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967613, "uuid": "cfa3d827-bea9-4847-a1b7-1dce50701f89", "value": 76428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967613, "uuid": "3142ad57-6f72-4434-8314-0a5ea291e988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967613, "uuid": "c7effc5a-eaaa-4059-80e8-28cbbac766b7", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ceabdef-e4de-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030467, "uuid": "8c522fe3-585e-479b-8493-69e9ffc2e181", "comment": "Malware payload (Mirai)", "value": "180c36317f960a72749c6f9bd68b626f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030467, "uuid": "82d6c0f3-06b5-41a2-a299-8d803d09da80", "comment": "Malware payload (Mirai)", "value": "42fdf9186d1c247ff624b64fa6a8245d1bfbef6dd4be2b8334f92e726f0ba831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030467, "uuid": "32f0c3cf-1196-4375-8e8f-c47e7cc2aaf2", "comment": "Malware payload (Mirai)", "value": "4290f2743eb9d2b36b23ad40274bc88be5fb7013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030467, "uuid": "906f5661-7d4a-45e7-a777-f78c27766601", "comment": "Malware payload (Mirai)", "value": "142cc896fddf2e8a250bdde2e2b85cf447df1182a4dcf8f972ac0e948be8323ec69cd350f1caa5295e65aa05d78096f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030467, "uuid": "78453835-5ac2-4809-a47b-57cefa870a34", "value": "T1A573027DC55473F6CE79B533BE2307C7658E0D64A2AF44AB62108B01979B33E9772610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030467, "uuid": "5abbaa3b-a2aa-4465-985a-f2f874ee74c0", "value": "1536:BBsoodU4aa05kBEWvGsdqYv6Gtc5vygdUFTig0EUOw81dJTFLi:PyaDWvGsdAGtqvygqFug0EUk1dPLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030467, "uuid": "d284a4a9-55c7-4b27-b49a-12e39eab6abd", "value": 74552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030467, "uuid": "4c5078af-58bd-4b1c-a500-406ffc075aae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030467, "uuid": "427f54fc-1a2b-45b5-a88a-49a2b5c6f929", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde49345-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051300, "uuid": "1b7a0674-caf3-4a67-98c5-ad007e6d8e9b", "comment": "Malware payload (Mirai)", "value": "46de5051bc923cb4523011368ac62772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051300, "uuid": "111d2ea5-0fcc-4ab9-9d46-f0c67a214d5e", "comment": "Malware payload (Mirai)", "value": "4308809f710022b4453e7bc25fa02dab0012c67ddcd3fcdd3512d4020db8504f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051300, "uuid": "8275ead6-6bef-4064-b589-b0918a7b01a8", "comment": "Malware payload (Mirai)", "value": "e84386bc49748075136464a4af640c316d445202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051300, "uuid": "7a83a11e-23f6-4f3c-8ebe-45e4fc0dff57", "comment": "Malware payload (Mirai)", "value": "9b7e6dfa526e296cb8518ce223edf30b08f3e98c941c489922d9a08b04ff9b4c88ca68b3dd849286bad06ff5d4c91feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051300, "uuid": "3f47f273-93a0-400f-b7c0-cd4274388514", "value": "T100D30902770D4E43D1233DF0277B1BE0939BFD5228B5A680B52EBEC992719F22545EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051300, "uuid": "735ae926-4bfe-4b89-8d04-70d457ad070a", "value": "1536:uMUMNseU9Dmrtg1xjfBtvAskxLdJpqwWCNbJEU8BId7vANzn5v50GXnVYzDmC3:jseUKg1xXYsej1buU38Nup3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051300, "uuid": "9b4d2277-eb0c-4f14-991b-e8ebabbf56af", "value": 139540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051300, "uuid": "2a010b57-9146-4805-9849-08409067222c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051300, "uuid": "72bcb025-57f9-48b9-8e50-fabd16fe2f4b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5f6bbc-e452-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970389, "uuid": "9d80f42d-bb85-41c2-8e14-efec228c1293", "comment": "Malware payload (Mirai)", "value": "e676483d612ff560856c59a70b10d9b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970389, "uuid": "a91e124f-ddf9-469d-88c8-c89c146a9a52", "comment": "Malware payload (Mirai)", "value": "4312e8178f3598573856f4b2e4f9c575da6de86c0f0a7e3844aaafab102f76e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970389, "uuid": "e39604ef-5039-4642-bad2-31a6e9210c92", "comment": "Malware payload (Mirai)", "value": "89ef315d6859ecf28addac63697bb572f4006e0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970389, "uuid": "a6510cf6-56f5-4c99-9f5b-907c964fd893", "comment": "Malware payload (Mirai)", "value": "4c25b6cbfe968ee43979967373290c46b47883310b0f0b0256380112b9c6fe2c5f83f27d29c0d60b5561fbd508cf7a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970389, "uuid": "abd97853-129e-4099-ac76-9261922a475e", "value": "T149937D33C87A6E14D15489B5F0B4DB789B03A60491874F9EA97BC37A9087EDCF8493B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970389, "uuid": "0f1ccd55-b577-439d-8bd4-9e6ffc60dfe2", "value": "1536:gB1yoAcRZdyFSWo9X5vqJnRrIK+5uxZtH+gwyCcTETmI/Qvnzi+:M4oAGcvoZNqhRrv+UH+gVfEaI4vnzi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970389, "uuid": "69d8cadf-fcb7-4cf4-8dfe-91ad8dc00835", "value": 95664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970389, "uuid": "d17dd21b-04b9-42cd-8d72-95ee0e97af27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970389, "uuid": "455afab5-89d5-4303-9b05-e2881b6e1ede", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fee384-e511-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767052488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052488, "uuid": "28dcaa11-8cc3-45f9-bcc5-7ffe36e7a963", "comment": "Malware payload", "value": "e5abb807549c22d162b2dc284f6d45cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052488, "uuid": "1499960a-67cf-452f-aabb-675bde1533b0", "comment": "Malware payload", "value": "43d178652432d3e7e9c5e673df3255440529309aaaeb5e0e0533080fd2c288a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052488, "uuid": "c66b5e18-8eea-47c6-91bb-4748b8d58a21", "comment": "Malware payload", "value": "7525f49063fa0873e545e4b1116ea3a93140a69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052488, "uuid": "bb163fd0-4428-41db-9eff-cd5f1cdff4be", "comment": "Malware payload", "value": "98cc2eee4880a2c68f49dd44632544cbb33e6c3b2938bd96df5649c5884d50091721c7a7f154603e6eb5538008e9a5e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052488, "uuid": "b35b9e64-228a-4343-8bb1-8a23b621465a", "value": "T1F9E53307A7DE8218DD9C8A71ED9C452B2FEFA7A86521615F45FB32509ACCE0ED20CC53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052488, "uuid": "4f7f36bb-de50-4c17-bc78-cc4d519985be", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052488, "uuid": "b1cf2531-152f-4db2-a9d8-07ae89b08460", "value": "98304:JzEtiVc0R0Y5WKRY1SkOX8UC7xPGza6aC/reb:JzEtiW0R0YZRYOX27xD5Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052488, "uuid": "fe217930-ccd9-417d-a704-a62a9c87a54f", "value": 3291648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052488, "uuid": "eeda4005-2958-4d7f-a540-8976e02df483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052488, "uuid": "ee4ce643-7559-49ab-b997-812aea2bfb40", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573e5e8c-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026968, "uuid": "19c0c05f-6de5-47ae-9640-50f453abd8a0", "comment": "Malware payload (Mirai)", "value": "d2671e1c0668a0a5cff9e63166e921dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026968, "uuid": "15d0613e-2860-4b9c-9ecf-ffbe61f28551", "comment": "Malware payload (Mirai)", "value": "43ff0fffb32014ffde5e5c9d0a1fb869773d038e0cb030ea7808482315549967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026968, "uuid": "b8b23a49-7bf6-4724-8e07-3f7cf2cd3d7a", "comment": "Malware payload (Mirai)", "value": "9d37d4365cb254328c99073ec3a9b505c1d687c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026968, "uuid": "b4d47a70-a878-42d2-b16b-40c1815f2044", "comment": "Malware payload (Mirai)", "value": "984895125cb8f7ad2fce285477eb11a1fb2eb334c55c2e575a91210ab2b51001cf96d2255080fec63619ba96f5be33cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026968, "uuid": "4a3cb2d0-3061-4670-8f65-c63429ea7a21", "value": "T1BE93074AFC819B15C5E922BEFA1E018D335357A8E3EE7202DD115F15778A82B0F7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026968, "uuid": "910794e9-980d-4c8d-8899-50ef7f9bbbe8", "value": "1536:l9n+3XcFr8ecVnSpLqSxHsQrHOHweniATGYJSnLAVTclyqW3DNlg0ikxiB7q0tuB:sMF8xSpOSJPqHweniATBUAVTclyqlaxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026968, "uuid": "b65d3232-69fa-4c52-8d0d-c483cdc77829", "value": 88836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026968, "uuid": "e8278e89-ddbd-4442-bcfd-41ce8bf83d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026968, "uuid": "36ce7af0-7d94-4b51-a0dd-0ff30442051a", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de49e4a-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996029, "uuid": "ededf55f-85c5-4055-9ba8-c023aa13f3de", "comment": "Malware payload", "value": "29fef75841738f92c52aa8c9f2f3ff0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996029, "uuid": "97499bd4-31b6-4ffb-803d-28f7be2923ef", "comment": "Malware payload", "value": "44804e707421bd77a84889916a28dab2b428220a69fad521925d04a7c4772662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996029, "uuid": "ca1f8c5f-3b12-4b41-a095-de89149c7426", "comment": "Malware payload", "value": "0a4cd91bce9060dbb3a9818f23f29410e1a845d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996029, "uuid": "ceb83a74-8af4-4f2e-b138-10056cc74695", "comment": "Malware payload", "value": "49953612b624094c7c93b8398c399c8a74dedb86b6a6e876be6836bf1d15362b152b02a825502c319ea4ce7c31e6d8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996029, "uuid": "20c4138e-ee25-4692-8e10-3395251fc8ad", "value": "T1C2E54912F65254D9C06EC174835BA232FA71B88D07357AEF1BE45A223E66BD06F3D708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996029, "uuid": "cbe2649f-e115-4d9e-9871-4362d245518a", "value": "9480746e00fc962bac66605ca5e652e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996029, "uuid": "454c8843-ba18-403b-8bb1-9fff400c4c1a", "value": "49152:alVADd5jHz5AfPkEXAddksl94o0JpNRPbvi5oA3g01gJENG2bdMs6c:asDPjGIddf4pRtcoA3geS6G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996029, "uuid": "37f5182c-ae24-4536-ac82-ac12b3cff059", "value": 3057152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996029, "uuid": "b011e2fd-801d-47ff-a6ee-2718c1384952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996029, "uuid": "7dc3461f-4612-4002-a71b-68e7f53744c9", "value": "29fef75841738f92c52aa8c9f2f3ff0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bca867-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997709, "uuid": "0fc30e3a-05ec-4788-81c6-c17539d7696e", "comment": "Malware payload", "value": "2e84b8f80ca0a8d5565853c50d65764e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997709, "uuid": "041b855e-b1d6-4805-97f9-7ed415799ccf", "comment": "Malware payload", "value": "4488c294c5ec87a744e3d05149a71a7497ab94d8e0bb933f0cb805b752851a77", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997709, "uuid": "46cc78a1-d943-4465-a31f-6be01ead2a1c", "comment": "Malware payload", "value": "a569a56ac0d51305f63f258d6f880593d1e3bd99", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997709, "uuid": "5df39850-b439-4fd1-bbbf-f4c027b997b3", "comment": "Malware payload", "value": "65236b14cd170da3a8a9e0cd2dd5b721313a95d74c4c91de4f8bebae987367dff72ba8d47ea1c42f170ac2c58b1e1b87", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997709, "uuid": "9b9255b8-f103-417a-814c-49d01bbbf949", "value": "T10DF00513116993CC11A486F2111469F8432D76DB36281D4DB3F4CB4C5F4216959DA7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997709, "uuid": "4517587d-17fc-4499-902e-6b3bd40ae1ee", "value": "12:s80Qpc5InLgyaIS1PKC26wx0bYV45kJ00qowwnaXBXOVZ50H:xLw1PKC26mOo4YnwJkVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997709, "uuid": "ba3dd035-0bb3-4c72-9f37-803557ea24db", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997709, "uuid": "d5462900-6751-4303-a5f6-afb777c646b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997709, "uuid": "0b06611f-1f7f-4365-995a-5ce0fefacd65", "value": "8mf206.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b591460-e487-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766992991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992991, "uuid": "386ac5c2-8984-4136-880e-eefdeda90210", "comment": "Malware payload (Amatera)", "value": "8514f30194ca23c780b25be0d6a2eaa2", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992991, "uuid": "d8331943-53b5-4b40-91ea-301592df0995", "comment": "Malware payload (Amatera)", "value": "44b424b73d77827aee492d919fe5d4e9ce21c802a7f8ea32e45a620a706b0f15", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992991, "uuid": "e4cbaf9b-d488-4502-8d32-8b2261427278", "comment": "Malware payload (Amatera)", "value": "2b9b86062320509f58b0d8fcca428cf81fd12c5b", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766992991, "uuid": "1375bb1d-0d50-4d14-bfce-36236f53dd36", "comment": "Malware payload (Amatera)", "value": "d8d0dc3c376fffddfde9bcfae15e2e8ed1109333b8d2e0442a706042b78578043a558e059645995ce2aadb1797c7a383", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992991, "uuid": "465062fe-4b57-4e7e-b877-3a22d8ed6216", "value": "T150764BE2BF545365C69FE23AD4B061952230B044033526D3BFA51BBA4C6BAC4573FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992991, "uuid": "7e95835b-acaf-4570-b5bc-ead6df4ba663", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992991, "uuid": "67b1d137-2ea9-48e1-81a4-9568ea4f5906", "value": "49152:WNJ1e8J5zl2y6N18rAF9IkEXSMi8jgtnAznQHX:WNz9GIKAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766992991, "uuid": "4fd49313-cddd-453e-9117-4fcb7da76034", "value": 7139328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766992991, "uuid": "623c149f-bef0-40cf-b612-997afe94b038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766992991, "uuid": "20fe6f7b-2e05-4eb1-ace8-691e23a4a2cd", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec2dfef-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026229, "uuid": "dffef3ea-94ad-4c17-9fa2-432395709d13", "comment": "Malware payload (Mirai)", "value": "84e4ad619474366a585613b31f417e51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026229, "uuid": "a048e553-6bcd-459b-80a1-cc185ed909c4", "comment": "Malware payload (Mirai)", "value": "451d9873292758fff3d9d52112cf9681c0acf4d3ca7200b8ba62a5105fde986f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026229, "uuid": "130249d5-9235-40be-9c65-0f9b7b3cc2e8", "comment": "Malware payload (Mirai)", "value": "a24b266025098162effa1597510427fc606ddc29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026229, "uuid": "52a4330e-c756-4188-86d7-8223859f86be", "comment": "Malware payload (Mirai)", "value": "5bb74cea7319d0512e6adcf54b8675e4b9a33ddb68e4ce711369bbf81c01649188b74e18b628e7964bccccafe9cd3035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026229, "uuid": "cd07a0b2-7647-489e-8367-fd60978958e0", "value": "T18C530845BC81DA16CAD862BBFA1E42CC332653E8E1DE7207DD116F157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026229, "uuid": "66c3fe36-28e3-4dbc-b0dd-810d3a206cba", "value": "1536:8kVN0DwPwKaLGEENuLwZOmJUrmjQVitu+7R:8kVN0Tz0C1ijmitu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026229, "uuid": "3b5629bb-d8e8-41b4-b19a-c47fde7018a1", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026229, "uuid": "b0b0ff3b-945f-4368-911f-5aabf5d5f4ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026229, "uuid": "14657771-0d5b-4a3a-99a8-bd695710ec42", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f181c2a-e4af-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767010150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010150, "uuid": "0c610f2e-c99d-4b47-8533-ac64b9f1da0d", "comment": "Malware payload (Mirai)", "value": "f92be733d4b2471d630d25e4fd5e9e82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010150, "uuid": "40274b49-2b11-4fdc-ba2b-ab129cb402e6", "comment": "Malware payload (Mirai)", "value": "455d33ad9ffe7621054b1a4798356f29650a9e4701731b18d6a354d481e9de26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010150, "uuid": "15aa6253-2487-45b6-8bda-8b9c9b32581a", "comment": "Malware payload (Mirai)", "value": "c8a405ce606da7d82243214fbe596ad54bdf0968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010150, "uuid": "941030e1-5c63-45a7-b42a-b9a67fbb213b", "comment": "Malware payload (Mirai)", "value": "56802e708ca37d4ea4da971cfef58744e7064a71b1dc43123cc73d69ec0879c2e435810c8f65c4ed3f226b408c67858f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010150, "uuid": "c7054386-3b7c-4e67-8643-19580e5295ec", "value": "T1FC438C36D01E99E0C4554574B4A98E700F13F1C8C3537EFB2AE586B1A887E68BA56FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010150, "uuid": "23ea8af4-dd40-4542-bcec-d1f8b92087c0", "value": "1536:csa1A6D1vpbb2+nxFUNf08CfZEvo7FR2xh5+C82Y:XD6v32+nxyN8DZEQ7b4h5+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010150, "uuid": "81c87c0e-582d-4ab6-8f49-1d5430309a92", "value": 60300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010150, "uuid": "d35cd941-c943-4499-9ecb-b4f9cdff83dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010150, "uuid": "25f0c981-c4c0-4e5d-bc3b-7e4f73343420", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536466a7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995179, "uuid": "3fbf52a6-ccb8-4aee-b933-1a88d66fe4c7", "comment": "Malware payload (XWorm)", "value": "274ca9ec366350d03e7ba1a572dca11d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995179, "uuid": "19845faa-7bca-4d62-9c85-9fbd2b3917dd", "comment": "Malware payload (XWorm)", "value": "457709d1a7f2b03d7dfb7d9ef275273efd52f655e22c6c304b244742a2ddd627", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995179, "uuid": "c68e0854-8a27-4205-b50a-cbf3c499687a", "comment": "Malware payload (XWorm)", "value": "7fc388a7d84deea3c81cd51eca4d6d8714c49dcf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995179, "uuid": "34feb481-7f4c-40fb-9273-71a3b94843b9", "comment": "Malware payload (XWorm)", "value": "3b7ebcf639bd866554691544f4f43cd40bee25bebf9dfa8417d3958f97b18a9f0b5c9b4b5e448ad8a6ba288aa6fa7ee8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995179, "uuid": "d62b6238-af8d-4f17-be8e-7de632adfb99", "value": "T1CD732B001175FE71BEBDA90AE6AF9D7DE01B8826C3B59178FC748D24A72CC88C879C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995179, "uuid": "f3ea1f31-c00d-4237-8486-2f71cfdb20a1", "value": "1536:I9l/AoSSMRfcUZin1gcrKmSEDPYLXNpiGZpGyFBirB+rAUf4U+Bjj1YEyjfKVD7N:I9l/5M8uusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995179, "uuid": "c9fa3925-b1ce-4b85-b6f3-8e3cc7ac3900", "value": 73469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995179, "uuid": "a920aba3-3eb4-45a9-9bed-e748e73bf9e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995179, "uuid": "7b1a02bb-f52d-48c6-a2d0-b5e31f347678", "value": "invoice-1645080830.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cdab38-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995398, "uuid": "f6debd74-6c72-4630-8804-04ea526801c2", "comment": "Malware payload (XWorm)", "value": "7d8d810fcbca69f757200a60f2abc6a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995398, "uuid": "c0c19668-4427-4b60-8389-06855f3113f3", "comment": "Malware payload (XWorm)", "value": "45b918b08b2fda63348bbbbc8731b61bb6dbf27f7efb975e1d09477c2f7b8601", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995398, "uuid": "66b4cf72-03b3-442b-af6b-8c45b1ad3e84", "comment": "Malware payload (XWorm)", "value": "e73c263af3841a854012b2b5babb0004b61ee44d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995398, "uuid": "ebb89de8-a390-4cfc-909f-6c7d754bae46", "comment": "Malware payload (XWorm)", "value": "149181bdec71b595a7e0d5a25b3d5ad639fa27bee73055b5701b7b445952ac27ec3578745f174ad585213560a2c5a258", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995398, "uuid": "f5125e33-232b-4110-86a6-6ca1a6b430b4", "value": "T140632BDC0CB37C45517BE6A85D86129B6A85E1D9DE4BBAE2CB8FF702832173D16306D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995398, "uuid": "eed5b017-8696-4d16-999d-0fcc4acb76a0", "value": "1536:I9l/AoSSMLHbHgHJHkHMHhH0HBHrHjH0HPHpHbHBHXHlHaHUHSHjH9H5HIHhHiH4:I9l/5MzjaJ2uxmRT7mfpjRXdkGs7lZSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995398, "uuid": "b008c247-30c2-4547-aa91-28ffc9b2e3e3", "value": 72530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995398, "uuid": "9b5624e1-7d20-4d47-8e8a-4cd58466de2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995398, "uuid": "a3a2d0a9-8079-44d4-b41d-b78332e94420", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fc6c9a-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766988313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988313, "uuid": "2b92867e-2df6-442f-af30-0efc46bcf525", "comment": "Malware payload (Stealc)", "value": "813c2976379f65e9d247a1b61f60a676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988313, "uuid": "28e928f6-246d-43b3-bde6-e11a1c22e594", "comment": "Malware payload (Stealc)", "value": "45bb2eb22ca0fd45c6ccba8b069e155eb97cd938cd526e5d83e8c68a867c5891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988313, "uuid": "3959f4dd-6362-4ae1-b78e-f2769a745e25", "comment": "Malware payload (Stealc)", "value": "f5457eca14f62ed22fef83019dbac829e5eb9e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988313, "uuid": "906e2020-7bdb-464d-af4d-cbd86b294b23", "comment": "Malware payload (Stealc)", "value": "da9283424a3a2dbc5c2116154acd8d02fb4f321941c09979c212cf20b064c934a9532c9f0da5f21459c9b2d4713fc0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988313, "uuid": "2b96f3f0-6bef-4586-a337-b0b9f362dec1", "value": "T125F47C1EE7E512F8D2BBC278CA474552EBB278055370968B03E11AA51F376B05B3EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988313, "uuid": "c1118da8-6623-4fb1-9b03-fd240c4b75a0", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988313, "uuid": "b1ff20ab-83d0-4e3c-848b-e9cb82ea3606", "value": "12288:hU8VHX4ZPBuvzkOkW7UE+YTRqwJ4dfv3YZtF15kjHaA:hVH6BuvbkW7xXVVmdn38A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988313, "uuid": "cd98d23c-c583-4828-81e3-ebf88b74c69d", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988313, "uuid": "d9fbbce8-7ac8-4d55-a28e-87441336ccca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988313, "uuid": "31b7dbcd-de09-405d-ae0c-d1547065aef3", "value": "45bb2eb22ca0fd45c6ccba8b069e155eb97cd938cd526.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab46caf-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971810, "uuid": "9323dadb-9aac-4d15-aa9f-8f22e24a27ba", "comment": "Malware payload (Mirai)", "value": "3ccb8cf5db48161192abf8403df2d3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971810, "uuid": "a0d6c4d0-32b7-43ef-9ce2-6f45906f0eb0", "comment": "Malware payload (Mirai)", "value": "45fc1029fdac85c74bb06da108cf94c5097b5f5e7c43198c78cdadc0ed27bb7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971810, "uuid": "94e60586-4eb9-4771-9cc8-c080382aa8cd", "comment": "Malware payload (Mirai)", "value": "4ab46106b17e1947226b23140c175bedb287e03f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971810, "uuid": "05a37807-811d-4cf4-a688-0881f63e12a1", "comment": "Malware payload (Mirai)", "value": "8114cf7b36ee48f0e7759f4c2aa42415c25abc2504a7ab7a3538b311925080510265e3551acbaa0e3b4e39c30c0573db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971810, "uuid": "2bbba595-f363-491c-a9df-2b6850ca7296", "value": "T177B36A46E743F4B0C81A0475225FA3758A35A9722421DDABFBE43F32FCB5B019A1572E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971810, "uuid": "694a26f7-df04-42b3-9ece-f49e8015ded5", "value": "1536:XM2Z4+tgifw0NBwPRWvHcSokFKDwarDdE1vqFHyUYqxdIRb+DvkobVDUc31ssdX+:XnZ5rH1nGwaqvwHyUYqxdIBcVxiganb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971810, "uuid": "8e03fb9f-91d8-46f6-bc1f-0a000093f13f", "value": 111352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971810, "uuid": "815f0bc3-8963-4f90-9ca2-ac5615cd810a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971810, "uuid": "a6448948-4b0c-47b8-8846-dfead7e9191e", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb820f46-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013500, "uuid": "9d459dd0-4d26-4c9c-a317-a11b270985e4", "comment": "Malware payload (Mirai)", "value": "32fb59a29fbb4299a4fda809525ae349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013500, "uuid": "70d5fc94-8782-4790-9083-ea7fdc8248d4", "comment": "Malware payload (Mirai)", "value": "46627eccfe166cd6e0493536bb359be43a7ddeeb8935a820715440951ef56247", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013500, "uuid": "055e6f0c-c7ab-4d7a-89b3-86405c1cefd5", "comment": "Malware payload (Mirai)", "value": "78b51adc9ddb68b5d8385b7fe958ce2df8840038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013500, "uuid": "c2b0d1bb-fe30-422d-8a0c-5b6887a5ee7e", "comment": "Malware payload (Mirai)", "value": "66fe546173fc9b62f1f9e3fe758d45e61f236205af48911b159a98a49367ab48fcaf3d410e49da004957e2cddf715ed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013500, "uuid": "68cc6012-4386-487a-96b8-a44187e645ce", "value": "T1F4732981B881D623C6D462BBFA5E42DD332653E8D2EF7303DD21AB15378682B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013500, "uuid": "39c53090-9881-485c-8e04-6b390d26f12d", "value": "1536:xFRDmJmap51U1TtNcnBXRZJKMgEddWOD+CqAwiJvATAbVRs:xFRDH1cBxKMgAWOD+CZHZATA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013500, "uuid": "c7c520dc-db01-409e-9a00-f9397966110e", "value": 79040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013500, "uuid": "e5ccc6e4-1a46-455a-a53d-fcf01aeff558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013500, "uuid": "06df0a5e-fdb6-4600-9b0c-0221111216ff", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76f43ea-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013010, "uuid": "c27ff6e8-6e86-4c0b-8575-6d013a1649e6", "comment": "Malware payload (Mirai)", "value": "2e42835ea375d44541646e7e66663c66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013010, "uuid": "eaf1f86c-9e06-444e-8acd-c9e7906dc808", "comment": "Malware payload (Mirai)", "value": "4674c2dde7fa10af53a6cf4cb0d76937f87d6e0bc396d05a036af6fcf3d3ae55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013010, "uuid": "27af3a64-ec19-4196-b28d-0af5c0537b23", "comment": "Malware payload (Mirai)", "value": "f61a96995b3ad6e90a25ed88599a3c1f1fb69ad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013010, "uuid": "6182f385-eca2-4db1-8495-f3a278689ac0", "comment": "Malware payload (Mirai)", "value": "af9f0cd83098407ddece94a80c15e4357d4f151f118e4d44af4e6e8d011ea33ddd3abe5c11a383684d73b1030edb2bdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013010, "uuid": "d97a1176-eedd-44fd-ac67-dee3d2aec99b", "value": "T1A9635D31BE766C2BC1C4607A61E34235F1B6574A64BCDB2B7EB10EDCBF146102247AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013010, "uuid": "1090d304-8a35-4928-a047-4f0c620294e1", "value": "1536:lPqZe761t2uHV56S7j5JdH7zJT9w2bw1XSzm7uht:Nqqcjjtp9wcPzmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013010, "uuid": "6c7c9718-11d0-4014-8262-80d9a92610cc", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013010, "uuid": "fe3f7f92-607e-4d03-92ae-447a38784964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013010, "uuid": "fad65930-9455-4f11-8509-349b10e0d90e", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688fab3e-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995214, "uuid": "c5eaae6b-0e8d-4cad-ab1f-21b43c96dbac", "comment": "Malware payload (XWorm)", "value": "b46370c3ce2089c610f504fa184cc2cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995214, "uuid": "388f4aa0-31c7-4572-9cd3-1eb81de21e37", "comment": "Malware payload (XWorm)", "value": "467777f13f151e708a30bb7c7b8c7082b73cb2d20bb3849406104f4797664250", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995214, "uuid": "f1a1d603-e3a4-45f1-bff1-38cbbc69fe27", "comment": "Malware payload (XWorm)", "value": "9bd6d07fa84831e2b7812a327ad2426248583dc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995214, "uuid": "0d26cfe8-629c-4e14-9a54-d57ce69df61c", "comment": "Malware payload (XWorm)", "value": "6f713c269986b200ed769268c53c2a6c005b550369a7d393459696b4e420f04d4ec08f3a256cbe9aaa10006ae70127bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995214, "uuid": "27b18256-8cd9-4c53-9168-6a7088ba3602", "value": "T1C1634BF96C12B4BFAB7ABC54D5FD061014723E81C93F67CEE4065BC258CB6ED84A0A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995214, "uuid": "0bda06fa-8c68-47c3-a182-2cf2b379118f", "value": "1536:I9l/AoSSMVL9LLLbL7LCLuLTLZLwLKLiLOLNLNLALKLQL5LfLGLdLALHLRLjLVLn:I9l/5MVBHfHm6/l02GyRJsWsNrqBcjdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995214, "uuid": "298f91ca-dcae-49e2-9967-200b05287846", "value": 72528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995214, "uuid": "beb147d6-5c30-4093-a32a-3af587702eca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995214, "uuid": "418a5a9e-f542-4c2a-b28e-133eb99e1fab", "value": "invoice-1645080830.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6884444-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967428, "uuid": "3b22d4a4-7ffe-438f-80a3-67dcdb451403", "comment": "Malware payload (Mirai)", "value": "99a165c67f6505967ccd6e04c0c28b18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967428, "uuid": "0176c8b3-b76b-4d05-b4c6-81d50c7e4c44", "comment": "Malware payload (Mirai)", "value": "46c54edb67d30611287451cc13b5248983cad0f74d19af70b5245dd1de1d4dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967428, "uuid": "895c1033-2301-49d4-b291-b0f02de9080c", "comment": "Malware payload (Mirai)", "value": "9640aae24c01f9669f457f7b4b3e2dc2b6d9716c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967428, "uuid": "fece4db8-a78e-49c7-99b9-ee07ba366cc2", "comment": "Malware payload (Mirai)", "value": "bf9713a82d6d7d0e16668bb3377432c85b9f6826f58da2975ed7d6833a6ac807bfcc83906c028f5eda3dd39f5753d961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967428, "uuid": "df175067-cf3e-4250-bcdf-f5e2f11da310", "value": "T171B3080BBF601EB7E81BDD3715AD5B0A19DC600762883F767A38D918BA4658F49E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967428, "uuid": "63665b0f-ddd3-4e9f-a59f-dc21ca12e3ef", "value": "3072:H1WmR8KDGKm8tjxPGbKyt8oY8lbSZ4E9USmZmOFU8nzK:H1WmR8KDJm8xObKyt8oY8lbSZ4wUSmZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967428, "uuid": "3613d1d3-294b-42b6-a534-05b12cebfa8d", "value": 112756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967428, "uuid": "3dc2ac3d-8764-474a-a8b1-d00eba9801a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967428, "uuid": "576b5feb-f31b-4b54-8ab9-072ea407bbe1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff991124-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051302, "uuid": "469df0da-f540-4b75-b6a5-806b30df636e", "comment": "Malware payload (Mirai)", "value": "c31d5140fd9d47ae4a85b6686cedb037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051302, "uuid": "089ce2cb-7763-425e-b14d-6da52d50567c", "comment": "Malware payload (Mirai)", "value": "46e71fbce5cfa05bb8cb9b516f556a16df390b243ebedcb8ee0d14313a59e3f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051302, "uuid": "fa26b650-fef8-4ea3-9dc2-6349e7cb77e7", "comment": "Malware payload (Mirai)", "value": "9badb14f8c978b2820f9238994e85d4f379444a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051302, "uuid": "43cfd259-7488-439d-819c-df54ff6aef33", "comment": "Malware payload (Mirai)", "value": "963df717a90a8b9cc2227920e6ec2b7437271a52d0f020abc6415087a74c73789eb9ff11becaa584c8b257e312036f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051302, "uuid": "1775adf7-7b4d-4f92-8401-594ed2dbbf67", "value": "T1B5D3D746BD418F13C6C721F7FBDE429C3A167B6DD6FA3102E925BFA037864D60A26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051302, "uuid": "ae0f768d-8111-4882-bbc4-4a2f2b245e7d", "value": "3072:s/Pqj1WPVbtzw4CL5nKbBywHJdK54b6rP:s/PqGVw4C1n0IK65drP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051302, "uuid": "d45bf5be-47cb-4cc9-b63d-a05624a5db64", "value": 135296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051302, "uuid": "f625758c-1478-42c7-9310-bb40d091c7f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051302, "uuid": "abb722a4-d9fd-4f27-bcd0-734240f6638c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9baaf4bf-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766968242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968242, "uuid": "0f52eba6-afd4-4741-9048-be290be75038", "comment": "Malware payload (Amatera)", "value": "68f5265ebd1fb376ea2480b66376a27a", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968242, "uuid": "d3df97ab-0896-49c0-90e7-11e35f00e679", "comment": "Malware payload (Amatera)", "value": "47b04598800c3231e8dd3eae7d187a42b131f851584403be28f1f4364cf523fa", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968242, "uuid": "52e8445f-ca23-41fe-b030-a32197001b9e", "comment": "Malware payload (Amatera)", "value": "c7a83f2218e0ba5067db540b438b0627f1d72ef5", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968242, "uuid": "082e8dde-b0bc-4b13-9a4d-9e4106eafcdd", "comment": "Malware payload (Amatera)", "value": "63ab2af86ae84f11033ef679907827f98fac8de5cff3231beafd724cd6fb7e39e4ad38c30dad2ce0181bb8ca5dd202c0", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968242, "uuid": "2e502d8a-5107-4465-bdae-707d862463fa", "value": "T110B6120563E0E352E4F25B7545F28BA3D632BCF12A3542DF52D460BC4923787EA71B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968242, "uuid": "e6f206c8-2fdf-4187-b3cf-18e512403a8c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968242, "uuid": "c8cbf308-0fdd-4d2f-9954-ff1dcb25e368", "value": "24576:2RioVDPXU3/N3ePhQjkpD1yaV7hbhPJDtwrEEJjSV:QVDPE3/lepQjk11ym7ZDtwQ4jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968242, "uuid": "c1aeec03-0c9e-4600-a9b2-15d8b5cec4a7", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968242, "uuid": "fe64280b-20d7-42dd-8ec0-ce0440d52c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968242, "uuid": "90690b51-4f7f-45d0-aef8-90c8ba343ce8", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccb338f-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972405, "uuid": "2f56cf3c-132c-4823-8894-f05b8296a3e5", "comment": "Malware payload (Mirai)", "value": "1f37afa945b358b045aaf0cf5d1fada5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972405, "uuid": "b23e54a1-7daa-4889-8230-b4d540ad3fb6", "comment": "Malware payload (Mirai)", "value": "48151dd52f92a036a7d8937abff2585c0e8beea2cbbd46fd671059f2b70f9f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972405, "uuid": "e784c603-b2df-431b-9412-893a14635540", "comment": "Malware payload (Mirai)", "value": "887a8a1dd17d43ac5f8a4dec8d04a98d029b8822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972405, "uuid": "044ee7c9-14a4-4152-9c25-385872da2cb6", "comment": "Malware payload (Mirai)", "value": "4911eb501e87e946f4e893c826c5d70a25673e54e1d7549fc6f78312ca14e1167f13bca0b33b8e921ed333e7b106d645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972405, "uuid": "a9d0f27a-445f-4279-b7b5-9adc637ad0d4", "value": "T138939E83DA52D8B1D8220076123BD76ADA72F5313032AD0BF7A52F75ECA9740DB5139E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972405, "uuid": "2368bb48-5d08-4197-8ebf-41a3f7adf1fc", "value": "1536:589bNbYybwn9Nqw/WQ2+1VwG4kZ6Exjze5gI+8AIBWqgWqKRNmAxsp3+k8ymmhIY:cbZ8GIVV4daXeeSW2xRNmAxs9+ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972405, "uuid": "dccf9e4e-bd7c-4dd2-bfda-cd6b7200b02b", "value": 95472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972405, "uuid": "d0578515-a8f4-4496-8e7e-d55b7c284a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972405, "uuid": "dbbe56de-f87d-44da-b562-faaa6736bdce", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec723fe-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767029880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029880, "uuid": "013e8a78-ff5b-460e-9375-6bbd5ed57f65", "comment": "Malware payload", "value": "65287d0c5971d6a4086b62a46650d36a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029880, "uuid": "8e398688-5510-4a4c-919c-f608cb72c759", "comment": "Malware payload", "value": "48ba4957092b5e8aa9de38096238d578f08513109d351e308f18ff6a029e8555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029880, "uuid": "787039a9-45b4-45d3-9b9f-d90c3cf2afa1", "comment": "Malware payload", "value": "c590e5eeb2757d1ef1a248cf59dd4a50cec036a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029880, "uuid": "1050ce70-da58-4ce2-83b7-7f86adcf5a7b", "comment": "Malware payload", "value": "22b7e2957f778248458c12fecf565d39ddda93f732a30c9e66293552918f01516f4fc67a98605b4dc87e10152a24c532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029880, "uuid": "d16b231b-0acc-4cdf-9124-e6921e28cb2a", "value": "T1F375232DA3169FB4C38D873FCCD695285070974B0E93E6123C8E59CE9B197A06B526CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029880, "uuid": "5804961c-0da7-44a0-820f-d8960346a455", "value": "24576:guQPQ05k7YysM2b7mCFaBlHf5t9AO5ohpadPY9zws7YCzNNBtxioItb:rQV5IsM2b7oBl/3/kaJwzLJzfBtxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029880, "uuid": "66a74545-5651-4e02-a5c3-d5da0b44337b", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029880, "uuid": "7f6af9db-c277-4f01-9b09-fc2e031706c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029880, "uuid": "256f63da-84c0-4bba-87a9-9ebdc124e4a5", "value": "SecuriteInfo.com.HEUR.Trojan-PSW.MSIL.Agent.gen.2662.28269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfb5b08-e488-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766993371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993371, "uuid": "4d4e7eca-d7de-4c0f-b1de-1f527361d050", "comment": "Malware payload", "value": "3e20907d1eb22ac333c3be76a11cba3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993371, "uuid": "7dcd448b-3529-432e-8f27-9c20e1a3f558", "comment": "Malware payload", "value": "4933be97765e66ecc05ad51a99f81b2c0170b9ec4a67930f8b8d058cf6dfa9e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993371, "uuid": "ef17c2cf-8f36-4fe5-ae56-0382695016ba", "comment": "Malware payload", "value": "212021a1923df9641c04d95a2a7f5d552c3aa65c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993371, "uuid": "e46c7411-a971-4afe-9deb-3b261bc3ea70", "comment": "Malware payload", "value": "0d82709d9f89411662df2d0d86469e3c6cdcc9d301149fbcc8edacf75360092065180c5d6f1c4df884e310a3c9284079", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993371, "uuid": "2722c404-9d29-41cc-9aee-5447b1c65370", "value": "T183A54B07FA5394B2CCA706718656F7AF16316E748A344A97FA883E18FF729E2015D3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993371, "uuid": "80b7cb57-8273-4e36-bf71-03f634e08ed7", "value": "5ac84e9c2171260547a866c78a163e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993371, "uuid": "6038d5ca-e09e-4537-b857-2f8c8870c5bb", "value": "49152:EUbjhpEkm5Hx6wRf4YGhtMuZ6l+Oc3zldF3pZuqqr5swHgKPMgB5JydN9yWKG4ew:EUbjhpEkm5Hx6sf4YGhtMuZ6l+Oc3zlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993371, "uuid": "6957bbcd-6527-4009-af1e-0cc29bf8613a", "value": 2249520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993371, "uuid": "4b36a72b-420c-4656-a187-5ed7f3e15707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993371, "uuid": "15d78b1f-db31-468d-9b4d-f7adf4d4283b", "value": "4933be97765e66ecc05ad51a99f81b2c0170b9ec4a67930f8b8d058cf6dfa9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de360593-e491-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997559, "uuid": "01c2175c-bb8d-432d-b040-78e1dbfe56d0", "comment": "Malware payload", "value": "cc101cbe71b2253b59bc8a36a02d6296", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997559, "uuid": "3abab710-96e5-485b-a620-6fc0f4f11833", "comment": "Malware payload", "value": "494aa7780051dd4e03f40ea2b87c9bb548716ddac19c6a2ccc5d0274faaa9911", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997559, "uuid": "5b7433e1-65d7-4372-b9fe-3435ad88a9c1", "comment": "Malware payload", "value": "85e2bd7ac59d36b44db8ff15e726b9d0b9096deb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997559, "uuid": "8d180b8c-5aaa-42e5-a046-2dd1e32745c7", "comment": "Malware payload", "value": "0529d2d6933e9b2b877b92a3927e028836ad54f05769d0acbc6ebc5c9b0e101bd6ff788bbcf2e34c863a54a6cdbd9004", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997559, "uuid": "a734a342-d9ae-481d-9fb8-113701f53ca0", "value": "T1A5F00513116DA2CC119885F301246DBC832DA6CB77281D4D77F4CB4C9F8211895DF7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997559, "uuid": "718cb697-8ba4-414c-8b19-78adbe815b27", "value": "12:s80Qpc5InLgyaIS1PKC26wx0NV45kJ00qo8spnaXBXOVZ50H:xLw1PKC26mA4Yn+kVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997559, "uuid": "7ff75abd-430c-4199-9df7-fa8b08075701", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997559, "uuid": "8e05fa03-883a-4fe1-841d-25d067b16a91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997559, "uuid": "2b580c2e-626d-4c2b-b033-1fb7f6944193", "value": "01hhn3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3532f3a-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966671, "uuid": "955fb98e-f4b3-4673-873e-973c86106a71", "comment": "Malware payload (Mirai)", "value": "ed5c9a36efe3a9c5e266bbf78f347668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966671, "uuid": "9ead6697-4eff-49bb-9fcb-5f9ec85f3c62", "comment": "Malware payload (Mirai)", "value": "495bbb49dd4929fffa49e015208ec08c616d5ec32259b1518659a0de23a93668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966671, "uuid": "2ac17a5d-2890-427d-bf4d-8bdd8d11d268", "comment": "Malware payload (Mirai)", "value": "9c7537d4815127599b54008694ad62f06a1ae2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966671, "uuid": "980ec267-edfd-496b-933f-dce1668215f8", "comment": "Malware payload (Mirai)", "value": "cf3c9acce34aaa0883f1a87320fb0049d11605dbfc411b1e4c4199164f27f132912a0baf64e4c1c6db32c0897c2d0304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966671, "uuid": "7a6500cc-f16a-49a7-b7f7-d315d25373de", "value": "T170933A95B9819A13C6D552BBFA2E42CC372653A8D3DF3203DD259F213B8782B0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966671, "uuid": "45ef4141-2642-4045-a6b7-9e539e7e7d3e", "value": "1536:B3jIwAYcE7AtbBixxkFC9Pm7oB1hZTB8avBuZ7RV:FjIwkbBixYC9PmiXzBuZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966671, "uuid": "20396e52-c7ac-4b38-b34c-a8ed29f28736", "value": 91312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966671, "uuid": "509aff15-b7a9-435a-a57e-1cd7fd77dd13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966671, "uuid": "b07e97a6-f53a-4245-8a32-9b5a40a7e2e4", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1791e585-e507-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767047907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047907, "uuid": "3486808d-c423-4f1c-bdbd-2b949cf2dcca", "comment": "Malware payload", "value": "33e2f02f906437db3ace46819c370bfe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047907, "uuid": "02743170-b0ab-4499-8e39-55ea8d96ccdb", "comment": "Malware payload", "value": "495eb742742592fbef66dc4a866db93eb3420a44b4c7b000c762a802fbdc8a73", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047907, "uuid": "04d81344-f04a-4dfc-a8cb-f34e8f3efc28", "comment": "Malware payload", "value": "0101e75196da4f6a84e0e4134ccfbad6ac4a445b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767047907, "uuid": "d9eb1247-e34c-4cc6-9cc2-0d53f9fe7b86", "comment": "Malware payload", "value": "1e064c886f18d8a7a4897e4ff821d9567ccd8180c78a34a567c0b1bd5d4f1693871e9e534dbd97ecab7f19f392a47d5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047907, "uuid": "e1932347-feda-40b3-b1ea-6b25365a4375", "value": "T17585BF4BB3B540FDC0A7C178890A5607EA72741913755BCF1680C95AAF23FE25EBE728", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047907, "uuid": "4226f0c4-fd3f-47b1-9631-f49faf2fb964", "value": "b2d508ed7969314688fcae24071d9c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047907, "uuid": "c7a1b06d-3585-4669-874f-5d0d120ca108", "value": "24576:Ed76C8BHUWOv0nsoVW/Lg96L9KnardebowPTipk+o7LmrVvyL3H2mR5f8TT3:ERKjsaWTZL94aSipaCVvyL3NDkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767047907, "uuid": "ca48019b-d481-4353-947f-da859a20081b", "value": 1852416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767047907, "uuid": "778b26f9-6e32-430a-9430-2c8ef55339c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767047907, "uuid": "a72a14d4-e655-451e-ac2d-8cb04b615eec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88fee84-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766971807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971807, "uuid": "4b100ab0-c6aa-4e2d-a4cc-7571158401d3", "comment": "Malware payload (RondoDox)", "value": "44ddfc5382fa503f7f8d2a4cc88aedd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971807, "uuid": "f28a2768-75a4-4d0d-a0cf-6d4659d74089", "comment": "Malware payload (RondoDox)", "value": "496de56a5a0525f7e037b2a578fba020e9bfd3dd2e04df1a8d9e5c30936fdf64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971807, "uuid": "b9203b5b-4bfa-4a49-a785-34cde5aef0f3", "comment": "Malware payload (RondoDox)", "value": "b402194f98ff2fb398cc9a1f97bb27f061629a0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971807, "uuid": "c98c08fd-46b6-4b8c-a6f8-b07317920963", "comment": "Malware payload (RondoDox)", "value": "63386517f725077b3f4fa1ccdcbddcf6b8d3b92e64d2df35b69903530ac6036032a030b5c5d95ade4c86a4f69feed1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971807, "uuid": "bb7ae10c-38b0-476e-9c8f-aa629e48d471", "value": "T183D32A6AEC819F15D9D526BBFA5E4189335357BCE3FE31029E244F2523CA92B0E7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971807, "uuid": "9102d408-4348-4e20-8b58-9682ddafeb40", "value": "3072:9LHWxpfx6HjqIVRRwaT2H3G5Nssk+8PLmEiWbAjg:9L2xpfx6HjPVPwaT2H3G5CsmPqE3Ujg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971807, "uuid": "2b332515-53da-4ae7-8aba-4875b7a17d0e", "value": 141844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971807, "uuid": "07a9232e-2ff4-47e0-97ae-479099bcebc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971807, "uuid": "82a34cc3-29ac-40fd-9ae8-3c8c077fe56c", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ad44c5-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029969, "uuid": "a5e61506-f103-428c-b059-8c75d0ed0b76", "comment": "Malware payload (Mirai)", "value": "e0a11fb6df3ebc9b2136527c46feee4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029969, "uuid": "4f04c15e-c54c-481f-99ac-a03d9fbcc2e3", "comment": "Malware payload (Mirai)", "value": "49c533323bb04369c23ff0daa98d0102bc24ebc3f142af1f9a1819b15484a4ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029969, "uuid": "80195ca3-2067-47c6-b0a4-30d5b1955f15", "comment": "Malware payload (Mirai)", "value": "8704027e98428c26c313ab30872fe315a040bdde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029969, "uuid": "a80a8793-ead4-4036-8642-e3ee0feebfad", "comment": "Malware payload (Mirai)", "value": "834ea1ab3ac7198ecd158966f74838071b67b7aa37b9831ce8c880c04aa03912e96c8b2c368c14b10ba9075d655cd282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029969, "uuid": "835c7d1c-d412-4777-af6d-87a73c90c2a4", "value": "T14134D90E6E228F7DFBA8C67447B74E24975923D622E1D585E1ECD2001E2029F641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029969, "uuid": "0f7b5e77-4a6c-44b8-b397-b0d27c7e4b97", "value": "6144:MLaYsgSxseqtCWjkFu1WqVzQ82uGUxgC2Qjj:MLIBGQ89X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029969, "uuid": "c40d48cd-fe37-489d-a977-65a248ae6dbf", "value": 245564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029969, "uuid": "1745b0fb-d148-48d3-84b6-43c067d70fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029969, "uuid": "b016880a-ce1e-48c4-be62-9a6858afd4c2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc11122-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031407, "uuid": "da05d57b-5c61-47b4-ac08-068118e4f2f8", "comment": "Malware payload", "value": "fad616d5fd1130a991a31ac717735d9d", "object_relation": "md5", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031407, "uuid": "ac0c4ce9-4981-4fd3-a888-30eecc094764", "comment": "Malware payload", "value": "49e08c15226427243cfd66c41b08a7c355511bcb04a3d7e23b68f63b990cf679", "object_relation": "sha256", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031407, "uuid": "165005d5-acf8-4040-86b6-93080e306e9f", "comment": "Malware payload", "value": "b0d8947af2da89af708a15031d2c319f138621a9", "object_relation": "sha1", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031407, "uuid": "c239fba8-932c-4f91-8944-29fbfc6d9c38", "comment": "Malware payload", "value": "6a8bce3e33d41765b8fce1b9d1d9aeef26d83c382fa039c200b1e704b1684780fdc643e2641bf1244404402c2d8568af", "object_relation": "sha3-384", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031407, "uuid": "6d5658d7-a4aa-4791-b138-2edd5e5e8f9a", "value": "T123C08C7180A4113CED1CDA8AE1A0F99EC0EAA058E2BB26A1AC204A4C07102318705020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031407, "uuid": "072edb4c-efac-4c22-bbda-a873106cf6b1", "value": "3:VSJJFIGFGMF17Nf/sWvER6fCqQRwJAFBALTZHpAUFIjyOGGiTZHpAUYE:s8GFGMFn3sl6f+RwrLTFpAcKzqpA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031407, "uuid": "56cc4cb6-96fd-4ee3-b78f-8f313959d8ae", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031407, "uuid": "06ee694b-8dc3-43ce-ad82-0e228f996661", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031407, "uuid": "87e48553-5ddb-4913-a873-1c22b08b9d41", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9e9b5e-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016746, "uuid": "9bf2c879-8a08-4b2e-bc48-38a0a65d0dda", "comment": "Malware payload (Mirai)", "value": "4bf1aba036b59bfeaee6b3839f918299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016746, "uuid": "90fed57e-8258-46b3-bc43-290e748c16cf", "comment": "Malware payload (Mirai)", "value": "4a77f0cf8eb9ebd5cb6339569ad9544288763ac91490bf2b8f4b591fa0ba7b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016746, "uuid": "43c44a14-1b55-4835-833b-8f7b0afd7982", "comment": "Malware payload (Mirai)", "value": "54088a24f7caacc8fc46056fed61e0cac22c0529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016746, "uuid": "8c73d340-80b0-4a33-b53c-6adeeb84b719", "comment": "Malware payload (Mirai)", "value": "d71475192d6547ef5b2fad4f6fe14d0e6a121a24fee1165764726f7d566516369564de136aa902c44c3c1fa5ae37ac83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016746, "uuid": "a28953b8-443c-4045-afdd-8fde8913b85a", "value": "T1E7B3D81E7F228F6EF768C63547B78A31A758339227E1C641E16CE9105E6034D681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016746, "uuid": "fee695e1-cf08-41b4-8ae2-9c6b55670f79", "value": "1536:iInlG8K2ITYUbUUl2xMDDTYlBf8WwsDNm2vG2SvG221Ln43uL0ZqeAjzY/auQ7Rb:xlG8KhTA7Bf8wn43uL0Zh/auQT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016746, "uuid": "ac4a8145-6a11-4bf2-b68f-4d998b7418c3", "value": 112344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016746, "uuid": "fa59149f-3d06-4ac7-bdda-98206521aef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016746, "uuid": "2d967bf4-4884-4e31-9bf3-4509267a1b37", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087e4d56-e4ee-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1767037144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767037144, "uuid": "32861d40-f5bc-4293-a05e-dd81b9a6fa51", "comment": "Malware payload (ArkanixStealer)", "value": "4e5f2e666f8f79753b7ec52067ecf7be", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767037144, "uuid": "ad22ddfb-0c4e-4429-8824-5fa8a861c995", "comment": "Malware payload (ArkanixStealer)", "value": "4a90bfe4054cd21f045717642273fa89bbd3fdf4c6808811ab1904b4175680a1", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767037144, "uuid": "e2c619ab-7da0-4207-a66c-632db49411d6", "comment": "Malware payload (ArkanixStealer)", "value": "5ca35796279738a399fff183fbf404d295b3f321", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767037144, "uuid": "111d2ccc-187a-4102-a192-5ff68d882f8d", "comment": "Malware payload (ArkanixStealer)", "value": "9d06c7f165be38528b96db4aee1215e24d9a8212f0ca192114cd14522c2ccc35711ef0e40eaca847a734791b649ff90c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767037144, "uuid": "c8080fca-185e-4cb6-ad4b-ab314f4ea3b1", "value": "T188C5E11AA3A401FCD1A7D275CD56590BDBB2B44A0770A79F07E04E9A2F237715E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767037144, "uuid": "dce3afc6-38d7-4155-a368-f2360a0f07c2", "value": "919350504531202eeca84154d8bfdf0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767037144, "uuid": "4e97f438-4607-4cd0-bbb1-42455aa09cce", "value": "49152:4g4vXIydAw/aXNYeKX7BMYWVWP9MDzelH91YYl6w:74vXI9WadYKnVqM3qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767037144, "uuid": "6e7e8501-a691-45cc-a0c1-c58a2c7c2ab5", "value": 2506240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767037144, "uuid": "208cac9e-7c40-47ae-80fb-545874d54722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767037144, "uuid": "a504b054-2ffd-45bb-b01e-f6058fbbd5d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ce3b05-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995448, "uuid": "821102fb-9503-4bd7-b15d-4b29175ce5b8", "comment": "Malware payload (XWorm)", "value": "f49a60fb2c931da2affe29e9e2bf4a62", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995448, "uuid": "6274d95d-6c2c-4dd8-9359-da98e80de8e4", "comment": "Malware payload (XWorm)", "value": "4a90ebca0d8891051f292c0ace0b9a8482d8dea332bfb7cd4604b403967899d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995448, "uuid": "26f13a23-7570-42f1-bf33-25d2c11c10b6", "comment": "Malware payload (XWorm)", "value": "fdb8a54f337d4e1d32ec5af8d63a5d5082c8a234", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995448, "uuid": "019d844a-06e1-4319-b0d4-85e696dd253b", "comment": "Malware payload (XWorm)", "value": "1cf0e932591e601679f789c6bc4af234353c9ebf37f48290d107d1bc5863e22703a5e07f5d9e543f552f74c3fee90427", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995448, "uuid": "f35c636d-b585-40f8-bece-c5dc4995fe1b", "value": "T10B733C9B426738FB913DF87CF0B2501A0A2B9BD18913B12C60EBED5D9E4D6D801593DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995448, "uuid": "e5b93993-7fb3-4668-87fc-4f1c7740b6d9", "value": "768:I8w/h62/jWs6oS+xISN0vxZoZ95ZwZsZXZVZHZoZAZYZaZa5ZxZmZxZqZ8ZkZKZ3:I9l/AoSSMkN8usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995448, "uuid": "2b2607fe-cc0c-452d-bd2b-941ceb2da4bb", "value": 74425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995448, "uuid": "f4267446-7ffd-4773-bb15-a3a59ebf2a35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995448, "uuid": "ea5ecba8-c98f-4f1b-8079-ae126268a09f", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc036050-e487-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766993314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993314, "uuid": "58a772cf-a862-4c81-a2c9-7ed25cf9ed2d", "comment": "Malware payload", "value": "ef80815602d371b6446d5b4a78f3b9bc", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993314, "uuid": "1f5b07dd-c8b2-4f10-8b06-2453c16c07a9", "comment": "Malware payload", "value": "4aba8f3183877c01c9ba98a18d319884ce59aaf7e6638e8feddfddd490cc2b81", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993314, "uuid": "df86b528-7e4b-4433-8ee6-ba98116670a2", "comment": "Malware payload", "value": "e2e49786f333fc6d6e14d9b25e1fcaada8e57451", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993314, "uuid": "362583f7-3c6c-41ee-bd0a-10114875c1ef", "comment": "Malware payload", "value": "9abb24932796d3d28deb058da50431bc4713999d33394bdbc95de94bc880a42777e701047ad46150b1bef478b3c70f6b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993314, "uuid": "b973d978-85f8-4dd0-84b5-7802c808d626", "value": "T18AC1FC383766C5ED06E3AF708D6EF604B46C504A7049AA49F48CD6F9AF009B7DBDC948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993314, "uuid": "8f4e6374-84f7-4edf-953a-1a93476b8c5f", "value": "96:tRYMZQzf4IwWQRXmv6lGqQH6D91JQ5YIiHRYTDQK5GSCMQjnwRCyI6Q28+XmFFtE:tjZQzQzWQ5Qaom9Y1ywRCyI6QUXmFFYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993314, "uuid": "b7abfbb6-a5d1-42c3-a48a-fe43aa27f287", "value": 6014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993314, "uuid": "f96d1e6a-c0a7-4b48-864d-11d3e27de7fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993314, "uuid": "8a0d40ec-d318-465c-8961-5f2b23f9e0cc", "value": "4aba8f3183877c01c9ba98a18d319884ce59aaf7e6638e8feddfddd490cc2b81.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7952f4-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767016755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016755, "uuid": "6d9a6c04-92c3-44f5-b575-b04942a66ede", "comment": "Malware payload", "value": "24d60cbb4f4bd06669ddea01b9946e2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016755, "uuid": "da4811b3-d05e-42a3-825d-6533b49f9a9a", "comment": "Malware payload", "value": "4c1998f345ed65d8dcc6a34ebb83365bdfe4e457bad2e301617fd1bec5bdf20c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016755, "uuid": "24f6fb15-ae10-4ab2-9d23-c322abb741ca", "comment": "Malware payload", "value": "2205e1daf5664f62e4abc2adbad7a06ffac79c45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016755, "uuid": "0c59a637-1291-4cd7-85e3-1b61b1fcce29", "comment": "Malware payload", "value": "fa6fd1dc68ca30877df36e065d0803c46d1dbf488d0f338cdc2f181b424316934548008e6cc4620418c45af656cba0e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016755, "uuid": "c1cbbcac-41b9-4544-b02d-f56d84965094", "value": "T1D89423C984484D92FFF2F1B56161946836BD6B4F27ED62F084284B3A0EE1D03159EFDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016755, "uuid": "00fe40a7-c1b6-4304-8570-b2e41360487c", "value": "12288:VL6BT8wGLbYLrixxSkgT8+MIpg4wn+Bx6a:t4T8BYLzkB+MIpg4wsxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016755, "uuid": "7994437a-76d3-4fe0-8cb5-8fcf3d5f671f", "value": 421400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016755, "uuid": "52b9db73-704d-4176-a763-ffe636a6db57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016755, "uuid": "b2ee5164-c69a-48c6-bf68-f2c59aade8da", "value": "app2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f08091-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972611, "uuid": "5740f0ef-199b-4615-a65e-ef8a7e9f8a86", "comment": "Malware payload (Mirai)", "value": "5f44fd5c99b31af18e6510450eb4ce17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972611, "uuid": "b8fb76f8-d3da-4e82-8d0d-c36511760067", "comment": "Malware payload (Mirai)", "value": "4c21abbd2a05581a23ef4e2d9aafd8c0687c28399655ad8788e1d0209e3d3863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972611, "uuid": "ff2e1756-6e94-4be7-94f6-edb38e1962da", "comment": "Malware payload (Mirai)", "value": "50b7a6dd7b2c49af5293e8d5280879ffeb610a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972611, "uuid": "dd7ed083-7b15-4387-a414-0b9b640292b3", "comment": "Malware payload (Mirai)", "value": "390f89484adbfd99e2a0558e44c5f659c23759e0cd8c1943c675b267ecad2662e2e414552bb5c0eb8afe85e33277551e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972611, "uuid": "14518b10-b0da-48fb-ba10-dd13cd60864b", "value": "T1CCB3179AE8819B16D5D522BEFE1E118C331357BCE3EE72039D249F2467CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972611, "uuid": "57fe4994-94cd-4fe6-9e32-54fbeea26158", "value": "3072:wbzUhDgMF+UaTIFuc7GJGwLqjCaaxRFnr8XUWDrbVHqL8GuZq:wXUhDJF+UaTIwc7GJlLWCaaxRFnrSUkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972611, "uuid": "92ceff2b-e575-4f3c-87e1-8301923c84a4", "value": 116052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972611, "uuid": "b8bc42df-596a-4683-abbb-1cf29744170b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972611, "uuid": "e74710b0-ecb7-433f-85a1-bd6d7dc91c2c", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a65469-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1766993324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993324, "uuid": "f93e05ad-5fd0-43e2-8218-c8463cbebc68", "comment": "Malware payload (XenoRAT)", "value": "016431fdaab0026f582053be20b5a911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993324, "uuid": "b877f9e0-58b3-47c4-a19b-5a0818354d41", "comment": "Malware payload (XenoRAT)", "value": "4c7ee077dc8d15fd3afa28f49ee87f78e432fac3bf65581cf5d6cc13db69ffae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993324, "uuid": "51a0728d-507c-4d5e-8e0d-663a7b4ced78", "comment": "Malware payload (XenoRAT)", "value": "8ee9cc2fb2209a53eace751eecc91e479cc697d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993324, "uuid": "bd9784a8-e29c-4117-bae9-c5bce9c77855", "comment": "Malware payload (XenoRAT)", "value": "87b91fe224ecbd50d30d14e048d21a3ae5f06dc48dec56b35913eda2b694dbe92f4a44fe3f3fe03625956b7b5d5315d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993324, "uuid": "5e10d1a1-4659-4871-97c1-abe92e0da1c9", "value": "T1D233F78C5B6C8923E6AF5ABD98324263C7B3E3669532E38F08CCD4E937973855405397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993324, "uuid": "b4c4bf36-146e-4e30-ac88-5eef6ea48483", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993324, "uuid": "d35c8a89-3438-4eb6-ad53-873b6fd1d717", "value": "768:odhO/poiiUcjlJInnr6BH9Xqk5nWEZ5SbTDatuI7CPW59:aw+jjgnwH9XqcnW85SbTQuIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993324, "uuid": "cbb566f8-6f66-435f-af96-db33da2b7acf", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993324, "uuid": "709676bf-85ca-4aaf-913f-616c988e9d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993324, "uuid": "6f27dee4-1cd1-41dd-9547-0d83cfe8fb1f", "value": "4c7ee077dc8d15fd3afa28f49ee87f78e432fac3bf65581cf5d6cc13db69ffae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ad12b-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767016756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016756, "uuid": "922f14cc-2237-4dbb-8050-21c311c5f94e", "comment": "Malware payload", "value": "a1f75b49d14aaa4f0498305e95121edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016756, "uuid": "816b9a8c-56ec-4cb2-a153-abcec67deb02", "comment": "Malware payload", "value": "4d640783e71cc3261665c51d2d91cd48b301a64c15df9ae5dc3a9501d3aa762f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016756, "uuid": "49e305c4-321b-4d05-81b8-4f15c3dd5bab", "comment": "Malware payload", "value": "8083ea8d45ed9fa4f765ab53b8c418ac173c6a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016756, "uuid": "917bbf10-a74a-4745-b9b6-d7a8e479ed94", "comment": "Malware payload", "value": "cf93843b427452a13e47695a649a57ca7e9201c6d7d84b0f1cf14fa5cbc43c2e9ab3a62f9d81d859ec4cf573ad00ad7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016756, "uuid": "197687a7-fc88-4211-ad2a-c17991c4fcc8", "value": "T133A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016756, "uuid": "55c095fd-fb25-4f79-89ec-43e3bca261d0", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYkj:FOuhPHCKsqZ9YfM6g23ZJLYkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016756, "uuid": "1cf4971a-ae74-4f39-89c7-06232e468c52", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016756, "uuid": "a8b6f1f6-42e6-4b63-a048-51afee9794fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016756, "uuid": "d0fbc6c6-d63f-4cc8-ada4-f240dba00287", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa29df3-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982226, "uuid": "a30047ed-dc11-4822-95e8-fcdb7fd89d0e", "comment": "Malware payload (SalatStealer)", "value": "6e063c7734ebb6cc788b94e03a0bd23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982226, "uuid": "821c9327-771c-4b26-9576-b53ef19fa9fb", "comment": "Malware payload (SalatStealer)", "value": "4d6cdc0d45f2007762986ba865ec0dad012b23b8ab1ef0e96345a0cc638282d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982226, "uuid": "6c0126d5-0277-4a73-abe9-b88298569ec2", "comment": "Malware payload (SalatStealer)", "value": "5eb8744a75870bce57ef03a856c7d0dd341d066a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982226, "uuid": "6838e5ea-d39b-439b-bdcb-ead6dc6ac091", "comment": "Malware payload (SalatStealer)", "value": "d545316ca70ba134f8c62d706c772253ff77e1fb75ce164d2a9b627d9d9f62d63cf5bc216ffdd07bb515d701340269f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982226, "uuid": "a1dd172c-f27d-4d2c-979e-abb0c53c55c8", "value": "T1D3C66D41FA8B96F5E9079831416BA33F63315D008B28DBE7EB543E2EFC776811976209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982226, "uuid": "1a2a775c-9215-4bd4-a040-e432a5534ede", "value": "49152:r5lHV6cGPdc93xqiLs+ZTEEQI+uI+ATOAY0XhWWIN3pSYCHb915tL4Vh0o1jHunM:1VVnG0xfmLxiQBxUVh0oLkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982226, "uuid": "cc9b425e-5e41-47f9-8477-637b5909bce7", "value": 12089344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982226, "uuid": "a618e561-7079-4fb8-82c5-9b7ace6c5459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982226, "uuid": "f645e3b8-93de-48ea-97b8-d115f146f7d7", "value": "4d6cdc0d45f2007762986ba865ec0dad012b23b8ab1ef0e96345a0cc638282d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cbda23-e45b-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766974210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974210, "uuid": "0becb3fa-98cf-4b87-8d1a-1eae16f59422", "comment": "Malware payload (CoinMiner)", "value": "2a07229dd1db1e4c4228d80c2a9044e2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974210, "uuid": "bf3ce6e1-3f7b-4ee2-8675-f7ca2277c7f3", "comment": "Malware payload (CoinMiner)", "value": "4d90753ef2115ad9c5c646f537c1b10285bed07b4f96813557c2a80013af24d9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974210, "uuid": "714e591e-d435-4efe-b575-3a0ffbb6c07e", "comment": "Malware payload (CoinMiner)", "value": "39f26cc7b4620bfeacf119b1e3114556c6b91d5e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974210, "uuid": "cb99db8d-f947-4f86-a318-b67bbae4554a", "comment": "Malware payload (CoinMiner)", "value": "500a5c96b5ef44f68dbbad963cd60ee946fcc1e560ba4f84a1164723ae3a3f4ec09065ea8e5c40f6e5a2631a7bd3db61", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974210, "uuid": "f6b61881-51f1-429c-9c42-69a6048849a7", "value": "T181A533BB290FB122C1294A396EFEB745D5E0E0185FA85BA747909C7542D027BD039BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974210, "uuid": "372336c4-2fa3-4e53-a3c0-08c42237cd3a", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974210, "uuid": "c5a66790-f2d3-4de5-b008-4bfd83666e4b", "value": "49152:zhkQXUPqIZUiEjU1FvtznLPMOqR8A4h5AhBIrvKiwv:z1XUCviEjUtznTq62D8Ciw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766974210, "uuid": "da1a7c44-6c55-42a3-941f-013fc5986cbd", "value": 2234368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766974210, "uuid": "2497f037-9350-4c3d-ab76-1e68a19f2413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974210, "uuid": "3925bc42-d46d-4d2f-a76e-584ed34f38df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9394bd51-e4d2-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1767025351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025351, "uuid": "8754aa88-063d-445d-8cbf-9db25abaed0c", "comment": "Malware payload (PureLogsStealer)", "value": "c827a9796d06b58777168e31c9b6c827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025351, "uuid": "a2bc2068-dffb-4573-ae2c-6b494c011847", "comment": "Malware payload (PureLogsStealer)", "value": "4e7553e3a78871ad5e545201d8ae2d707528b78f34d22e039b7756bffe729a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025351, "uuid": "934a725b-000c-43ba-963b-7c7afd963259", "comment": "Malware payload (PureLogsStealer)", "value": "17a42301856d74c06851f32ce048a8bb94818ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025351, "uuid": "ab732a37-e8f8-4dd7-a876-917a88e150d2", "comment": "Malware payload (PureLogsStealer)", "value": "9b9516c43e79507ff6b908e8e28c6babb49c7dc49d5da1c04c668d698584e245b6a35e6825be221ab94cb349a9120390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025351, "uuid": "f3e74435-edd7-4c00-aec7-401351945c5c", "value": "T136E40165731ACA03C0919FF29871E2B127786EC9BDA2D34BCFC57ECF74396614448256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025351, "uuid": "fc94747d-2a8d-4b41-9e92-6d356937ba68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025351, "uuid": "553cb72d-a788-464e-848c-800bd3538bcd", "value": "12288:cx8Bc6eFQO6inxkuM8XXJfyaRvOkGTf9ukkpSyx0pOGEY1o7oyq:cxx6eetSkudnJhvD2VfO0it7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767025351, "uuid": "9ea90366-6db2-4466-bc37-d84b1eb2aecb", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767025351, "uuid": "4c975a99-6f7c-45e8-a9fa-c5c1f2482c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025351, "uuid": "50cbd51e-db41-4e11-9a48-4d5e70dba4c3", "value": "SecuriteInfo.com.Trojan.Packed2.50433.2299.910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175146f0-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767013976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013976, "uuid": "89b5b207-ab70-44a5-a28a-843d31e8ad0f", "comment": "Malware payload", "value": "d47cc368485d1af299ba1c54d6dd5975", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013976, "uuid": "89435a09-58dc-4466-b76c-658fa6971d1b", "comment": "Malware payload", "value": "4e8db96dbfc6294840ab99e84278f11b60bdbea9d9beaef974676d6f576deae6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013976, "uuid": "dffa344d-faa4-4b83-921d-b92eecf87a05", "comment": "Malware payload", "value": "8caf914ee4e58339e18d176ce9748f07d00fe024", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013976, "uuid": "007c6016-8f19-4da1-b1c1-76aae6c50657", "comment": "Malware payload", "value": "0c424d5d984aa8082ee74230ddbf6799f4c7bcf7f55f828ea3399a720129e177f60a88e255938f0e104bd29d9f89a2f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013976, "uuid": "54253815-f91a-4191-a5de-7ccd833126e5", "value": "T166214DEF3595A731268CCD8072E59429B44E6AE226E41E28FFC928B3DDE5D007748B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013976, "uuid": "4de101a8-19a0-46e8-b136-dc6b710938e9", "value": "24:boWBG05pELMk0aNw92i9Rq3gOahv/iYZJKU3v3pZuFmatkk0:boGGMpzaTziViu5/Fat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013976, "uuid": "79f6cd1d-197a-4f63-a195-6fd0e91f0527", "value": 1297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013976, "uuid": "bff0cfc8-278b-42aa-860d-028e62f906f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013976, "uuid": "04016f88-a709-4b99-93f9-63e25a5a413d", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223018bd-e4c7-11f0-a129-42010a9c0007", "comment": "Malware payload (GootLoader)", "timestamp": 1767020437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020437, "uuid": "32fad627-8280-4b9c-aff9-c5b2f44b3283", "comment": "Malware payload (GootLoader)", "value": "3cfad915e1db0af563175b0369da7354", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020437, "uuid": "a04260ab-6894-4540-a6bf-987ce1dd8ef8", "comment": "Malware payload (GootLoader)", "value": "4e9b0f6ab987c7867ed23efe917794d053da4fb6dc52bda85cd6687fe97ec7ef", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020437, "uuid": "4aa6d1c4-155c-4bc7-8364-5bd0001b3d5e", "comment": "Malware payload (GootLoader)", "value": "7d24fd6540c9ee5227aebedcc0f9d047cf2eada5", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020437, "uuid": "f2ac299b-16ae-4df2-89f8-37729280f057", "comment": "Malware payload (GootLoader)", "value": "89a12afb4b585e3c5300c2134f28d8825d861570029d2af4deb9e65a95af611fa669e3e01cc61b90fafa604d2570ba29", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020437, "uuid": "5c5cc102-3e47-4115-b22d-587963345273", "value": "T13C28126BF2AE84830D7ED90B61F0483E7536F86167A4056685DDC7F7A0208E6FF1318A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020437, "uuid": "d616cf5c-a191-46c9-ae7a-474bf124dff5", "value": "98304:LhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLhLj:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767020437, "uuid": "119e8b1c-adb9-4688-b528-a6c53b7168a7", "value": 99898932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767020437, "uuid": "eb4e031e-1f69-49e3-aec5-e50751cceee1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020437, "uuid": "7372dec9-0f53-4d54-ad23-f24d01fb9203", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e3f3c2-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026236, "uuid": "dfb07293-b8de-4859-994b-b78cc48a9123", "comment": "Malware payload (Mirai)", "value": "d08f686e53cf2c15ab005d8bce51cbe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026236, "uuid": "7ef3ab47-4311-417a-859d-f6338cfd2a9a", "comment": "Malware payload (Mirai)", "value": "4ed6deef0d30ef28ad8321e4750a02c6949453236251146ff0aa445c81114f4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026236, "uuid": "d7db8352-4bf2-45a8-baea-f503a22e2363", "comment": "Malware payload (Mirai)", "value": "565b5f16c9709d85ebe1a67372090905395248e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026236, "uuid": "e59bd849-0093-4809-bcaa-439b5508a506", "comment": "Malware payload (Mirai)", "value": "703384d47c57f9ef793bd203064cdfb0e63a164b5501075f2a8c6905a3bfc193a69fdfc6c644a224f90efd55b647cebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026236, "uuid": "f548fae5-ba06-4255-950d-b429e3de397d", "value": "T119535C0273184A57D5E64AB0193F1BF093FFA9A021F4B3C5650F9B698675E332486F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026236, "uuid": "ca9d4d46-a2da-48f4-8ee1-edd7f87fb495", "value": "1536:aikP7tID5Wldd+bo0mZqkXATfBFlqu+7RR:4G5adL0/fBF8u+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026236, "uuid": "0e70e055-2672-425d-b0ef-123d3d163914", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026236, "uuid": "13fcaca7-9508-48ad-a00b-d8381b6af63a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026236, "uuid": "dff1cc28-5382-4ed0-b277-524851f0eedd", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4f7dae-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997719, "uuid": "7f01425b-dda4-4611-af76-541ad0065d36", "comment": "Malware payload", "value": "cc36551e91aa0419073d9bd5cb52353b", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997719, "uuid": "6e0bdb63-f903-47f1-bdd2-579d5e054162", "comment": "Malware payload", "value": "4f2913bf769bc5482a244d4db05bef2be7e8aed5c8179b9e63465a179684a4c8", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997719, "uuid": "c7445e82-1e4f-4128-8da8-b8a999e271c3", "comment": "Malware payload", "value": "394a5ed44b109b598e3bfc904ef63454411ef51c", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997719, "uuid": "c7be96fa-30da-45db-a1b1-a84f729f564a", "comment": "Malware payload", "value": "4b2f6b84911b60e9d891880ac6ca16137706a594128a6c48251b161f7b00280915c4d1fd3e54eef3f00edca65c6bbd22", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997719, "uuid": "8a2e26a8-a396-428d-a1a0-d824bebd8896", "value": "T156C02203834D4336E56A58E23481E633900B18910B0F00F12134670D2D4E714C683018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997719, "uuid": "ceceaa84-4be1-4145-a109-e1f3d24e7217", "value": "6:s80QO0c5IhLh8CLWUSjCwrLTMfW1R51MFyMfW1Rx:s80Qpc5IJGhEwfZj51MGjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997719, "uuid": "8aa41ffe-9393-48a8-984e-503df3be4c81", "value": 194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997719, "uuid": "02a363cb-00f6-4638-be56-9133ba9d47cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997719, "uuid": "9ffe2108-89f7-4ce2-8bb3-feeabb4ce305", "value": "s4truz.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d689c3-e45a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766973730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973730, "uuid": "e6ffecfd-aa14-42bb-843e-ce354e48e9db", "comment": "Malware payload", "value": "3ef1b454c2b4f30125c94c183cd78cbe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973730, "uuid": "492875b6-f107-40ec-a08c-80fabe509bcd", "comment": "Malware payload", "value": "4f464571d3b54eb0be954ea9a3024198e6d8ff6db2eee6b6f798f9eb21205b16", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973730, "uuid": "879bd23b-fe78-4c7c-9da5-b8d563f31507", "comment": "Malware payload", "value": "8cd1722885fa8e0a68b2247356afe4f8978f8a8d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973730, "uuid": "c0b77896-e0d7-4145-a7fe-d89d40164466", "comment": "Malware payload", "value": "004fcbf90a8353865f7134cb7e59f44b07ead6fb14ce8aea590cd88641ceccd7b3c7fdf4490f2b26946871658d6ea7f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973730, "uuid": "7a7df5c5-adf4-46e7-abfa-3d8905f29a73", "value": "T1E2851216ABEED417D0D0BEB99AB142479732F4E02B3B03AF8565587CCA363E05E34785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973730, "uuid": "34db13e8-776c-4f36-ad68-c2c0c381942d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973730, "uuid": "461cc0cf-bc2f-4478-ac84-63057c4310a7", "value": "24576:jH4q62JGXMFjKfvboHMxGsm22YWMaSn/3YgRYHQt4sbDELBaDy2xBtYvFCsuMlIL:r4qkXIkvboH4m2VaSnvdqTuy2xBtOHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766973730, "uuid": "0d9e7f6d-1374-41df-86a6-48dcf80676f1", "value": 1855568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766973730, "uuid": "6a240504-04d9-4493-861e-8c98913fe2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973730, "uuid": "72acdc5f-5775-4c4a-9261-82e3d8bb59e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0273c742-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029403, "uuid": "1fa128e0-2a1c-4c9d-a902-df5ce8338dda", "comment": "Malware payload (Mirai)", "value": "c0d4e3b0a1bbdbfd1ba8c2243bb39e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029403, "uuid": "b08c6507-66ea-467c-be11-1a700ac45278", "comment": "Malware payload (Mirai)", "value": "4fac670869fb8547da564a4120da1b8b44741d5c08f4433e298c030e99bb5e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029403, "uuid": "c21591b3-dbd9-4041-9ddd-cb0910571b87", "comment": "Malware payload (Mirai)", "value": "0ed87701a0e17c2641b200fb5a80fdaeed819b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029403, "uuid": "392bd59b-cf3c-4900-865d-2145439622c8", "comment": "Malware payload (Mirai)", "value": "b87ac4799bf8117035558753d681338c3871d5ccd8c5877a0df09c80915203f18cf0746b4445f4a372616c6a12851d48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029403, "uuid": "82f9a560-b0c6-4960-8fa1-dd8a502ff0b7", "value": "T1A3437C3BD53AED98D54C45B8A9B08A791F13B201D7522EFB2A89C57680439BCF60D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029403, "uuid": "687c7451-fb9c-4150-9382-5022abb0f37f", "value": "1536:katwtDUlyW1yMs2bfeNdUW1SVAHCjGuM7R:kW7lRyMzLecW1+AH1uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029403, "uuid": "13266af6-1226-440a-9cca-b1c526f62364", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029403, "uuid": "b61fc35b-bbf2-4ffb-aea3-79edcb12f802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029403, "uuid": "20bc6b80-4791-4c96-a2a9-963e0c0e6d5a", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531a671c-e469-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766980146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980146, "uuid": "4a0becdb-f231-47b9-9061-c0f806e26eae", "comment": "Malware payload (SalatStealer)", "value": "f982c8cb9fb63885401755b8f00ace53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980146, "uuid": "297c8daf-fbf0-44dc-8f4c-6d637fcd4435", "comment": "Malware payload (SalatStealer)", "value": "5077be8a481f253e69b09a17473053510409f605ed1554d108cb2d4f4cf1962e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980146, "uuid": "734ebea2-848f-4673-94dd-39206cb124db", "comment": "Malware payload (SalatStealer)", "value": "43487f5cbfeaeb107a38ea50818c21989e79ad40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766980146, "uuid": "f0d90824-d583-401e-8c19-dfa70f7df205", "comment": "Malware payload (SalatStealer)", "value": "7e81f31a785c5c5d8009e1c5133ce37500893a014c23711b602a9ebd20d6ee63540382dbcea5147fa410151ecf780ccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980146, "uuid": "000dc196-fe31-4a6c-8ead-bdd708bb4948", "value": "T1E5C65B41FA8B54F6EA031832415BB23F63305D049B28DBDBEB547B6EFC77681193A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980146, "uuid": "860c58a3-27a0-490c-b054-d13e0a428ced", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980146, "uuid": "9890db6b-c233-4733-8f82-6948fc75ee92", "value": "49152:PfmnU+wVbz38Bc+sju2D/17ukLIItkqXmgDliCd+j4NVV81WSpZQts5yLz0+eyZ+:nyUTVsc1KIfaZEP9cNdv/KpoUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766980146, "uuid": "b447e532-34ce-4c4f-857c-a3b5017f3f63", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766980146, "uuid": "da5ae7ea-b802-4ad1-a819-56a1cade1515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766980146, "uuid": "56f8ad0d-e9d3-40ca-9821-811560c55f39", "value": "f982c8cb9fb63885401755b8f00ace53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a551f2d8-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996175, "uuid": "bd8ded7d-c292-4bf0-94fe-f4951e776eb2", "comment": "Malware payload", "value": "534b84fa79df1c19f24ed9a6820e2124", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996175, "uuid": "7fe34845-774c-4b32-815e-a1149445298d", "comment": "Malware payload", "value": "50ad7b54e9772982e413ae4227f500604f662844c45e7194040936ed25f0a41f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996175, "uuid": "674faa9b-aaa9-4e02-8827-90b162e9f12d", "comment": "Malware payload", "value": "f02d7917e079c2984831828c0eda8397beeb9f87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996175, "uuid": "3be22541-2140-4cf3-9d07-8088cd2e8eeb", "comment": "Malware payload", "value": "bb6bf818d8f9c306f8cebbc2cb5e943fca0075cf06ef86e45d7c644e85967afdea13b2d9e0c3baddaa62032c0d70f712", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996175, "uuid": "bb978174-a86e-4e57-b2c9-cec6c0b2da51", "value": "T1EF33308523C0684643472B7B723FB0F5FE6E49DA39888547C208BD90B5B670FE6E5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996175, "uuid": "5a8ff92f-82b7-48fc-b5a3-f38e8fca68eb", "value": "768:U8NMvEnXArDjpVFVetm2nr5U3yvJpi3EluPWFMRainxZlePfXS9clX4ntuyZYAMC:skh6kvGB6Dccb2LlBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996175, "uuid": "232fc512-85d0-4b1e-8bd7-55544fc51320", "value": 54609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996175, "uuid": "ae7d2b8d-9725-4ac9-beba-1f92abb4f663", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996175, "uuid": "b282ee69-b1a4-4ea5-b55b-7eec70d0ba38", "value": "Standard New Order #PO 354688976.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb7001f-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982254, "uuid": "02c28d6f-04ac-4342-812b-cd6a3dd3efc9", "comment": "Malware payload (SalatStealer)", "value": "b079959f3702951d8b47b2cd12842c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982254, "uuid": "5b198ffb-e250-41b6-8182-d770a28fbf0a", "comment": "Malware payload (SalatStealer)", "value": "510252cd62bd131224e5001edbcc9b73f320031dc28301fed45acf3d56cd5b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982254, "uuid": "755914d2-9dc6-4110-ac90-2d391c2b86da", "comment": "Malware payload (SalatStealer)", "value": "63d52125d6d341b89d632c7f5a97f69bb8a7a7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982254, "uuid": "88cff4d0-6085-466f-8453-3225d24ba82e", "comment": "Malware payload (SalatStealer)", "value": "251c313eabf2231b77c9a67ce65c33034d859a1fcce0586da0812593d27031779207b6d8961b67fd58a3419ad8408010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982254, "uuid": "4ef0a5cd-0b88-4f53-bf30-17d9b26a1939", "value": "T175E68D11FA8B54F6E9031831405BB23F23355E048B28DBDBFB547B6EFC77682196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982254, "uuid": "cd7caefc-953d-4c09-b06a-3ae58c469b36", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982254, "uuid": "310bcdaf-08f7-4d58-9400-202dedf0da97", "value": "98304:/J5u6dT/QVs6tTYUZ7ApvO3WBtm6+LwYWTT7RjIpF5ZTxPCWNzV:lZtvdtEsJjIpBTxZNzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982254, "uuid": "46bf56e6-c6fe-4976-aba4-4b257c414ab1", "value": 15067888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982254, "uuid": "fee31174-1e0c-4f2a-b57b-4d571cc2e246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982254, "uuid": "aba39025-7091-40ca-9a44-ee9ddc4a9e5f", "value": "510252cd62bd131224e5001edbcc9b73f320031dc28301fed45acf3d56cd5b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce4fba9-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767028535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028535, "uuid": "8897fe5e-1ae9-4bc2-8527-85e968c43fc9", "comment": "Malware payload", "value": "43b1f72bb30061538e61ac68c48f3228", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028535, "uuid": "314c19e8-9a7b-45fe-a536-be56361c097a", "comment": "Malware payload", "value": "510e16fc319eadbf409075dd1fe04dfa1ae350bcae544e3391a0e36f5e6b9fdc", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028535, "uuid": "db08aba8-2341-4a22-bf09-c90a791f76a7", "comment": "Malware payload", "value": "ad163a8064c4f2f5d3b1b2486b86196e6af0461d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028535, "uuid": "1b34d992-85d8-43cc-91a2-2a4af829f6a4", "comment": "Malware payload", "value": "3757f7b488536fe22f83e7eefb76964834789f24e66f589de9e0fc8b7080aff0a0809a048dec3d6b9b0382a844f34448", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028535, "uuid": "450e1834-3ff8-406f-a988-27bbae338ceb", "value": "T106180218A190FD9BD6A9DD812B2974B7616A41DDEC053FEC2F2E076CF6118DB0CBA41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028535, "uuid": "81fb0584-4990-4fc5-b9de-8d23101ff9d3", "value": "49152:zLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLv:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028535, "uuid": "c478f0a6-62ef-4b4d-a1ca-cf52f8c2a1b1", "value": 85925021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028535, "uuid": "a63d95b1-b277-466d-b597-d05fe4cb03f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028535, "uuid": "717894c5-3b7f-4f67-aa53-c67d8a2dbc47", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88553354-e4b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013736, "uuid": "e0ab19d6-a267-432d-ba20-3ca0d477dc6b", "comment": "Malware payload (Mirai)", "value": "110dc7b0a347e720122bec4e8af23b00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013736, "uuid": "1123572f-7613-4ff3-bdb0-bbb3f4764c84", "comment": "Malware payload (Mirai)", "value": "51353de611a58cbeda735ac5bd9eb576c47bcaf3531ad1d824262c4955921759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013736, "uuid": "32847d75-20e8-487b-9521-bf3daf60236d", "comment": "Malware payload (Mirai)", "value": "7b83e19c4572d7a9da208fd27fc3faeec8335bfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013736, "uuid": "52bfcecb-ec38-4012-b463-82f4af8a69cc", "comment": "Malware payload (Mirai)", "value": "745f880aaf0c8148d70fa9a8f7a39b2e549c0ad87e30892db4a86057f67e7ec95fd060003420acaeb483498b9800dc96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013736, "uuid": "f8f99977-b312-44c9-bb8f-b35a7f687621", "value": "T10363B316BF650FB7D89BCD3B05A5170439CCA61B21A93B3A3934D818B54B21F5AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013736, "uuid": "a5afa855-dfa8-4089-b4a4-e77b9bf09e90", "value": "1536:fov1tw905vCPp5pMZcN5KhaqrGLVpkT9:f+1twm5vCPp2q+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013736, "uuid": "7ca6cb1d-af2f-41c7-b86b-eeae367528f2", "value": 67196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013736, "uuid": "1f5db3d2-8044-4888-877f-560b8eecd4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013736, "uuid": "b480f94b-a67d-4cad-98f6-5919afe82ecd", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6123af72-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968573, "uuid": "7c239c89-bf1c-4893-9782-320d97c37d16", "comment": "Malware payload (Mirai)", "value": "a24e96d2a0f014bd1c4386322fcff879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968573, "uuid": "a634c8b1-1f9e-4226-a281-eabc4a018f58", "comment": "Malware payload (Mirai)", "value": "5170f421e34a3688d945a97f7d9261df2dfc0f0299f43ce2e5180c3be6d541f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968573, "uuid": "12034865-4dcc-4e69-a6e7-f60368d3a809", "comment": "Malware payload (Mirai)", "value": "07705ef4fa924c1e77a887eaf81f5f1dd30e93db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968573, "uuid": "03337bc9-b4c3-4ce2-a303-d4e4680ce030", "comment": "Malware payload (Mirai)", "value": "0362dd07ad3ee949665990e332152aab7a5296f58854b49c58196ca821e0824f891f987777ef145a85e36c8cfa797382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968573, "uuid": "31ee9dc7-aee5-47f9-976e-0164c28a54b5", "value": "T1F3633A51B8815A13C6D422BBFA2F428D372653A8D3EE3213DD256F11778B91F0D7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968573, "uuid": "19c25fde-cb5f-4b5d-b94f-2ffefe94a126", "value": "768:PhvE27NqTXLUVeIJGXaSVc2ZKiSVUdeBqXNCBtfCuOOMmlbupsC57mIDSa1N4MuL:ZEONhJGKSS27yU28fmlbufNWaoMuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968573, "uuid": "fa8c9a61-657f-4f81-849c-770d14a3c2f4", "value": 70820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968573, "uuid": "25febe76-eff0-4c88-be71-b65d44bad4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968573, "uuid": "8c71ee98-e8da-4c8e-85a2-a4022c173346", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f13de55-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "7d6f0881-3846-4277-9e5b-b6cf49fc3a00", "comment": "Malware payload (Mirai)", "value": "d751e31760a01e4bb6e28d137f7aa715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "c0a24a1c-eb4f-4cc5-98bc-8ac681d098de", "comment": "Malware payload (Mirai)", "value": "51ea9bb2fb7d1da6d4b62a5451154c6c1caadbc51d400d3a65f5d868257d685d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "70f8b6e4-050f-452a-a03f-c143b8556586", "comment": "Malware payload (Mirai)", "value": "51899bce1a80756f0861fb2443bfc809a49ff1d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "000af995-60c6-4af0-b5af-2e05c63189ba", "comment": "Malware payload (Mirai)", "value": "43a5eb26b75ba4e17a8ba44e99f37af3a9970108b30acb9539a04d9eb01fe4c5b5e3108b185238e306ccd285fced77c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "6e881d49-5dae-4ee6-9322-b5c5a0301038", "value": "T116934BC7B400DD7DF80EE77B84674A15B570A3615B920F3B739AFD93A8320985926EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "988b2d97-d35f-4f05-909c-7a142bc423e3", "value": "1536:2Q+c4ppufmAASO306gl9mA08inQuPatOoQ/vdHwduzgRzXuLv3VjdP3Y:2Q+cNOAAf0NXmAYQzO//FQRzXm3R1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017022, "uuid": "66b039f8-d61f-4566-9281-632a8d47cc4e", "value": 93136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017022, "uuid": "3e3a6d72-aa95-4321-b741-167a1d261451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "1ba76af3-11ec-4483-a980-dd526550dba6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6cba5d-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026230, "uuid": "a7a74e5b-6702-486e-9f67-e565a709e2b9", "comment": "Malware payload (Mirai)", "value": "9f977ec304d30d47c7d670820ebf5f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026230, "uuid": "a21c6cfb-06c5-4c6b-b1b9-d02e9e1d6a21", "comment": "Malware payload (Mirai)", "value": "51ff0765d480710b6d38da747817af20bd0e3078706f07f14a8c69edd65af1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026230, "uuid": "b327417e-681c-43fd-b1ef-2b75314cdfb4", "comment": "Malware payload (Mirai)", "value": "46e43d2f4ed4dd934114623fcd6db8d6e010406f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026230, "uuid": "864ce71e-d331-451a-9c1d-5f6f3acbdd9a", "comment": "Malware payload (Mirai)", "value": "2c7bb424ad1b1072c17808970012030cdd6230ae5d1f32d68dfb4fd0e550e09d40a646bc8798510f37da73ed2973ab92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026230, "uuid": "df41f236-7cb1-41f4-be68-a31badc65c9e", "value": "T1C063E946B881CA26C5D512BFFA2E118D332717B8E3DF73129D106F157B8A96B0E3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026230, "uuid": "9624ed6b-439a-42b0-842e-4832845ce8d7", "value": "1536:1IRnVrbKCc3rH4V7nM5sY5gHweGI0LaDqJuePM7IdiS2nB0k8uM7R:UWC4H47nQb5gHweG3LaDq32nB0k8uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026230, "uuid": "7653e8e3-e729-4752-98ba-71a01e3a80e0", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026230, "uuid": "35f8281d-87e8-499c-930b-df25969b29f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026230, "uuid": "02de4bfd-2256-4d66-81dc-dd5f5844e2b1", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ea7063-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969178, "uuid": "ae2b2e54-57e0-4c03-9136-ca31403f20fb", "comment": "Malware payload (Mirai)", "value": "7d70bdf4aa3eb59086be47fc5caf21b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969178, "uuid": "490706e3-6e06-48d5-a828-4e4a111da862", "comment": "Malware payload (Mirai)", "value": "524faea2f49ce5f07dcbf4f3b3c2a6df6d2e326d0d7ef03c49056aff93afc772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969178, "uuid": "15963111-c7db-407e-bade-5e48ce8e2e6a", "comment": "Malware payload (Mirai)", "value": "f61e951af02b6ba73c8fe473fd7b66cd2435ea5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969178, "uuid": "0530b3ec-f2ea-4281-b38e-8c10cb60e8e7", "comment": "Malware payload (Mirai)", "value": "bbd2294c7571c18375b294de9a32e0b79c3ad6d446bcfe4a320a94eae3442b4e421c72aea7137b90c14a5ba76bb847ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969178, "uuid": "3efb45a1-8431-4a9d-baa5-bce05726bb2d", "value": "T15483E70AEF610EFBDC6FDD3746E90A0134CC554712A43B3A7674D928F64A60B49E3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969178, "uuid": "1e1c4fa9-4399-4881-95c2-9c373fefd801", "value": "1536:dn1f5+8rc7a8/pvx3VdA/m6xlgHU8VcR:HruZ/Kxx38KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969178, "uuid": "24881fb2-3174-4ad9-b3c0-181990567a6d", "value": 85056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969178, "uuid": "8c0a6c1c-66bd-40b6-b4ae-60d150e50b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969178, "uuid": "73c21d84-304a-463c-9157-79ec36ca16a9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aa7bbc-e4e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767032433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032433, "uuid": "b206f1ab-7996-42b4-b7ab-e5048a69a36c", "comment": "Malware payload (Mirai)", "value": "8f19081f958d44a53e0bf9386071bd9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032433, "uuid": "4269a5ef-7e02-4b7b-8026-e1f117539616", "comment": "Malware payload (Mirai)", "value": "5270d354612e8ff5e67eff5ec1e153fc397934fc53cab4c38832fc43f5c10103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032433, "uuid": "97aa8b4a-f5a9-4d96-b752-9bf5b9386eb3", "comment": "Malware payload (Mirai)", "value": "b97a79d3a4728aa58cfa95d6a53dc0d18f587768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032433, "uuid": "f0fcb690-c674-4b51-9e72-aadb0d827cdf", "comment": "Malware payload (Mirai)", "value": "f7ddd053ffceec062652998f0740b209cb36d160c3288278dae06cbcdc160c37bb144f1c2875a2eb71b89efbd9830e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032433, "uuid": "e4429adc-15f2-4dc0-a7fd-f7113990c9b3", "value": "T137634B227A7E6D1BC4C4B47E25F74320B5B2570A36A8CA2E7D731E4DFF14660210BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032433, "uuid": "81974776-722b-407d-92a6-48a7da991d51", "value": "1536:K4mSt+p1z2rpSwytO0ZeDw40oRHsIzlxZWIfGKaKUe+chs:v3wCpc/MwnIH8KUe+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767032433, "uuid": "5687bffe-dd36-44c6-8233-75b1db9c1575", "value": 68504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767032433, "uuid": "13d56c96-03f0-4447-8ce7-521d9361d520", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032433, "uuid": "a32e53d6-b00d-41f6-84ff-a9510749850c", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201e96dd-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030741, "uuid": "55b5074e-20f3-4fdd-bf75-300537e2854a", "comment": "Malware payload (Mirai)", "value": "c3d7dacf98ccb3bbe30ad8760f0fa689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030741, "uuid": "f3a87e89-9931-4aaa-9a50-6cd4faf1932a", "comment": "Malware payload (Mirai)", "value": "527b55548e956c7c492a56176bcff39df1de9afc0f0dc96269a4284079b0fd28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030741, "uuid": "22b46f0c-dfc1-436c-8be4-56baf1172130", "comment": "Malware payload (Mirai)", "value": "ca0e36af699af94aff0f2ca42e2bf8be87d5180d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030741, "uuid": "516193dc-725e-4907-bdfe-1ae10bd527e4", "comment": "Malware payload (Mirai)", "value": "b7e780d66d2e39b76ad4cbb4c444b96ec417a01d95ec7d80507125c77173065af951e0edccb239cfef8e6cad8ed8a611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030741, "uuid": "43cfbc4f-3073-4a6f-8672-e309dff72114", "value": "T15D232BD9A401AE3CF84FEB7E84530A18F520335521931B2B57ABFDD36D722A49D16EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030741, "uuid": "ab2ac292-2b74-4c6a-804f-a2fae132ba45", "value": "768:2ZreE8eIpNH0Wa2O09EF9SJK6O048uwK8XR6/vK1a3obQPgn:2RN8BH029ELSJKDT8uwPR6/i1CMpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030741, "uuid": "d7d3397d-7da2-4c4b-abbd-521a13370c7a", "value": 49536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030741, "uuid": "967976a9-2f4b-4773-a11e-381836cfb637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030741, "uuid": "4ab206cd-9fa4-4f4d-90f5-f559fbebb4b8", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9d6746-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026467, "uuid": "34affac8-6d90-423f-938c-6561bff98ddb", "comment": "Malware payload (Mirai)", "value": "09ebcf4c2e57dde142a5ed4be066f89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026467, "uuid": "4030b337-aca2-4549-ab12-7b05d4d81b56", "comment": "Malware payload (Mirai)", "value": "52c67be41902f662760549047cf5aed6bc178751ba7a921e5e6e7f6bf62819e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026467, "uuid": "051ec85c-da45-42be-a69c-2dfcfc99372b", "comment": "Malware payload (Mirai)", "value": "aa115ec30620523359875afe6732b89d6a585882", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026467, "uuid": "c106875c-0484-44f7-8973-a7779c3c1e67", "comment": "Malware payload (Mirai)", "value": "77a0502f5205651de82367243ed67b7e9dbc3000f4d3b7b91fcd9e9a24bfce4374850166f767e06e98e2c45d4d061e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026467, "uuid": "d19c6f32-ff04-4906-9ff5-40992abb5570", "value": "T199131A92F400FD7DEC8AEB3AC1270A07F2607656C6914B23B372FC536D76294952DE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026467, "uuid": "d50b98c7-a7fd-47f8-aa06-d4a9038a3aee", "value": "768:wP4pnxjzqIVOaiJ4CEmuElTOfO8uF946fVmXcORZ4NMUmDPlx:jpZzDVOaiJ4C9ueqfO8uF9VmXNRe+rDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026467, "uuid": "3c8f3a4a-527a-42f0-ba94-71d0ac696b3e", "value": 44700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026467, "uuid": "8a0dff21-dbd8-4231-a333-3f2d003e9ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026467, "uuid": "85380942-2160-4836-a5b5-66fe94fdcfdd", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d6fbdc-e4a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767004469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767004469, "uuid": "c1b8d4a0-f9e6-486f-b1e1-b6bf7ffdbc83", "comment": "Malware payload", "value": "6a9eb82232b6b93f5231249759db22e5", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767004469, "uuid": "17d00fb2-94d5-439d-b630-6bef0ac50060", "comment": "Malware payload", "value": "52ca5ea7095e33bd7bb8f8b23413305dacf664c9154baca80b95a957549aa4eb", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767004469, "uuid": "a1415fb3-f113-4f07-996a-5423f3655eb1", "comment": "Malware payload", "value": "211eb5ecd4fb8d7faac37b11a05a31303f4a50a8", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767004469, "uuid": "b1286a5a-1bca-4fdf-9456-3477fc67879a", "comment": "Malware payload", "value": "8791f4596b31126bee2d05785bfca80a6035a75e1208d2314a51ee6eba525a4b75776a70eaf8bc08bf931f875d64ff32", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767004469, "uuid": "b0981238-19ea-4a3a-b4d4-48ff8dfc1dde", "value": "T1C545332A50CEA5FC4CB23B731957F79C10A4B59C7D0278BAD4C260192252CDA7FAE8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767004469, "uuid": "c49b4595-616b-44d4-9f9c-4b8e39a594ec", "value": "24576:VNagISK4/JSVplG/fCoh8umz0Lv3GkCLgdjbaOOOQ5EaRbH44HmIR5PP4VQOlw63:XrKq4oy+OzYfGfGjbaOw5EaRbY4HmaPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767004469, "uuid": "9cabb9d1-12f5-4980-a44c-133bf8e7b4d5", "value": 1245889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767004469, "uuid": "4f475096-5fd1-465a-b15b-8085ec547f36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767004469, "uuid": "c25dad14-8e7e-4b2c-97cd-d0f0a9551d94", "value": "Logitech.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476ef216-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986569, "uuid": "b95b4e8f-fd2e-4aa9-86dc-3c233cfee829", "comment": "Malware payload (Mirai)", "value": "98fda6722231a7ed6ff01c25c4be23c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986569, "uuid": "d1cf9d02-1e2c-4dd0-9cfb-86fc672e7fe0", "comment": "Malware payload (Mirai)", "value": "538b1cbce4efc20a2d4edcbb44efb71156279bed31a9f42b07e950548f7e83d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986569, "uuid": "9a1c47c3-f107-4371-86cb-c7f533d9783c", "comment": "Malware payload (Mirai)", "value": "6fa5e2eb318724f5935e993794729926fc079021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986569, "uuid": "50e48423-ef43-47bc-8a81-40fd6b92a08c", "comment": "Malware payload (Mirai)", "value": "a71b85012541bb12e7ecaa2b990b15f44e4907c8c7fc98682abaf7e9e4751837ba8a48e2ea62f619d418624c14ae7dcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986569, "uuid": "1bfe3af4-bf44-458e-bcec-d7a5d8d5b1a4", "value": "T167936C42B70C0A43E0575DF02A3F57E1C3AA66A120F8FA89790EDE4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986569, "uuid": "b34f08f9-1daf-482f-8f9b-1a59591f4793", "value": "1536:aDbQbediuZ6mJYRBNS3LJEr0YN7OQqTzp8asfFzmge2MP0l1WrSlfPp+tID:wQEI4TzGame2MCWr+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986569, "uuid": "8a759b0e-b492-48a5-90c3-e95e0f43c5f4", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986569, "uuid": "622d4ac2-651c-4672-a2c8-475c9d9adeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986569, "uuid": "4ec20e1f-28a0-45dc-8f32-0e9cb32aa4bf", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca7199a-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016750, "uuid": "edc0991f-7b65-466a-8379-fe6d3e1a1a4b", "comment": "Malware payload (Mirai)", "value": "6e505427002b40b4c2ff33e5e338e7ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016750, "uuid": "ad141c72-ce16-475d-a454-6844ba1b9a32", "comment": "Malware payload (Mirai)", "value": "53b543cbada9ca1e8274c90c479c4f070828394092ad6c319d72c54856562719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016750, "uuid": "0e1459fa-81d3-4fbe-93ef-402cd1d400fd", "comment": "Malware payload (Mirai)", "value": "3126a0b192cc8c4bc6bbae2f96bb309316be522b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016750, "uuid": "686c6924-cdaf-413d-b286-3dff8be55c24", "comment": "Malware payload (Mirai)", "value": "e38f63f846013d5e00d1df3ca1d520e3eb1ce1c281c7c74f9de56063763b18490c9561e92f6a0524fed62917e3863aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016750, "uuid": "7c4f147f-b47a-4222-889d-857728fc537a", "value": "T174835C42B30C0947D1A74DB4293F2BE093FFA55021E0B789A51EAB9A5276F335486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016750, "uuid": "795aaf07-3f06-4b6b-80db-2edd766fc8a5", "value": "1536:W3WK4HB5a//yx/cRiqLOZGHANBIQlhuTNDfSuQ7RLX:ZHHtx/c5QNmQ4kuQRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016750, "uuid": "624a641c-9adb-4262-99ba-ae7693232784", "value": 87332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016750, "uuid": "8494ad91-f1d3-4912-a72e-f4a07c1a8394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016750, "uuid": "9ab9e227-aaf8-4f6b-beea-ba467099b905", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d057d309-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017293, "uuid": "59a09065-a253-405b-a7c0-a44cba258134", "comment": "Malware payload (Mirai)", "value": "d815cddfc2834aa0a979ac4e6309e85e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017293, "uuid": "8c3a6bee-6964-420e-a28a-337680f7d6de", "comment": "Malware payload (Mirai)", "value": "53d74f7f4e8c05d8557b84764026738cb7d40c519f6c9de60558b753e95db3a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017293, "uuid": "0fde1872-aa98-473d-80ab-243b3c3cd4c3", "comment": "Malware payload (Mirai)", "value": "3f1fbd58bd82f4e0161b7624163cec9d2df6d522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017293, "uuid": "e5bc2917-ecaf-465b-b1a8-68f49c9f3216", "comment": "Malware payload (Mirai)", "value": "2c17443f1d2ecc922c23f894c5614a1a511599eb81563fe9cb5869d6b93b07a0fdf175b6edf1b0993351957825bfb8a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017293, "uuid": "0fa9ea53-12e5-4a5e-b5c0-690b720b514c", "value": "T1FA333B21B97A2E17C4D4B87E21F34724F2F6170A36A8C6597DB20E5EFF20A4460576F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017293, "uuid": "2ad1cf66-eba9-49e0-a4c3-1568c6843095", "value": "768:PKoLZeFy/aaTkT8m3Dq95rebPBSvNS+a2JokJH1OX2Mz3O+jcS/teF9:PKtS5rebPBSvNS+zJJ1OX2MzrPteH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017293, "uuid": "c95b219e-5725-4a1b-b86d-7a2cbc2fdf05", "value": 52640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017293, "uuid": "ce2148e4-8aef-4362-ba7a-62132a103265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017293, "uuid": "f0e3e764-108f-4430-ac9f-ef202345e1f0", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54709b2-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971399, "uuid": "9cda615c-1548-40b2-99bd-316a2c84d152", "comment": "Malware payload (Mirai)", "value": "a7e4f58fab49ea1335f9d0246efb15f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971399, "uuid": "e597a616-6ba8-429a-a0d8-e1d2642e3744", "comment": "Malware payload (Mirai)", "value": "546f6b0cff7aaaaa591c9d9ede8ec97df076aab9c28576c502178a66e5c98cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971399, "uuid": "ac000c56-dc16-4b2c-aebc-059b2ec68304", "comment": "Malware payload (Mirai)", "value": "d395107881a93dc3a3486e29a73fef50d76d850c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971399, "uuid": "39dd7726-697c-4e90-95a0-becfb6abda27", "comment": "Malware payload (Mirai)", "value": "101f476d34cf9d27b439a0b8fe91bc8a24b48b397d253abc0766ccc97dba82846596aa5f1a6b4486d0e544d682086e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971399, "uuid": "4190f479-f9e1-4b37-9df5-0eb8c813eb2f", "value": "T111B30806BC80AB55E5CB66BAFF1E21CC331347A8D3EE71169D145B25369B62B4F3B402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971399, "uuid": "901f77e2-5ca1-4593-b915-b5fc511c520b", "value": "3072:KDGWOcNPLvowI5tUdLEk6m5UKikCxq74IlOmVno65:KDGiNPLvs5t6T6m5UKrCxq7Xl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971399, "uuid": "6a0a5ad0-4559-4c49-ae88-73dd1dd8a3fd", "value": 111372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971399, "uuid": "a0f6b3bc-56af-4205-93e8-c35788f6336c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971399, "uuid": "213c39f0-1f4c-475d-8578-67dcac0af5f8", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bb8c06-e4ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014945, "uuid": "d911f924-1381-4a60-a602-dc2d21ef9ff7", "comment": "Malware payload (Mirai)", "value": "5539b95a8f310a416b844a43085fbe49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014945, "uuid": "7f6bc743-5405-4a58-8e58-1b76c7a6e41e", "comment": "Malware payload (Mirai)", "value": "5484af9919e16e389b039afff4e25b90773cbc6d517966daf1ad047de30f4fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014945, "uuid": "cc22d134-038f-462a-85bb-a96fdb20a18a", "comment": "Malware payload (Mirai)", "value": "1854c25a0f6ed473149428b4689293a508590b8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014945, "uuid": "fd21fa30-5b0c-4969-8f62-b89139af86e2", "comment": "Malware payload (Mirai)", "value": "fec32340fcf35a3f6cfb9b8c62e82169a46df0417e70c1eb75a159c816030e6622199b94d2aa99777f35d4ce6605d0aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014945, "uuid": "45a6dc01-c3de-4d6c-8fb1-d2fd30d75661", "value": "T14373AE3BC56DAD98C94C06B4A8B18F351B03B100A6531EF75AC9C6764047EACF64D7FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014945, "uuid": "23bd758e-6f13-4265-9e83-157a1c30c574", "value": "1536:9auwt6FCkO2Y3cXvCz8JkLoUFI52OoNCWJ0lhT2bVR:99VCsYYCo+Fe2OoNnePT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014945, "uuid": "2d96c0bc-d0eb-491a-89f2-88273c693766", "value": 74940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014945, "uuid": "035f245c-0b97-4be5-bccc-8086949e1b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014945, "uuid": "228f39be-91b4-40fc-8fcb-180a85ca246f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43151f5e-e4b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014479, "uuid": "2030f900-d65e-4447-a1c0-3856ffe63cee", "comment": "Malware payload (Mirai)", "value": "21743650934ff90a9b20585abe5a4b23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014479, "uuid": "34e95534-c95a-45f3-957e-ef55ab3fcf01", "comment": "Malware payload (Mirai)", "value": "54a35e26ad9a9c3ecf3466a249218bf1677c06b3b14318ef04b9515804d90c8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014479, "uuid": "31981d5d-20f6-403c-bc63-63dd85abc213", "comment": "Malware payload (Mirai)", "value": "46bbe3a4534c632e11ef7d3c15afd6f18f6470f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014479, "uuid": "c5af70c9-2639-4af7-ad55-c91c86deffd1", "comment": "Malware payload (Mirai)", "value": "90a33da5204dd293e1da0cc0fc830483d9c187bd37b800df7d1b4844802d751a71bcf0fac952fc4c0f83d85b4fdb8c46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014479, "uuid": "dcc6ab65-7313-4d14-b9e4-141381939097", "value": "T1B7935B21BD7A6D17C1D4B47F21F74224F2B2274A21ACCA1A7DB30E5DFF256502143AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014479, "uuid": "a9f50b40-cc17-4bf9-bdf5-a2076a9aac1d", "value": "1536:IFvXSGzDgfQ71X75DluLZeqS1ACSHsOTZGoQM3cFuL/jEqPpzm7uhl:giP471XLot2xbpgH7zmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014479, "uuid": "f577f6ed-6d4c-47ae-bf47-c265c8a06fc0", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014479, "uuid": "e0b8886a-b003-48bf-9290-df1f8aacd252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014479, "uuid": "85943705-ab6c-4cb8-ac4d-cc7703d0a6c7", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957a0a4d-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995290, "uuid": "f62415d6-fa7b-4714-a3b5-cda032a16501", "comment": "Malware payload (XWorm)", "value": "aafad8236fa316b9286e70702fc9aac1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995290, "uuid": "d82d7cce-5bab-4735-88b9-5673c6099298", "comment": "Malware payload (XWorm)", "value": "54c51f2d2f35b975a7baad024046867fac75c083ca7f781600ffea46c2e83b2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995290, "uuid": "405351c0-9b01-4661-90aa-d828d7d97730", "comment": "Malware payload (XWorm)", "value": "5caa9928b1791ca3269cd6e67d5bd9fa92fd9e16", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995290, "uuid": "5733d24a-1d9e-49fa-bcb6-dab7b658c2ce", "comment": "Malware payload (XWorm)", "value": "7c40da4917c4c427faa9b111042e4d70f7190011c0b41d92e4d8cb559f369b5810d5ab7099ba5628bf85e52c4f46c84f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995290, "uuid": "511a956a-94ca-47c5-89c0-0067c5952091", "value": "T129632CCE89F03EDD307B29942D7D6CDF6737287A1D9563C05B97B0058799CAA02827B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995290, "uuid": "b5cbc316-fa56-43e0-b397-a223093caf61", "value": "768:I8w/h62/jWs6oS+xISN0vsuIa5b5tfqRzzYSDuvRj5aGIAOVZqZFqer9uGMaHDnF:I9l/AoSSMaLBusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995290, "uuid": "eb9fd0df-ea7d-47dc-985a-2d3b22ee31ad", "value": 70658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995290, "uuid": "0057e16f-ff7e-4a50-90d7-d0b0f55f0c2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995290, "uuid": "e8976150-d1c7-48b9-a6fc-43e9f9a81cb0", "value": "invoice-1645080830.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdb7655-e452-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970391, "uuid": "41e0637a-dc57-4434-8fc0-7e174d70ef3b", "comment": "Malware payload (Mirai)", "value": "fe5f6b1ab29be073ecccec007e95a748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970391, "uuid": "8a3f7d7e-441d-4c82-ad0f-f58ac6f46694", "comment": "Malware payload (Mirai)", "value": "54f654a1118cd4fe2034a0620b28541a2a7a81e9834e2caa99abbadb55b931f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970391, "uuid": "66fdc48b-ceca-4920-b933-3f9928e4be52", "comment": "Malware payload (Mirai)", "value": "7fd5b00c9773dc3ca0b00233fcb53d8d4ceedd82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970391, "uuid": "f26eb851-e8f2-4718-8cb2-5cd38675d02e", "comment": "Malware payload (Mirai)", "value": "bc73b1b21b64b613441e707b3a856723d596ce8f93ca5c60050bf911a691218c46dd8b3fc1a0470e9dd1e2691415845a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970391, "uuid": "779c6257-5a4f-4068-a1c0-67f144ea707c", "value": "T138A36B06B18084FDC4C5C2784FBFA155C922F56C23B6B59E27C4BF263E4EF602B5A265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970391, "uuid": "977fbdec-b4b7-441a-94cf-64d9a6c5efe0", "value": "3072:rZwYmI2vjtf1Nu9PxCrfkAvRykExbs2A9:rmsAzXxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970391, "uuid": "ef26f96d-2e0d-4b24-95f1-85d04a6e2fd9", "value": 102688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970391, "uuid": "65514313-35c9-4b4c-83b6-8a0a7496c533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970391, "uuid": "5e178de1-b379-45f4-874d-7b89b665505f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e34626-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995074, "uuid": "9e28fe68-8db8-4a55-8883-fcfd21d89c49", "comment": "Malware payload (XWorm)", "value": "eb3363be1d35aa0833e862ec953faa25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995074, "uuid": "699f4dde-b85e-46dd-b764-da9ca57c8663", "comment": "Malware payload (XWorm)", "value": "558e0eb3e393c4183f4f9f66f88cb5d4b0ba6236b2a2be6debd750507ac8b9c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995074, "uuid": "6979815b-1a8e-403d-8da5-ec533d1973ef", "comment": "Malware payload (XWorm)", "value": "a33101b97621f724a5633abced5d8e97fcec6722", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995074, "uuid": "2eda9d2e-cd34-4860-899a-a5ca6881740a", "comment": "Malware payload (XWorm)", "value": "96cb4aa39abc09dc3981e1ac1c8c05b3ca2b7dc456097ef0c1ea200fffab7d41baf8fa7d0f019f16d15e3f82c98ceb7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995074, "uuid": "3b3467b6-57e8-4fec-83ac-5f1e39281fae", "value": "T121631A947D63BC45C58B93A30ECE3E6D290400974EBDE0424E5B3628E3856B54FF9A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995074, "uuid": "ab5f9ca8-3acc-4430-b9db-1fd911e945a5", "value": "768:I8w/h62/jWs6oS+xISN0v9nYj5wDdkfScBYrwz2y8kTAlGB:I9l/AoSSM9Y8usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995074, "uuid": "414ca01c-2eea-499d-b661-326d5abe5ebf", "value": 70542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995074, "uuid": "4c761824-140e-4f18-8f3b-a1c2dd455502", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995074, "uuid": "5160a011-087e-434f-9781-f8342a3327d7", "value": "invoice-1645080830.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44652edc-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986564, "uuid": "59120e3a-e54a-4add-a413-0d49c7bc0ae6", "comment": "Malware payload (Mirai)", "value": "b7be7d0de309cb2514e54475601702d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986564, "uuid": "d49fd76b-bfda-4ac1-960d-3cb1a82b904c", "comment": "Malware payload (Mirai)", "value": "559028388f6fe57ad5d4103ba5f8e1d90052cb4f1ac54511174ba4ff002ab581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986564, "uuid": "fac00404-e22a-4ee2-8277-cb1fcd732acf", "comment": "Malware payload (Mirai)", "value": "05fb50d191604482cbdfffa19e0d9499c5993672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986564, "uuid": "4d53c187-09ff-4ecd-b37a-b469f641441b", "comment": "Malware payload (Mirai)", "value": "603453f845d1c84b1314a8b414ebe470d18dc6f8254c80038c2a30943cebbc87a3421df3d2c248c454cbd8c20e0b979b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986564, "uuid": "40dc5dfb-8f1b-4e00-bf73-16736991555c", "value": "T1FDC2E151D1F62DD6F7766E601A74C2C17BB04E9EB77BCD92255CAF0408A71170705BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986564, "uuid": "67fb47dd-8dfc-4adb-9431-c335cfee5b0b", "value": "768:AG959yM0HWubJsWDYcGgO4uVcqgw09S0S:OM0HRJswYcGgO4u+qgw09S0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986564, "uuid": "ceaf621f-f8dd-48e9-8fb2-ba71c0c28c56", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986564, "uuid": "4a2d4959-e317-4ad2-80bb-8da5e29ac1c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986564, "uuid": "2ed8907f-87eb-4a1f-98a2-86f55dddc65c", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f91af7-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027805, "uuid": "fa954cdc-b979-45ba-bb70-f0ee0e7c6e2e", "comment": "Malware payload (Mirai)", "value": "f5931616f1c2d744f0ad7f66b11d8130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027805, "uuid": "50e823f4-ab0d-4384-ad15-1dbfaa6fb60c", "comment": "Malware payload (Mirai)", "value": "55addc145943b991235884ad696538c0f89552d078ab8b0616d771b3cf26c8b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027805, "uuid": "7553ae59-87a6-4187-a169-6fd2c482f2a8", "comment": "Malware payload (Mirai)", "value": "22abbee98c2c71373381721209b0ea722c70b4e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027805, "uuid": "08d068ba-c627-4404-96c0-c5f0708a7f5c", "comment": "Malware payload (Mirai)", "value": "c70bfc990487e1d57747c939491f357655eb92da9072f5f607f0931bdaea0296316a3b546409f08ae842d08796540ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027805, "uuid": "61509955-bb64-43df-b812-d23b24cad4ab", "value": "T1F8234A21BE7A5D1BC0C9643E61E34231F5F6530A21B8CB2A7E720E9CFF54550235BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027805, "uuid": "b263becc-47e2-4f0e-8160-f5be798b7d92", "value": "768:B0ZeEUuN950HPDcDLsYnTX2qPQjTVqGeO+Vd8mzte+chDa:B0ZetPDGLnnvPQ3NsEmRe+chG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027805, "uuid": "0230a646-4618-4e92-b8fd-80b8a0560501", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027805, "uuid": "f63a310d-f22a-4164-b86f-ddb3438f7cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027805, "uuid": "edc1a70f-8137-4ffb-b02c-5a1f5f4097bf", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28857ccb-e451-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969767, "uuid": "98fedf07-30bc-4c00-bc6b-287998085370", "comment": "Malware payload (Mirai)", "value": "df43bbb369cd8848672c1a436e8a953b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969767, "uuid": "1242edf5-88bc-4717-ad51-bcbd8a5c86eb", "comment": "Malware payload (Mirai)", "value": "55ea3bd834e444d80e3216e3b4f190fefffa81a2ea96214be3768dedcfe9082a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969767, "uuid": "a25c09a7-96b3-4bd0-82af-70c8da94db54", "comment": "Malware payload (Mirai)", "value": "f5a54d2c4942ca8727494f37b9323ff7740aa41a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969767, "uuid": "c23dcfeb-4c8d-4e38-a106-1ed0e136a667", "comment": "Malware payload (Mirai)", "value": "3a0c3fccb21891aadad2dbad514170b42902c1815806984edd9cd3abc873d99237cb505bcfeac1cc48941f802eae2629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969767, "uuid": "a4644332-f595-4e59-89f8-ad249c9ff33e", "value": "T16CC30886B8829B21C6C216BBFE4F518A331357ACE3DE73139D185F2427CB55B0E7A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969767, "uuid": "5e817be6-89cf-48a6-9857-09caee7a7c1b", "value": "3072:xpgEGtJOaXOSKjvG4h9MrVQhF+eTYaM4xxnfvsJYrgaFVBunz1:x2EGtJOaXO5vG4LMKhF+esa5xnfRrfFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969767, "uuid": "409da4eb-a11a-4354-94d6-a3c1b747956a", "value": 124040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969767, "uuid": "1d4d37cf-939a-402e-9966-398eb154e252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969767, "uuid": "76fd84e8-fb82-42e3-97c2-b0da46bae922", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc66454-e511-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052266, "uuid": "4b99b2a6-c2fd-4f18-9beb-d3a1617f55c6", "comment": "Malware payload (Mirai)", "value": "b02af6ede3bdc7521815f1bee64c9cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052266, "uuid": "2dea19fc-e20b-4cf9-86d5-29d03996eb76", "comment": "Malware payload (Mirai)", "value": "5620e9a8a0441ae8a31c26e6f06d8501cd24d0a7a972c9686f6bbc93442eddf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052266, "uuid": "cd894a32-efa6-4b50-b322-9ced19418fc0", "comment": "Malware payload (Mirai)", "value": "348d2e1e115df94036b4ffc6797297560c25941f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052266, "uuid": "7397dfaf-82a4-4529-a02f-7591bf4d5de1", "comment": "Malware payload (Mirai)", "value": "e27890c7cb18cd13f04a9dba5b0b046c645cbc59dd54eb28fba567cd8a45bd692b5cb7b7945377560adb5556031e550c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052266, "uuid": "c656a949-200f-4077-8888-dec68baae1f7", "value": "T1C2334BC49943E8F8DC0905362973F333A676F571112CFAE7E798A92B7C52A41B54A38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052266, "uuid": "34cb91e2-831a-4eb0-9c25-ebed14364001", "value": "1536:CQ2nAN32mlhFAIsWtGncDsy2pDZaMduxvjLcJZRB:CQ0432m7FAStVDsDpsJx7oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052266, "uuid": "21c3f22e-e84c-40fe-91cd-3086a4baab45", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052266, "uuid": "97d350b8-2820-4af7-8270-00364ecb343b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052266, "uuid": "4299d2cf-f762-420c-b558-dc3122e4316b", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd976aaf-e484-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766991921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991921, "uuid": "0f76ed33-7bba-4803-bafd-b13674c55db2", "comment": "Malware payload (Mirai)", "value": "9bcda52ccbf93c59caf6fb1d1eed8776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991921, "uuid": "78ef0d08-d3b1-4054-a645-80bb6e25fa18", "comment": "Malware payload (Mirai)", "value": "563e517bf2118e54ccfc1a7e4b3ebac975d5e6ff413bf515d6d95f77f1148f15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991921, "uuid": "e93c48ee-45e2-4796-bd2d-59cad6387020", "comment": "Malware payload (Mirai)", "value": "1cae43eed002af3faa93c2414d7ad29ccb1f6d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991921, "uuid": "8e96af32-0d74-48c7-91f2-99a78dfe8f35", "comment": "Malware payload (Mirai)", "value": "0b425ab854ac27a44d3c3b8fe1ede447ac4602564c2aabf1536a4fe0b6794b797d2b316be83c10fea810e8539c1ff35e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991921, "uuid": "06e9d7a8-f8ea-44b8-b3eb-18f1da01b598", "value": "T1ADE3F90ABF601EFBD86FDD3701A9074625CC651723A93B753634C928B64A64F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991921, "uuid": "08df4047-507b-4137-ab75-7ee2ff6a680e", "value": "3072:VOlhTwxze6mFgeIoKUFBjCn2g0dcQRnz6J:VOPTj6sdIbUFxS2g0b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766991921, "uuid": "2b700c2f-b64c-42f5-b11e-a94ec4719fe3", "value": 146988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766991921, "uuid": "110465d9-7858-45a9-9fca-17a71cc4e683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991921, "uuid": "5225c433-6ee4-4616-9e43-9595d2892aab", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4498dd-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766989151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989151, "uuid": "3d14fd34-b579-47b5-b09d-773e1cfc9456", "comment": "Malware payload", "value": "07162f9ec7fffd118eea79574a3f95e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989151, "uuid": "a4a68539-2c5d-41cb-a373-2e94d8f26c96", "comment": "Malware payload", "value": "56814b56d1cf5426f6b2a09fa9f8d2d4a944b7ecb9eacc7115c340f63a1fe008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989151, "uuid": "973f5398-490d-4ea3-a349-45ee44d94e6f", "comment": "Malware payload", "value": "145a91857d45909ba9fdf3e47c50a29ff441bc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989151, "uuid": "104252ac-9179-4cc8-becc-0c40d0c037cc", "comment": "Malware payload", "value": "9678c54bd46978537f0995f0875143f8cb20c5a9df8777220d2f9d06e202bc090e343336d2405600a9ee669adf46c231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989151, "uuid": "c04e5fc6-6309-43d3-a0bf-0818e8a03889", "value": "T1C9E53327D97B145AEB185EB182F3659A27528C52F23F2A59244BCFE6FCC7A401C7103B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989151, "uuid": "946c3e4c-de77-4241-b205-ed07dff86d68", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989151, "uuid": "0203fe4c-2947-4026-a808-f8b765df4265", "value": "49152:IDp89/efCmqVTm9j1pz5kCUvqY2pHU34Q1gOAGN6J0MiETM23p4MUhgOtIF2zcaM:ID29m7F6xSY2y3nL25vUhgOOOjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989151, "uuid": "f951bc24-d7e2-4c16-bf89-396406643131", "value": 3235328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989151, "uuid": "af8b6419-1d2b-4a35-85bf-65c0c142b846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989151, "uuid": "51b16bb1-012f-444e-8e60-2247ec98f692", "value": "SecuriteInfo.com.Win64.Evo-gen.28828414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa36744-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986583, "uuid": "2aed4d43-9e26-4d36-8f4c-c59c4a88a28c", "comment": "Malware payload (Mirai)", "value": "ce0a1e221470ee65f962959e98dd05fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986583, "uuid": "61edb25b-0f94-438f-bff2-98720f2664b5", "comment": "Malware payload (Mirai)", "value": "56d4ca6520bd235451ff31fd0ebd7d3ba97f56060edb0393c4bb1c670227cb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986583, "uuid": "cb6897e6-44a6-416d-9d0b-5d6324b6c83e", "comment": "Malware payload (Mirai)", "value": "767f7f306cb2e455efdc63acac0e34cb93c5f143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986583, "uuid": "0c343e81-1bfe-4d9a-960d-1582109a5fb5", "comment": "Malware payload (Mirai)", "value": "71130e0a40930af25fbc9059a49835dd464fb11bca992221c2d2b62d894a3bc7cda6c224b5216c481519e11357f8b9ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986583, "uuid": "9325160f-7fbe-4810-ad76-014ce0f42f26", "value": "T12F730A85B9819B25C6D513BBFD1F018E331657E8E3DE73129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986583, "uuid": "d085c422-a1ff-479a-a509-bcfa93ea17d1", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986583, "uuid": "365b00e6-985c-4a25-b497-d9a5f98940d7", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986583, "uuid": "6bf5f194-e385-407c-8542-fadead41bcde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986583, "uuid": "4415002b-5123-4ebc-ba2f-e8b53721a39a", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0a8562-e4e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767032857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032857, "uuid": "34c380e0-8c5e-44f4-953f-983c5edceb51", "comment": "Malware payload", "value": "16b112c4b8e0b51ec96185ab6c8b8dd5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032857, "uuid": "9a703b3c-0cf8-45af-9870-4a8022b5f3ae", "comment": "Malware payload", "value": "571ddf01e407ecddca1df9db3e5212f8ae76d8d3dfea292facdb862b984ddb67", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032857, "uuid": "b849b236-f9fc-4b65-a089-142e5578324b", "comment": "Malware payload", "value": "1e1a736ee11a108098e69dcdef36627c7cd048c1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032857, "uuid": "9636fabf-59fe-42c2-936e-f2ddf4931bea", "comment": "Malware payload", "value": "4396758cba3b46f195c32f2f31168aa5d2cd00dd6a1b241793b810ad86ed4f46654ff3b491ef977a6e32b27544e6166a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032857, "uuid": "e9478f6c-2d01-4d45-873d-f64cf3428d35", "value": "T1C1C08C92852CE032623A0A5FB261F0E4AD5649744BF83C91E534882021381740C0FB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032857, "uuid": "3af12f03-3364-484e-ab0a-0e9b1def85b0", "value": "3:WFBIx8sv3uy9Fb+dNMf6RyWwRAodI/bdymHgmQmk0QQHFxaFOd6HhC:/9vrbsMf6RyJAuUbYpZnoxa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767032857, "uuid": "bc51b4fe-4360-4063-866f-35e6293f6d71", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767032857, "uuid": "0da916a5-0f76-406d-a9d8-d1bc82ab6cb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032857, "uuid": "08f9d4f5-69c6-4e6f-9b1b-43cfb133d903", "value": "bl8gtmv9gg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edc5794-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766968140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968140, "uuid": "cc32a33f-848a-499c-b7fa-fdecf7e4826d", "comment": "Malware payload (Amatera)", "value": "7759e918c3483476735691e5c7236cfb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3336", "colour": "#5DFD06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968140, "uuid": "c6e5e651-2611-46a7-b69d-f05aa45fedcb", "comment": "Malware payload (Amatera)", "value": "575f0df983a4f3a513f9c27e157b8e3857a7727fd6bbcaca6614bec891712308", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3336", "colour": "#5DFD06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968140, "uuid": "4a43d3fc-872a-453b-9c7c-179ad230318d", "comment": "Malware payload (Amatera)", "value": "e2d8a747445af950fbb92f795b987d364428b2d3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3336", "colour": "#5DFD06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968140, "uuid": "848c3ee6-78b9-43fd-958a-b6720e4cde54", "comment": "Malware payload (Amatera)", "value": "da9da6a90ca6bdd380c871bb34fc054540c4a8efa23ab90e41fa74be3ec6389fe6a0bf40ea0d6bab7ea6cc7f0041dd01", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3336", "colour": "#5DFD06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968140, "uuid": "bff8d29d-df1e-46ed-ba42-191064b137a5", "value": "T158E6334B81BD97E65BEE801880C6346EFB28969DF1F6D334225A4B3374348E15BD1B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968140, "uuid": "0c5a2677-6771-4d10-bfc3-5ca7c0b609fb", "value": "393216:vK13MeXd08cHgKnga7HoOQn3WVl3Kd7qk7:vA08hKn17HoOQQl3k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968140, "uuid": "d4c88ebf-dff3-417d-88aa-d04d3ed82459", "value": 14754979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968140, "uuid": "23226095-5789-4ab1-9300-b5c5a48ae18c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968140, "uuid": "38817699-4b66-452d-8f0f-0635d64ef085", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4741a49c-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982274, "uuid": "063919fb-d2a8-49f8-bb9d-6267240206c1", "comment": "Malware payload (SalatStealer)", "value": "e184aadd2d66ffef3e4740960e5fbf89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982274, "uuid": "9679a4a0-977c-4439-b727-c2e9c30b8551", "comment": "Malware payload (SalatStealer)", "value": "577c9ed16d1744f86fbfd048d375b6325dcbd48eef47151abe0d72fd3c6aa6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982274, "uuid": "0390266d-2d8a-4523-9dfb-0d32e3628688", "comment": "Malware payload (SalatStealer)", "value": "2e5866d7e2288d7d61bc87b8318ab2d0bdbbaea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982274, "uuid": "647899d7-e347-40fa-a585-2dd8e715000e", "comment": "Malware payload (SalatStealer)", "value": "099179951bd21db0234aaf38c74260c65da392d8c4befe859d00a954b32ddff920b3af25501ebacd1fc0ca011ad02b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982274, "uuid": "9feb905d-a886-40e3-947f-365bf6fd11bc", "value": "T115D66B01F98B46FAF90B593140ABB23F23315D118B28DBD7EB043A3AFC77691197A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982274, "uuid": "7c933704-6e1f-429e-97ed-0c77302c400c", "value": "98304:NFnaoCKHqRHWgNjmDk/F3dIUuAYBShaEA:DC/NqwF0boVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982274, "uuid": "4d96d0a2-d0b5-433a-9593-8c672bb44f91", "value": 12825088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982274, "uuid": "1cc04461-151b-4bc6-8dfb-6b4fdcbb6634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982274, "uuid": "7a4816bf-387f-421e-8d5d-6bd21d603b13", "value": "577c9ed16d1744f86fbfd048d375b6325dcbd48eef47151abe0d72fd3c6aa6a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90229bd3-e4ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1767015038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015038, "uuid": "ccc230a1-2e1f-41e8-a130-6a7e0d82f321", "comment": "Malware payload (Formbook)", "value": "1d89decef997cc594c94c945b34c4e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015038, "uuid": "02587ab2-3139-4b12-b1c2-3b2e0c74788c", "comment": "Malware payload (Formbook)", "value": "57921406ca94ade5d1dab7e0345fa206f2e47ef73791fd205eb68b04c97afd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015038, "uuid": "db2c19b2-f1ce-45c7-86af-616238c46e08", "comment": "Malware payload (Formbook)", "value": "368c0dc0a8b08e72823bcccf30becad83fe19628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015038, "uuid": "31327fda-4a7b-496e-a8cf-be28ac4112bf", "comment": "Malware payload (Formbook)", "value": "f322f4133d0623fdf225715a40854b0feebd88794527bf56eb5343abda9e3aab0b64d387d630b31e54c16d797e3b0607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015038, "uuid": "5a57dc5d-c72f-4c5c-aad1-e4c67213eab9", "value": "T1B825DF87F1C4E512D8428EB03A60F9B0DEEDACDA9C0DD597ABE87E8F3C785155A63011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015038, "uuid": "adaf7ab1-5f3d-49e0-a6a6-eb4d90f9b221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015038, "uuid": "2a7a61ad-dffe-4a84-bcb2-a7de3f548824", "value": "12288:EKD0W8Bc6LjpOxBuGKcUkGCud68qVOHUseKI6h4uxN2GB4MgyE/sJWUHfbV:EKYWx6PpOhTGTvlVRzZosIU/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015038, "uuid": "39e06efe-8c53-4188-8614-00d1914e49c0", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015038, "uuid": "60fbfb4c-bb76-4906-935d-8f0f31ad1565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015038, "uuid": "7ea0f828-f507-4657-9114-817e02d0ebdb", "value": "Payment_Confirmation 900120252965 Remittance_Copy_2025-12-29_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d1ad8-e4f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040226, "uuid": "50b28fad-0e97-41ca-adb7-2b9352ed46ca", "comment": "Malware payload", "value": "09d23ae331db4625df08192fbce2e270", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040226, "uuid": "e69bfe51-f749-4b97-8e65-865de61dcd3d", "comment": "Malware payload", "value": "57a0a81eebdf6c1e0a5ab0489165f167856712121b86959f0c34ce5c24014266", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040226, "uuid": "0156a9b8-979e-48a9-8bce-46f8b73fd86a", "comment": "Malware payload", "value": "4501152ad4f7ab94c6a35c47d878d89ebebd7d3f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040226, "uuid": "245d5c8b-31bc-4396-92fa-dcd719a9b6fb", "comment": "Malware payload", "value": "37fe182dc3708d38922d52a211a8333c16f29d573e65598da457c699b04510ffa309ae4611fc10e60363a623d82329cf", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040226, "uuid": "9ec107da-9527-43a1-b302-89ddb2f9e057", "value": "T1B3B5E045BBA89E1EC877D0320D4A5635A55AEC23C703C387EDB4275928AF6F44F017EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040226, "uuid": "2330fd5e-6755-4db9-b512-9003db452197", "value": "49152:6YRmpTrwTMCH++RdGM+kthvXdsumQzQLhdWj6VdvPOwqqgYlLJI:6YRmTkoM+Ghu3rVJPogI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040226, "uuid": "a002ede1-bd0d-42e1-b763-ce05153e046a", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040226, "uuid": "7af000b5-54c5-4532-8554-ed7f11b21d7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040226, "uuid": "ad722ede-2d50-4f5a-912f-0f117d7c9165", "value": "Chrome (7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1df6a7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995165, "uuid": "732518f3-4bae-48d5-9319-c48e16c14146", "comment": "Malware payload (XWorm)", "value": "af6b286a88cf92b15d9fce640afee27a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995165, "uuid": "f3a31451-a6ec-438e-a6b4-4491f07dc3b0", "comment": "Malware payload (XWorm)", "value": "580ff69db45f48851af8f78938e1c986ac966978e615833bf10f670300a8b869", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995165, "uuid": "64922cbf-bd17-484f-a291-7a2aa9d4d645", "comment": "Malware payload (XWorm)", "value": "474457526f5b2168a527e02f1034406b7549cfd9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995165, "uuid": "6fec4b31-8d29-4cae-91e2-aa93bfa9e05e", "comment": "Malware payload (XWorm)", "value": "439dd7d4cc4c5efa4147b0d75a05f1a6328856d89b877e83aa6ed61e0a1f54a8dfdb0ba56997fbea9645185f0d396687", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995165, "uuid": "17b71300-666a-474e-9992-4b40aacfd74c", "value": "T1D373FA8E952AB8BD1B625117F7BC1BE17A0704B6DFA154CC3DF4493A70C4F6E082A16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995165, "uuid": "dff5ff30-839d-4beb-8bf1-a9dc204f5ec5", "value": "768:I8w/h62/jWs6oS+xISN0vBa5W3UO4itCQnpfUm7CwYoTwSkqYVnlj9hXS6XjoLS+:I9l/AoSSMc/usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995165, "uuid": "e01aacdc-a956-45ba-a884-2a08f5b5a0b4", "value": 74335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995165, "uuid": "149955fb-f209-4558-81fe-e4b8cb265ea8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995165, "uuid": "69d9df91-31d8-4d7c-89c4-981fa2a17046", "value": "invoice-1645080830.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49fc41b-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051687, "uuid": "2a609484-40cf-4585-8cda-84c621a1ae21", "comment": "Malware payload (Mirai)", "value": "dec8d5b52872172a4a1ed0d473adbd38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051687, "uuid": "c0b00457-6f8b-4493-9eb9-195ad3b9a787", "comment": "Malware payload (Mirai)", "value": "5855bb1802fab588d0ea3a6501675e616aca80731a416d055dd0d6198561d828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051687, "uuid": "3455955f-b816-4087-916d-03b9a8908edc", "comment": "Malware payload (Mirai)", "value": "6af0e50a0dc962ac965753e74dd04a7feeb9fbf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051687, "uuid": "dda44021-8203-4082-9de8-1eaf41342d74", "comment": "Malware payload (Mirai)", "value": "cc96f7a735fdeccd76586401dc36d9a5538f0f5e51810872f499020208b22f998a5190281794c98f73b760afe2ce6f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051687, "uuid": "31b16cfa-a2f6-491f-b786-32a99bf33647", "value": "T1E5175C47F4E218A8C4A9C570863AC226EB71784D473573FB6790B6302F33BE15A7AB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051687, "uuid": "b1eeb74a-72af-4213-b621-d458edc9e2fb", "value": "196608:G4j6Unhy0ClGh+TP3FYXLUC4kj5yIrrUUcs:GwJy0+3yXL3jAIrwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051687, "uuid": "1c1b28dd-baf7-4a5e-9a82-90477bb93d90", "value": 18978736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051687, "uuid": "9f4f07c9-6969-478c-8822-1b4033cbebea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051687, "uuid": "bae824f7-ed48-46b1-8752-6ad93f6e4cdc", "value": "dec8d5b52872172a4a1ed0d473adbd38.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff4863-e4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (TrickMo)", "timestamp": 1767011717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011717, "uuid": "7776e526-0a77-46cc-93e6-122a17e02111", "comment": "Malware payload (TrickMo)", "value": "002b1355f71bf64b692f4183342e0f4b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011717, "uuid": "5c2512b9-da53-4698-958f-4f7ef7c0cde5", "comment": "Malware payload (TrickMo)", "value": "5885804ac3fbd9a06595b9314b77898747b2f9b8a7624f72d402f5d5c5baac68", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011717, "uuid": "9f5a50ad-7bce-49fc-a593-7b0020c0d905", "comment": "Malware payload (TrickMo)", "value": "5ce451a9dada4de4f3185326dd80f324fdd128f4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011717, "uuid": "12c1280f-4d8b-416c-b276-057cd0d445a1", "comment": "Malware payload (TrickMo)", "value": "da8d5d61b926c31b841c76d1ed1cc30026eb0570c757fa18b146f53eeecc9b433d700776780838b1154ec3eb4d692138", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011717, "uuid": "ff2577cc-da2a-45a5-9865-91d4a9d5bf4a", "value": "T191D6125AFB45B59AC1F3473385B5A23211478C664B83D6D75D18F13C88BBAF08E4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011717, "uuid": "6ee697e4-4d25-4998-a8bc-5f6f1f78f423", "value": "196608:nGBLVtJy2IuKQQqdHDKHPPZBiIa/B9OiaiVU61FyimMIJzn6blApzBtkt:oL/JXIuKhqgfiRncWDIR6blAdX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011717, "uuid": "7ec46932-07be-4a18-a847-b3437e73fd91", "value": 12693182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011717, "uuid": "cc7b92f7-9ff0-40c7-a548-f5a88c2e86e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011717, "uuid": "11d70c53-3722-4c71-85ec-f32ee26b1496", "value": "tiktok.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983d5582-e451-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766969954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969954, "uuid": "53f50698-8f7b-4dd6-8b24-6e1b1ab7ea40", "comment": "Malware payload", "value": "94b9a4cfecd3907932b0ac1076239aac", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969954, "uuid": "d2cb2c5b-1387-473f-a54c-95a658ee01fa", "comment": "Malware payload", "value": "589e61cac39b00e76a88c73fbcbdc8ec687a14952b9a9cbc4d5cac54bb6b34e9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969954, "uuid": "63747bbc-f464-46c3-9295-33289f5e8014", "comment": "Malware payload", "value": "6872c8cadccede5c893f3dbc6f40178b094740a6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969954, "uuid": "3a695b25-9755-4408-88db-acfd0ac23f0f", "comment": "Malware payload", "value": "df67bc7180433d348e39be869d5acd1e7579c49e78009d398bf53f6e7eedf2bbcde027ef385f4b02da17b94048e0a6bf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969954, "uuid": "6d11dd24-bbf9-4655-a756-3a94e777683f", "value": "T1A1E1D896ADF32409601B506DCBBEA2587069905B874ACD5CFDCC72A8DF4C2A84622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969954, "uuid": "e47365be-4c9e-4da1-8ba9-0ea615b6ff7b", "value": "192:OZQ3gIE/CTK/eyu0llHYoHsfOBro2Tc/OcSmy:Osu/dfYoHsfO2/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969954, "uuid": "7766ffdd-1b5e-47f6-9cdb-4fa200069772", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969954, "uuid": "9730fef2-a6e6-44cb-91b8-db6134c69524", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969954, "uuid": "14025151-99a8-4821-b3ce-94b461096568", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241c2a9f-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030748, "uuid": "3037c37a-8d6c-4e80-bfee-254e2dfb6450", "comment": "Malware payload (Mirai)", "value": "3bb982b35133853e888f35359e153b3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030748, "uuid": "6361ecba-da1f-4a35-a729-999b4494a608", "comment": "Malware payload (Mirai)", "value": "58a6e77d4ba60fb894d2889c7c797a554a5568532ffdad55f4e83e866c6e4f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030748, "uuid": "f67f84b5-da95-42cb-859b-81b72bf31db3", "comment": "Malware payload (Mirai)", "value": "f1de6fdb0961b1079c7db23128cf5f31d1bd8787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030748, "uuid": "fb1c1a50-684c-48d0-86cf-332a5013ed74", "comment": "Malware payload (Mirai)", "value": "ea1ede11fb048ccf2f854e8d0487b678973cf95703afa78fc532084e1957208a96c9250e1120e2018087be2acb508895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030748, "uuid": "9a3620ae-fde9-4943-8242-a53673a9bcee", "value": "T18C241945BD918F13C5C222F6FBAE418D37166BB9D2EB31039D216F60378A99B0E37611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030748, "uuid": "285b1cb2-9995-4c2c-8641-09a15680fbb0", "value": "6144:CZk+S6FntPKLCR58DOic4XlOgA7aXX87y:CZfS0tPKerOc4Xgl6X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030748, "uuid": "0be350a1-be0d-4099-bb76-1f185df0f691", "value": 222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030748, "uuid": "f96f5910-da4f-44d4-85a5-f6f96f6a619d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030748, "uuid": "0c18eb04-f16d-4f98-a497-4de2eac77953", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56b685d-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966674, "uuid": "fc24f477-abda-44f8-8d26-0004091804ac", "comment": "Malware payload (Mirai)", "value": "fe79ba48672dfff025f3c801aef48697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966674, "uuid": "f347171f-60db-48b3-83e8-321f82e2d975", "comment": "Malware payload (Mirai)", "value": "58dc85c3d4cc0d1962309af1aebae302cc60c15006eb6fc30549c27bb0a5b23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966674, "uuid": "94dac427-25af-4a56-a4a1-b03bec935e93", "comment": "Malware payload (Mirai)", "value": "dd3018f5f08f8748d06e9727df2387290eed07be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966674, "uuid": "d4b0bb04-0b8f-4a74-847d-098c39ad1090", "comment": "Malware payload (Mirai)", "value": "e2d5dd44897d256bc65c7d070a1894514e88da402a73ab2e670578ace9071acc499b8c35a5577ba40377eba169135dd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966674, "uuid": "1fa7da6f-54d7-4701-8bcf-64f0ec874edd", "value": "T133934B86F400DCBEFC0FD67B44970A0AF635A3610E820F267757F967A9760D4486AEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966674, "uuid": "9ec85f82-85d6-4597-9a7f-f6da187a0908", "value": "1536:Hj6O1YGElDrexG4gEV6HzN+0tdnlouwZ8iwCDHqYavQEMPXnU1OWyohcFocPJG:H+O105ruG4gEV6HzHblouwwtYFECayof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966674, "uuid": "868feb8d-93ff-42ea-9a18-0320a7862149", "value": 96552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966674, "uuid": "fa507958-ec62-423d-bb05-e4881706eafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966674, "uuid": "a2d99851-a408-4e13-adf1-2cce59f95c58", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05a05b9-e456-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972196, "uuid": "7d93b016-cf78-4690-abd2-d65eb82f2bdf", "comment": "Malware payload (Mirai)", "value": "e03291e8441d0ed259b98bdf6fb4cfef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972196, "uuid": "80218433-636e-4a7b-a44f-f964a57d1a3b", "comment": "Malware payload (Mirai)", "value": "593a8d3668503b67abced8308488e6fa5b00b216b5d617891a7b4350d309458c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972196, "uuid": "b73d9ba1-5097-4f42-a17d-31802e925f0b", "comment": "Malware payload (Mirai)", "value": "de20fe3f3d4856e4a24ada76113c152448d44616", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972196, "uuid": "f9b51b12-55c2-477b-b389-6f5fba22f048", "comment": "Malware payload (Mirai)", "value": "bf52721a97086aa3a90a8fba2ba67cbd0d006ce2f34d471043f1c05cb4245dc96a593c1a656c95d1231ea92073307689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972196, "uuid": "0eb829f2-a8d6-4924-b820-968f938e77ac", "value": "T16883C80E2E228FBCF7A9C73547B38A25979877C627E1C681D15CD6002E6074E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972196, "uuid": "c86701ae-e8bb-4c3e-82b9-067ecae53c36", "value": "1536:Dfv4Hz2YR7mLKo6NOEgUxxTq7eDERaeL2ZuIH:T4HaYNmLj64EgsTq7eYeZuIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972196, "uuid": "dfe41890-b9a1-41b2-b535-154da105a474", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972196, "uuid": "04e36d2c-667d-424b-bc06-8f9975de4183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972196, "uuid": "74932b78-8f87-481a-83f5-4251a3ee36a5", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785e75cd-e490-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766996959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996959, "uuid": "2d2d68f7-91b6-47dc-8d58-308910575b55", "comment": "Malware payload (AsyncRAT)", "value": "a4c92ac287a2644d5ffe42e0626565dc", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996959, "uuid": "425ad1d9-ba33-4e58-bc7a-d7fb2c9f4b0c", "comment": "Malware payload (AsyncRAT)", "value": "599196973f4edfe03a56347f760dd830d5d7d57eda9919516e8b1a2434c1c7e6", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996959, "uuid": "142edef2-715d-4554-b875-eb0235e9bcf5", "comment": "Malware payload (AsyncRAT)", "value": "8bda3ea1bb21a190a1437ef2d0ea673b86d1bd5f", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996959, "uuid": "860ec88b-7f60-4aaa-beb6-a8d13b040f4d", "comment": "Malware payload (AsyncRAT)", "value": "5d49a50c89782ba07903ef7eef906c3051a997309e7e2aa2d95ef982478c508536d3746a8008e27fa62aa2ab0357ebe8", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996959, "uuid": "64ea45cc-7ddf-4402-b4fd-a23ccf22e417", "value": "T1E336BF8673C47EDAC505DD7A6714F63281A3A9338EBB90C96D97C30A4ABAD510F3DE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996959, "uuid": "81476d4c-dcdf-42c4-a297-ddf5c051a4f5", "value": "7c3c7245b0816261a6b02e9530dee070", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996959, "uuid": "cee195df-3599-4b08-95b5-dd676a0b3c2f", "value": "98304:ok/6BGxvEsoISjqR/3gDSfk3KLVDhxpULC6JMAelLjK3GnZobHiBrNxC6oOFE15Z:oy6BosMSQ3MRMVDcheAU23GnWbHiBrXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996959, "uuid": "301d4fa0-62bd-410f-aa4b-2dffa20ffd1c", "value": 4884992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996959, "uuid": "0157fdbc-ade5-47ee-8d18-e84d25b3a9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996959, "uuid": "b8dcf376-4e29-4de8-8b11-ab49930353f3", "value": "libfzclient-commonui-private-3-69-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e9092f-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051311, "uuid": "27f986d8-3fe5-43ef-b5c3-c23293ccfee8", "comment": "Malware payload (Mirai)", "value": "dd9646be2709a524f0f26e4fbae742c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051311, "uuid": "0192285b-e046-4250-9851-93ffeddc1602", "comment": "Malware payload (Mirai)", "value": "5a831e40d0886ca5a592fa31d4a668e1b464aecfe2dfb6655fa3dafd0a45ae1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051311, "uuid": "acb8bd23-aa48-4908-8933-274c0f82abad", "comment": "Malware payload (Mirai)", "value": "af553e997fd98a0c863eb1fc1ac94c025618bb64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051311, "uuid": "7399633e-af4c-4ef3-be7c-c999d59e0ad9", "comment": "Malware payload (Mirai)", "value": "f35b036bdc4160c7c158a969115fdaecd0ad81a98ead06ecd485b67536c8e07eec5cd182df7af5b7dc48a43d6daff7a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051311, "uuid": "a42b0098-37cb-44b8-9df3-53353cb7b1f6", "value": "T12593D292AE43DFB3E45310F042B79F658E31FC3A1C36D586E76ABDE18A114C1A616329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051311, "uuid": "ad308b39-48a9-42e4-9e65-c2030dad5184", "value": "1536:DqcU+D+MJmCowjJ5cHEfSWYQnf750neSoNqR4xuUvq0q:ntDowlZxnf750e2be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051311, "uuid": "afd7bad4-8489-4675-a5c6-4754e578b8d5", "value": 93940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051311, "uuid": "d266d620-136a-4efd-be79-ea351591ca85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051311, "uuid": "6874ce3b-a6a5-47c3-97d7-3de02bde702b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc13dfa-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995195, "uuid": "cfc8bbd4-f58e-4a22-8d02-91e66bc6e3fe", "comment": "Malware payload (XWorm)", "value": "412a126ec6d830f2dd6990a258172330", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995195, "uuid": "81d08913-830b-4117-a666-22a79685dc48", "comment": "Malware payload (XWorm)", "value": "5b8eaccce76ee41857dba1c3bf0985dafe2f97725c031dda604dd871e137571d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995195, "uuid": "59cc186b-3924-4292-ac07-0cd54fb425b6", "comment": "Malware payload (XWorm)", "value": "49733a6f69c6ea4f8400dc3256896c9e46c821f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995195, "uuid": "81e05370-f96a-46ef-8c37-4ef6805662fd", "comment": "Malware payload (XWorm)", "value": "3fbbc67598f118af8c798f62b987ad7e7aa0fc600113934df90350bd4ad9799122a1cf3f6207ee7327d22accc5301782", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995195, "uuid": "dda7aea1-ae6a-433b-8cc5-57e6bc09b834", "value": "T1636319626DB2630734DE896DCB070EB22D95079D68EB8654C846C71DE02CFD8B7D2F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995195, "uuid": "617da13d-2cba-4c9f-a7d8-5cafe25869e5", "value": "768:I8w/h62/jWs6oS+xISN0vEdNtQ1dkfScBYrwz2y8kTAlGB:I9l/AoSSM2gusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995195, "uuid": "239751b4-6781-414d-bb0e-19a10ee0e203", "value": 70619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995195, "uuid": "9c4dc48e-3820-4eff-b6e6-fa7b29ec25fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995195, "uuid": "26040bb5-93da-42fe-a32f-afae9a3160a8", "value": "invoice-1645080830.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf4cce1-e481-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766990685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990685, "uuid": "b294c3a7-df8f-481d-9d17-8cc2d22f9cab", "comment": "Malware payload (Mirai)", "value": "94e04ff208eb077dec7deefd112b7c8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990685, "uuid": "79a33e6c-e1c2-4a0b-949f-7effc2385fbd", "comment": "Malware payload (Mirai)", "value": "5bc881ba00ef3da272a1c822c6016b3ed3e29a0a2b8bdf8c681fe87aeb93643b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990685, "uuid": "b15e9942-dd3f-46a6-b7cf-bc7f7cd01070", "comment": "Malware payload (Mirai)", "value": "53b2b56a98d76152a1beafd4c7332a4655a51bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990685, "uuid": "95a1e423-5f52-42d0-a40e-dc2a9e974105", "comment": "Malware payload (Mirai)", "value": "404adfbadd785bdf210c02970f224315072ace8f3809e1a8abebb86f2a6660209a2af323951456c9241578ac3bd44d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990685, "uuid": "55b7e65c-9c94-4800-a942-5bf78b2e0575", "value": "T14D938D73CC396E24D128C675F0E0AF799753B55084871FAA916AC37A9083EDDF8493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990685, "uuid": "76a6072b-2e05-4980-a865-b5ff227ddf9c", "value": "1536:t1lApIzWcp89r5vqJnzMxKvKiZ4gYU0FfEsCokrgOPmLnzR:t1GpK+lNqhzMYvsgf0FMscUQynzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766990685, "uuid": "923501c4-17c4-4ac4-b22d-fe17cbaa04c7", "value": 92700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766990685, "uuid": "fd8cb4b8-6cca-4e4a-8855-70488e79b2ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990685, "uuid": "0d437fc0-58c3-4417-bda1-af0b0e68c691", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890ab22b-e4b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013737, "uuid": "7a03ab63-5fcb-4607-b20c-5cb03299d719", "comment": "Malware payload (Mirai)", "value": "b5c402a0056a996755327b208714ed34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013737, "uuid": "608105c4-7ca8-487c-9f17-2517442cfab8", "comment": "Malware payload (Mirai)", "value": "5c2dc63066b1f4f013436233f88d8926ce3e810c79693bff490df1142e83f297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013737, "uuid": "0dd1f9af-0073-4bce-9718-4f9b2838ba05", "comment": "Malware payload (Mirai)", "value": "e5a1d1d1307a3c711d9ec436702504c6b982ce91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013737, "uuid": "26c591de-b29b-4340-8d25-ca0ae6f8e79a", "comment": "Malware payload (Mirai)", "value": "1aa91531e08fbe53bb8d9feb40d28e55babbc2ca91b9c085940168fe10ae081ef8b4dcf088f0c30bd19d5d6dc2cd72d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013737, "uuid": "69f52acc-a5a6-4ffa-9579-67951b880eab", "value": "T189834C86A401DD7DFC4FD2B784570F11FA28AB511F820F2BE667FE97A931098491ED82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013737, "uuid": "31dacc14-d610-4af9-9e7c-3130a25ff796", "value": "1536:U8eOiA6Z0zF0HM1ZSvY/3HuR/24Cd58u5bGXbxlZg0MVfN7d/ETPj:U8eOiaF0HMPT/e2xVbil+0MVfJRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013737, "uuid": "1e0a8afa-0c08-4848-8db8-b7d518d88d45", "value": 82176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013737, "uuid": "9d0a2164-8f10-4f56-9604-11d174af4591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013737, "uuid": "783cbbf4-9d86-40a8-bfc7-d5f1b522facb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd84920-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (GootLoader)", "timestamp": 1767016831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016831, "uuid": "ace4fb84-91a1-4a6d-9c86-2ca080b67c96", "comment": "Malware payload (GootLoader)", "value": "85d021cd9613ba334fd7f2fdc61062cb", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016831, "uuid": "5905642f-ad4b-497b-9b15-4fbb99e55f3a", "comment": "Malware payload (GootLoader)", "value": "5d6433cc03d11daac1bba2d54ffc6294cba8fb5962e7586a377bb98e0841d8b4", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016831, "uuid": "c6d11904-ed26-4f5e-95e5-83b7a40a04fc", "comment": "Malware payload (GootLoader)", "value": "1e20009a60fb833013de9a9bcb2a0be92887a32d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016831, "uuid": "2691acbb-10cb-4e2d-9350-1a21d3744c8d", "comment": "Malware payload (GootLoader)", "value": "e03609ca146d6bc576a941184e5d5da173b909969f860f662e82f97e103ce321fc189171a9897e8c2fe1c00e8997fa25", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016831, "uuid": "29f05155-a863-4777-8c2d-d104d3350203", "value": "T1F08712236AEE944AF8F881603B4A46E5F5B0DB3974E15B64D133C7EB12231B6CE40677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016831, "uuid": "d121eb4e-6d42-41fb-b534-0a80fb057f51", "value": "786432:v111111111111111111111111111111111111111111111111111111111111111:v1111111111111111111111111111111", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016831, "uuid": "3f9cf962-1e39-422e-bac0-65ec8645d2a5", "value": 36187925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016831, "uuid": "a3ea82ac-fcd6-441f-a1f3-b215c4018b3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016831, "uuid": "6c4294c6-dfb0-4898-8e14-6dd524480b6a", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc3ebef-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997777, "uuid": "4ad4750f-8b18-484c-8bc1-f2fd13ec21ce", "comment": "Malware payload", "value": "43e6d90a3eadb24b0aa1a34f4838fe55", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997777, "uuid": "2b07a6ea-3dd9-4471-8a60-f5e59e6b947c", "comment": "Malware payload", "value": "5df15adf323dda617cc8b34922f1ac9ce0084f78c573aae50bb21a18c07786ff", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997777, "uuid": "60b8df28-992a-47f5-b829-201853f06b01", "comment": "Malware payload", "value": "23cffe70679d7317bbe62b827850fe0693b57f8e", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997777, "uuid": "29da9435-bdde-4146-933f-a4dd563b8747", "comment": "Malware payload", "value": "56e11078684685c6975f18e0264a82f8509533f44b6c2b7f05f1810a89089d230fdd4eb4b429a34366491dcd50ed0c83", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997777, "uuid": "531db7ce-6c55-4350-88b7-e27cc70bace5", "value": "T12B71324B31E1727487034379427F6199312E856B260E6D18FCFEC2457F29B254BE62DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997777, "uuid": "0875bf9d-ccd5-482b-9b47-db52469248d9", "value": "96:kUSwgCoWGNmyzrIvfiO0NNakZ8BciRDLTyhiVP:l/cN250NNazBci1/yhiVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997777, "uuid": "c1d7dfbd-dfc8-4407-9e8a-48baa624ea24", "value": 3797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997777, "uuid": "a4088d17-9c5d-4e5e-b931-827f27199967", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997777, "uuid": "65be0a52-65a8-492b-820e-c9ce8971b4bd", "value": "5df15adf323dda617cc8b34922f1ac9ce0084f78c573aae50bb21a18c07786ff.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa9bf7-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968056, "uuid": "e56a97c4-e040-45bf-adfc-b1e3dde2647c", "comment": "Malware payload (Mirai)", "value": "997f8120d88bd7a2ddba6b73b6c6021a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968056, "uuid": "25a3b665-0a12-4e74-880a-c6462a411f20", "comment": "Malware payload (Mirai)", "value": "5f0d4f401d41c36a0fbbb3acd04cc404efb646a48e1aba1c7276a04dd7d39efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968056, "uuid": "23a283e6-da91-43b4-89ef-e2fd09e48f0e", "comment": "Malware payload (Mirai)", "value": "2157fa694c2cae7b420842cc9d514c7751b960bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968056, "uuid": "f7703603-8002-4b6e-988f-4e0447f504fe", "comment": "Malware payload (Mirai)", "value": "2c6b190dec9144e94fbecbb3fbdeb0c8a9abbcc467c937aadc26d0e82e5ca228e918bbc662ba834d4b8aa1414a2e6346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968056, "uuid": "112bc070-c459-4bd9-959d-e0f7da648be6", "value": "T19F042846ED418F11C4D622FAFA9F414833536BB9E3FA7102DE245F6023C6A9F0BB6552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968056, "uuid": "393e7422-b29f-434a-9d47-c26ebd1ad7a6", "value": "3072:fIxOMRYYnOLTkTeBJ9F6RAhaLMQta3vqTJHVsj90dqj6hh13mYlf:fIxOAYYiTk0J94+haLMQta3vKzsZCqOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968056, "uuid": "7279988e-07ba-43a1-bae7-f7cc8074abb8", "value": 182688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968056, "uuid": "ab75646b-6829-4a9d-95ed-82b4d99cb7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968056, "uuid": "6910fbbe-84e4-41b7-9b8d-851863d7f7a5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87c982a-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011347, "uuid": "2e94e6d9-98fc-4f26-9545-d5a87e2416ee", "comment": "Malware payload (Mirai)", "value": "0228739a5f4b6b3bb77a3b642b7192cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011347, "uuid": "13dc967a-a354-4537-911b-6778a471e494", "comment": "Malware payload (Mirai)", "value": "5f1c29155a119e4ab6df08daad04ff95cadea3508c83b5842d8b12a02ce7abb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011347, "uuid": "d29e1b54-d1a7-4b32-9e40-32ffe5483770", "comment": "Malware payload (Mirai)", "value": "2505a8c3abb471a58c2d87c511674b10b6394959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011347, "uuid": "98be424a-4d28-4fba-bd9a-99f7ecd17c0a", "comment": "Malware payload (Mirai)", "value": "657215f7cff1a80375dd4f03ef37353459b812080c638209ef05d267f073b7e65891868a693f493a15856d06d9f642fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011347, "uuid": "8b669d2c-8491-44e0-b8f6-499788e11c00", "value": "T132F3750A2F228F6EF669877047F74D305B5876DA26E1D684E1BCD5402F202DE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011347, "uuid": "69281757-670c-482c-a01a-a1f7a8a2fb1e", "value": "3072:vVHGk0tK7Ri6FWRuiPiCYh7Ifs9wHyNQjAJ:vVHGk0tK7Ri6iw7/9BN0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011347, "uuid": "60362221-1dc1-4285-b030-c7ef7b13b5e6", "value": 170728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011347, "uuid": "06674966-cf60-4535-a189-be1b99bec408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011347, "uuid": "7caafc9a-cb50-4716-a325-5d03d672df2b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeee177-e47d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989019, "uuid": "abc43648-e40c-4ca0-97f9-8afa4aceca23", "comment": "Malware payload (Mirai)", "value": "fccea45f7546a8ecfb5bd9db668b3526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989019, "uuid": "62bdbfbb-65d4-4a42-b4f5-906d2c3a1a56", "comment": "Malware payload (Mirai)", "value": "5f31b55735c7454fcb57065d07ab86cf800da713fcccd80fdb9f759f5b454d13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989019, "uuid": "c9577afb-dfd3-4118-beed-5126f871319a", "comment": "Malware payload (Mirai)", "value": "fc0d3a5d78c54653b7310cc543f0fd60f7edb2f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989019, "uuid": "a3d6218f-fe38-468f-9390-86e1cbf80e4f", "comment": "Malware payload (Mirai)", "value": "3353564f2ee40d16c2d3db7a8d7e265d42b4ce95b057d41a6ba313e6eaa381990c58d701ca730943ac1474b99579fea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989019, "uuid": "bcfc4bc9-21bb-42b0-b102-1ff8727650b6", "value": "T11B830853BD808F5AC6C4167EFF4E52AC77564394D2DE320BBB048B52378B02A1D2F65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989019, "uuid": "6e64552b-01eb-4f3c-98dd-66a38ec6b9b4", "value": "1536:H8Vt95wC3V/33fxik9mIEkMpkaolcYHdCKg8nF8VR15vk:cT9z3V3pi0EfploNHdVg8nF65vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989019, "uuid": "b3063378-cb57-42de-85ae-c7df90d6bf50", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989019, "uuid": "f1d82214-6497-4085-8bec-99009a238092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989019, "uuid": "9e414ac2-d0d8-473a-aec0-7b858b24baf1", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddca0f0-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031006, "uuid": "b467b34a-c044-4046-a9be-d4310f545302", "comment": "Malware payload (Mirai)", "value": "377075581f9eb2d35dc23f3ad2fb4850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031006, "uuid": "03752798-cc64-4572-aabb-ae2cbc63def1", "comment": "Malware payload (Mirai)", "value": "600ff4e3a2cd87621a59697a859d57b3b84fddcec69e4c8ad337229d86468d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031006, "uuid": "7a767c18-d14c-498d-b819-12a46b3246ec", "comment": "Malware payload (Mirai)", "value": "30f5e42d7de26ce63d1444fcf1d59529a88f3c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031006, "uuid": "03e8c217-e5bd-48d0-92e8-c488281a1aa4", "comment": "Malware payload (Mirai)", "value": "cb6fb907c0eac5872797e5a42a6b1bbd512968da64dfed0d7cf3226671c70eafc31a9585c6b5e9c6bdaed9e34e1441b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031006, "uuid": "40690e17-a249-4019-89f4-a4763c185734", "value": "T1E7133BC98D43D4F2DC1A1936147BAB325AF5E57650B8FA6BDB98E5316C03302B34A78C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031006, "uuid": "59d74cba-7d18-45d0-b942-eeb4c28476f7", "value": "768:Tc+dV/VtAl4ouvxdx8csl6of6N6GbyYNVQDqDg8/JRTo:Tcw/t24omxdxtRCGbyYN+es8/JRTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031006, "uuid": "ba678391-5d4e-43f7-8ce9-2a133e092053", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031006, "uuid": "9ae4be24-8b07-490d-b134-2485338e13af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031006, "uuid": "fe84b427-970e-4f1d-ad1f-cf3057887d55", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8805afc-e492-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766997899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997899, "uuid": "ea732e66-93f8-435d-a89b-0227eb302822", "comment": "Malware payload (AgentTesla)", "value": "bc0fbf4fd1aaabf59809773ed27eb2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997899, "uuid": "cd726534-4232-4c5d-b96c-7561cabd02ce", "comment": "Malware payload (AgentTesla)", "value": "608e3d64ba60486aebbbffc8f207f641129a632fb31cf6d6adc836fd22cab939", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997899, "uuid": "a54fa502-3e5c-4d20-afc2-a4ca6825958b", "comment": "Malware payload (AgentTesla)", "value": "1a4b3312e1111f063f24f078103f1f4ef3a4c08a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997899, "uuid": "0a5c2412-088c-400b-808e-3e4e98aea436", "comment": "Malware payload (AgentTesla)", "value": "310b8676441f4f7354cbcfe8b8bec68706914e0319ebc3e138a964960e3c7dca437b033a7f3a9527eb646b431a1225da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997899, "uuid": "051b8eab-5c7b-46f6-b22d-5804cffdca07", "value": "T1C045F2148DC82FB4CEAC990990FE261ED3F05A5F44166589FB3BBD0AAFF7644011B2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997899, "uuid": "6742378a-6407-4657-be25-d15b80e44c7b", "value": "24576:JnQKsPCJof6CR2OfJMmlSmYKJRAaRmhxgvUU507GPXy5:Ns9fxMmNRGQGaPXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997899, "uuid": "17a6e82e-36ba-4bad-a105-1a0fb94953e3", "value": 1247492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997899, "uuid": "4ab5d813-6d77-4782-89d9-0cdb5ac1b7d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997899, "uuid": "4b8adf5a-cb85-4cdb-ad24-c0a16de42217", "value": "PO 10012292025.PDF.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11ab433-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968761, "uuid": "1a47c238-4266-45d9-9f79-cd39b4daf2da", "comment": "Malware payload (Mirai)", "value": "8555750958cba3b589f1f32a6b3e3837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968761, "uuid": "2b22df8b-0494-4b7f-8a12-49891392e7a8", "comment": "Malware payload (Mirai)", "value": "609d6d82c364a5f77cee60778f5d34e5985c7f4778ebe8d1ed5762e021b1cd9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968761, "uuid": "8b22e92f-32b7-4c6c-9838-c9a265a2c0ce", "comment": "Malware payload (Mirai)", "value": "50f20d673fc9349fb0a0b5f234a8210bb4fb39df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968761, "uuid": "698ca97f-f35b-4b0d-aa0f-9f1addb19239", "comment": "Malware payload (Mirai)", "value": "ca683b6f6bff8cd473b75413a5542b346de7450cc49df3bcbe389d45ca8aec62724daad6bf505ea25395da95c1acff7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968761, "uuid": "f95090b3-eb15-4136-9f54-6db36a731711", "value": "T189736B0774C0D0FDC899D2745BAEB222E933707D1274B26E2BD8BE163E9DE211E5E650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968761, "uuid": "0ea1078a-5fb0-49d6-aa71-599d719d06f3", "value": "1536:dpBd1Rtl6C2dPOnRIaD1tCIlgZao3vsJu:dp1RtlkhOR3DfCdackM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968761, "uuid": "c19f64e5-9874-41da-8f44-92f83205d07a", "value": 76424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968761, "uuid": "13addbb3-3989-40d6-b543-0c60b52ae798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968761, "uuid": "1bbad753-c078-4858-a452-eed3c1aa9cc3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2aa95a-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968164, "uuid": "aaec3e9e-39b3-4304-a96a-cb0f1497895a", "comment": "Malware payload (Mirai)", "value": "02181220bbe586fecaac7418a0ebdc34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968164, "uuid": "3ab1b851-d550-48b9-8b79-59c0e98f5a68", "comment": "Malware payload (Mirai)", "value": "622dfd2af6085ee4d532da99984f5ec8539c6b61540c737827841e40312b9154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968164, "uuid": "ad3c69ee-e4a2-403d-9d55-72dd000c8902", "comment": "Malware payload (Mirai)", "value": "54dc6a18606d38354cefa245b55d472ba3e808a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968164, "uuid": "0f4e8050-8d55-4324-992d-fce3c23d3f7c", "comment": "Malware payload (Mirai)", "value": "4a452615535eb175288ad96394f5b374bdd148bcec11cb1c762defe0a1138af645b8df95412b77b625e58562f9949889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968164, "uuid": "80299388-5c19-4cfa-83cb-a54a2c6fe664", "value": "T1AD635A03894156FDD0C595340EEF462ACA32F5ADB372AD4F27C47F25390AF502A6FA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968164, "uuid": "3c29ee1a-6741-49c0-a405-2654020ed943", "value": "1536:TW1GoR5uA7rhsUcyYmEslWS77jeSICxxdUSM:CsovTYmjfjeSICx/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968164, "uuid": "7cb771ba-3334-4802-9066-876f84ef9552", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968164, "uuid": "68ab77e8-269f-4eed-8312-132fccc1c0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968164, "uuid": "f25a4883-747a-4cb4-8448-a74b50292ba8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329830ea-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029913, "uuid": "4a12b7e2-fd4a-42a7-bc5c-a409614ccd6b", "comment": "Malware payload (Mirai)", "value": "31e254d0d47aa0d184709c213a25a040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029913, "uuid": "9ce962d1-10f0-4aaa-9553-315d8c8d61c7", "comment": "Malware payload (Mirai)", "value": "6308651f470b986a675d730ff2b660045221523e569857009ff9a9400b4edaac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029913, "uuid": "9e128304-6dd9-4597-a22a-ca7306b9cda2", "comment": "Malware payload (Mirai)", "value": "33ebc4deb4fdedc56efc9085f5a4756540e9732b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029913, "uuid": "4265af88-0ba7-4fde-9abd-5a67f953f95a", "comment": "Malware payload (Mirai)", "value": "847ab3be1485ce34db59856475e64e8cfad9acda4810736d4c63661a72f60bd69bbb7a6d05173c14ebbbf22b4403d973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029913, "uuid": "4731fc57-61f2-4a79-a1c7-bc89b4ec2241", "value": "T1767302A732F1388FCEED49FE54C81FC76CA9E74836920769471828CDB55E033269D686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029913, "uuid": "cce7a21a-cdf1-4511-8831-3ac17390a999", "value": "1536:0rsQa3wbT7ILTkNQlLIOcuHxaGUe07bW+8RmCzkihDsxnkScVv/Is:0aMcNLlc717K+8RVzpDgk3VYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029913, "uuid": "e25a3e3a-848f-4f41-93d5-334837632bf6", "value": 76796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029913, "uuid": "f149b9de-62c9-4b72-a39f-2a8ab29ba154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029913, "uuid": "4d5e92c4-5a47-4d52-8704-04aa7d3ad72f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bd37a7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995312, "uuid": "9e1021c3-faca-4ea7-b3e2-8decf8fcf579", "comment": "Malware payload (XWorm)", "value": "585f35f312a090a1dac717519b631eda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995312, "uuid": "26bae347-c821-4f18-982b-4c9522659e5e", "comment": "Malware payload (XWorm)", "value": "63450ea9b698216e6961e8d212dce4de3196f7ef039ffe2e722088fc1bece6f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995312, "uuid": "a46d38b9-db5b-4507-b201-24d19f00f453", "comment": "Malware payload (XWorm)", "value": "1d1fb4699970a935fbbba1092791485802fd28cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995312, "uuid": "03b00dd1-c87a-4f5f-b183-e50afc586fbc", "comment": "Malware payload (XWorm)", "value": "fe9c0a7fe7ce78c108c5ab07ac6eaeacc72acff85e4276c7c1cb7d661ea14735e40faf82883ed20073ce2333f7ea7297", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995312, "uuid": "9621e6d2-ea4e-47e2-bdf2-e356b107a4ec", "value": "T1FA633B35957E799686A1FFC8EE4122C24EDEF93E0B639CF0200576E656CD9602E1BF04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995312, "uuid": "f372df93-29ea-451a-bfd6-a6228641f1d8", "value": "768:I8w/h62/jWs6oS+xISN0vV1iCxs5auuOuOFft3ILVmuhI3h12glGtAt5AbhZnM/g:I9l/AoSSM/YusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995312, "uuid": "10329683-1abe-4a1d-b6d0-04022627926f", "value": 71543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995312, "uuid": "46d5a54b-8865-43cc-9ceb-efa74b685800", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995312, "uuid": "048aef75-536d-4605-82fd-a2319567d3bc", "value": "invoice-1645080830.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714461a3-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995229, "uuid": "64f9230f-6f68-4f2b-bd54-53386671e620", "comment": "Malware payload (XWorm)", "value": "c83d4ae0cb46b36a0f1dcecddbdf1b3c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995229, "uuid": "f256997c-cb9c-403c-9f95-ac6fabe91397", "comment": "Malware payload (XWorm)", "value": "635389a65f98ee0cc269c09a9a7f9e9cc9e7cb40bd09dbc4cd88edc6e2633e18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995229, "uuid": "3da7cf63-fc3f-44f4-9ad4-c8a245ebfb8d", "comment": "Malware payload (XWorm)", "value": "08a1bf226997752989692c9adafd6f497a3847bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995229, "uuid": "b227a00d-8e33-4345-8083-d35910daa071", "comment": "Malware payload (XWorm)", "value": "b147f485b49aae7775173d01e1dd3c76b2375435b9891047f8462442773630941bfe09d0e3a42346caa025df6fd3251c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995229, "uuid": "237fe9fa-5fd0-4947-b176-b53a8114d2b9", "value": "T18C632AF70A29655D4523A1BDE10F3E4804464B0E0BF39A15C66BF416D60E37EEC29AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995229, "uuid": "7152584a-497e-4207-a094-d828bf300f93", "value": "1536:I9l/AoSSMHPmPhPEPdPbPGPvPWPbPEPSPkPKPsPcPxPNPVP2P8PxP2POPDPaPtPM:I9l/5MitusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995229, "uuid": "5d700a86-7aac-4ea6-ad67-94707a9c1459", "value": 71527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995229, "uuid": "87cffdeb-59c0-4efc-8aa5-e963013bcfdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995229, "uuid": "fd3d1e06-8650-4c9a-b3c2-64b7d5a23ba9", "value": "invoice-1645080830.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc912012-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011354, "uuid": "d93a49ff-b650-4d54-9142-cfea08a67c0b", "comment": "Malware payload (Mirai)", "value": "4aa6882d6c028216e65e53bd14589cbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011354, "uuid": "e2b5939d-4859-41bc-a54f-e5ac04b1f3d8", "comment": "Malware payload (Mirai)", "value": "63841915cedf46bc0fcc414869bef8207e048ada4c0b2c72e7124fa945bea288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011354, "uuid": "d425d057-bddb-41ec-ba4c-84c7b29edbf6", "comment": "Malware payload (Mirai)", "value": "4ffdec1fe327e7533d9654d9a25d5f30b609ed46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011354, "uuid": "71b82222-fb33-458c-95a0-9c39120514fd", "comment": "Malware payload (Mirai)", "value": "e3c215705bb15116bfaa684e3b043245182c34d9bc8623e4bb20bf3e86c5f44682f4b5f358627fd79bdfac0ca15ec36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011354, "uuid": "8f8bed8b-63d2-43ff-bfac-b8227d035628", "value": "T1E8D30802770D4E03D1233EF0277B2BE0979BFD5229A4A580752EBEC992719F22545EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011354, "uuid": "b2b2af42-f26c-4dd2-8e77-e7543319dbc7", "value": "1536:iDj9/U6dxHavvMH9dOZY5qaKjIirryJz9FvAhUDylyZKVIKwDrkHbqW:iDB/U6dx4EDOYGvrEzEhdArkOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011354, "uuid": "ded565b6-4439-4e00-9a24-7c448ffedc22", "value": 131096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011354, "uuid": "b45713c9-9044-49c5-a542-614a79a7ed2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011354, "uuid": "334008e4-2a90-4856-ace4-290a5f5cac5d", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b4275c-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995418, "uuid": "0e6945de-b762-43b8-a95e-d2a054f82b42", "comment": "Malware payload (XWorm)", "value": "dc4b1bb71840fa7608bda6da003947c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995418, "uuid": "c1aed4bc-2f23-4dba-b700-e0343f706c95", "comment": "Malware payload (XWorm)", "value": "63e168e020639222edafcd01afcddfe21f1a17c14bea75791459657ffe038429", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995418, "uuid": "b3ea0d81-3d93-488e-8461-dc0128e5db89", "comment": "Malware payload (XWorm)", "value": "498a5ba1029a2b4a6a8bf40a29a06fa76604f27b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995418, "uuid": "c36ca79e-c7fb-4abf-80df-46ba813d8c0c", "comment": "Malware payload (XWorm)", "value": "5bae3f62d86653327ee86ac75689f6d39832d36ee9375bfb18df976fb9da804250fbae79b2fae37c4fd5a623dc78ca61", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995418, "uuid": "43c16170-bb2a-4a1b-b0c0-220d12a15595", "value": "T19F731ABFB55138AC94625268EAA216FB5CBF8B2D246F7440FE2A3372171C83537F0561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995418, "uuid": "e997cb3d-44bc-46e7-be9b-45069461985d", "value": "768:I8w/h62/jWs6oS+xISN0vSvNSvmsCdkfScBYrwz2y8kTAlGB:I9l/AoSSMmlusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995418, "uuid": "536dc465-11c9-41c4-a1dc-b26a59cdc397", "value": 73471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995418, "uuid": "2a6ecad3-f8fe-409e-9fa7-cb54953e3c4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995418, "uuid": "aac6d6ce-f02b-4d28-82e0-77e381bbc4c7", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77136ed5-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966892, "uuid": "bdfaaf1b-aead-41b1-a02c-eb1fe0a97786", "comment": "Malware payload (Mirai)", "value": "87135453ca0ca43f6fe0e2cc085f54a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966892, "uuid": "203f96ce-cbee-4b30-acee-87e6da4e6579", "comment": "Malware payload (Mirai)", "value": "63e87d80e1eab12bcace2adeda59c7e454ea1886183e8fb390f8d4a21067e3b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966892, "uuid": "12b35c73-657e-4b6e-979c-c83a49f4a875", "comment": "Malware payload (Mirai)", "value": "8ce982c5b0cddfcfeb9a4ec58e1486c3e2acaec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966892, "uuid": "db8b14e4-67db-4f03-a320-1b34862889c4", "comment": "Malware payload (Mirai)", "value": "eaff6fe29141c8fd94079efc472a87c4459dfd3d6ea53706c9f57c17d0d348bced0bb19923754f817676a72ec07f6f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966892, "uuid": "7cbdb9ce-37e1-4205-8972-0e8a221803db", "value": "T123638D62CD666D18E25D8AF07534CF765723E21092832FFA2669C26D9047ECCF64E3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966892, "uuid": "ce69beda-616b-46bd-a547-069ddaa7396d", "value": "1536:XaMdr5qSpkXTGVkEKKfaOdF//GCxxjPZvGuZ7R7:Xz15p+DGuENf5/GuDhGuZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966892, "uuid": "372222d0-96b3-45b0-9fc0-bd9994edafab", "value": 66732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966892, "uuid": "4fe68b09-aedc-4387-8356-d87f740e7c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966892, "uuid": "7cddd206-6e6f-434a-b4f3-d48cc773312b", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae32411-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766968294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968294, "uuid": "8aaf93a8-c3b2-426f-bb8a-d3c19f719bb6", "comment": "Malware payload (Amatera)", "value": "960ce678e9b3a5f9a908eea4bc6bb939", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968294, "uuid": "906fafbd-8932-48ff-90fc-0f22f912e633", "comment": "Malware payload (Amatera)", "value": "6439ae266c4254e9916a365ba6a3cfa39b8193c4bd9034bd8249eda09a82ecdd", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968294, "uuid": "7e40df1e-c20b-4b11-9d2a-122e69fc7c21", "comment": "Malware payload (Amatera)", "value": "aef2a12ebc00e4cbdeef8c7a470444b9fa67b4d8", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968294, "uuid": "ce511911-fa80-4fcc-a83a-257455f8d82a", "comment": "Malware payload (Amatera)", "value": "26acba8602cfc1f1443e175c692d41ca4ef0c9a0750f0c6bc413f97f9aea564fbf4a461a127c9c48037580c63b4c5798", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968294, "uuid": "9c56a44b-1da7-407b-ac48-1b556e5a4903", "value": "T148B6121693E05966F872C33445B38B929931BC611A3467AF1D95F0BF09F3D84E870B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968294, "uuid": "9c32c66d-5a20-4a70-a32b-0661674dca2a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968294, "uuid": "2864b5c9-cc25-4df5-b481-9d302a890021", "value": "24576:bH77aUBYMqJ+VsrPYOgXVx6YcZZwoIjDOW50RIrOuWAcO:DjYMpovQVmZZbyDJWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968294, "uuid": "d2b87cca-ea08-4199-8a82-7aad3021462d", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968294, "uuid": "49338e58-2a7b-41bc-89a4-89cac5531b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968294, "uuid": "81bf5b6d-b2b7-44af-a7a0-6284aa599a73", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075530be-e4d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767024257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "6c5bbdb4-a72e-40c0-9792-55b7231240c7", "comment": "Malware payload (Braodo)", "value": "f593dc60a5eefec4ae650a96eff9779b", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "1e1d9ddf-226b-4134-b79b-e11445ec049d", "comment": "Malware payload (Braodo)", "value": "64bf9694f56fb3655cd3f34cc2fa9de4a7ac3951d62c33585c4f8ed801bc23fd", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "f84f99a9-420a-46dc-a475-df19388bd833", "comment": "Malware payload (Braodo)", "value": "adf87023d1b590f5c3f3e0ca5db9c0bf6fdd2f58", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "3d5de914-9a79-4dad-b361-1b1b00276c42", "comment": "Malware payload (Braodo)", "value": "92530597c40d90171255a6a43c1fea67784af45345433d737a7b392038f0c0c77fc515452414c84a9413d539319701f2", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "ceb45985-fda5-4da9-b5ff-a272fe20ec11", "value": "T101D433262CF32BE4FC811666E3B0D75D2ADEA56C8D410E6D1E0AC2164FF85443936F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "03358b6f-9abc-4af9-b18b-cac4afee67b0", "value": "12288:HkfOtVaGs5/DEuyzcX/lqRyF5Qmvi9/vPUl4t0AniMqh9gD5JL00ykOP:HkmtoIuyzcP8QF5Npl4yUlqh9gD3Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767024257, "uuid": "ee64b59f-2e49-4f01-90f4-76b8700833ff", "value": 643807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767024257, "uuid": "59a53e34-b0e5-4bb6-93be-27199ef05357", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "711cce84-20b6-4c94-be8e-55fd329418a0", "value": "Company_Event_Gift_Boxes.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd1edcb-e468-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766979733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979733, "uuid": "af833bf2-11d7-48ca-a356-a20c496ee74c", "comment": "Malware payload (Gafgyt)", "value": "b848960a40bc7a0190a25e74acbe4b30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979733, "uuid": "7e30db97-80d6-47af-94db-eafbf570c548", "comment": "Malware payload (Gafgyt)", "value": "6551a868526b2d509e8b11b0d933445bb0f9983c65c68a87161b97a0f02a22be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979733, "uuid": "9e365c28-fd62-4c3c-9380-6cdc26305481", "comment": "Malware payload (Gafgyt)", "value": "f57d29e48401ed0fc05ea6f3dc3b3e7907e2f4ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979733, "uuid": "63fe88e9-f3c2-4cf2-bab1-ec0a976f7bb3", "comment": "Malware payload (Gafgyt)", "value": "4fcac0a1c9aa6e97ee12d9b824c93190f8602f6d3c49dcd49b836758502248f3e971120dd190b481a456f3e2c2be5e65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979733, "uuid": "95a79aca-95e1-491d-af18-2d352759771d", "value": "T104F39509EF311EB7E9FBDD3752EC1B06218CA41312A83B7939B8D618F68694709D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979733, "uuid": "4a901c5a-67a7-46e9-b3d9-6f825f721f2a", "value": "3072:JbhKaEfPKBZ2DGxvCH7ZnjIgnPW5Qqcrx:JbElf/DGYbZnjIgnTTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979733, "uuid": "39f2117d-7732-4e12-8b5d-ad2cbea302ce", "value": 163912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979733, "uuid": "b82c5eaf-cda2-4501-9547-b302970a4f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979733, "uuid": "2973fd05-81c2-4e03-8fe4-f2b74a824fda", "value": "rondo.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9356236-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967432, "uuid": "b31e3814-1712-47e5-8049-18f61eeb81be", "comment": "Malware payload (Mirai)", "value": "a6c052da9f0397628e733e80adf171fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967432, "uuid": "92b1a5ae-f903-4bcc-b52f-d13dbbae008f", "comment": "Malware payload (Mirai)", "value": "6552ee5b763a8b3e733befafab3157877100949e06c53b359d7160c913a3499c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967432, "uuid": "94301d89-f23b-46da-9027-8667d3302d65", "comment": "Malware payload (Mirai)", "value": "19dabab2098b4bd91e753aa2686512a5431c12aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967432, "uuid": "15247d26-fdea-458f-a40d-f360fb6dda38", "comment": "Malware payload (Mirai)", "value": "1efbc2ad2adc8b0b7c7b64192707cf8b7131e1452dbc3e55d62920aa59de834a083f6487ecb16114c0a449c06aa11220", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967432, "uuid": "c8fcf9d0-4cbf-4893-b19f-c514de084259", "value": "T1B6933B85B8819A13C6D566BBFB5E42CC332653A8D3EE3203DD256F15378B81B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967432, "uuid": "123a086c-4ba4-47d7-8416-48796987a999", "value": "1536:Cxu0nz+tOLT2SVnRCWAauCF4DO5xEUs6vjcyDYTcYw9H6cruZ7R7N:CxJnZnRCWRz1LEUs6vjcrBwRTuZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967432, "uuid": "d944d362-576a-43fc-bc29-3c77636562a8", "value": 91312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967432, "uuid": "7af49165-cc54-4932-8654-9b78dbf44920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967432, "uuid": "c98b5f2b-cb57-49c6-accd-86a98f6b76cf", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24524b41-e488-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766993382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993382, "uuid": "321a54d6-d29e-4d6b-ae79-a3a8ca720b64", "comment": "Malware payload", "value": "61fdf7a79e0576061b47f578b90abdc1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993382, "uuid": "cb5a696b-8395-4569-a972-9fdc0aa0de42", "comment": "Malware payload", "value": "656a1019cd6c8301bd1aa4dcf1921ed3c6876b237e4b0b28301cdf51c4a02176", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993382, "uuid": "cfec4ffe-5bd3-45ee-9957-5817629fd9b7", "comment": "Malware payload", "value": "455e6e17a23d7db367ff0517a52360e9529c25f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993382, "uuid": "04f503f2-95a1-4102-91da-a7cd1cb88b3d", "comment": "Malware payload", "value": "3f8b851b5f5a657190ac0acd0aee0ca98f33872392c9b6bdad325806b8500c686777a4170ece3e4110a6f462c04bfdc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993382, "uuid": "e3271614-44ea-4ef4-b6e8-f7d3034febda", "value": "T137851A55DA838DB0ECD33FF02007B77E9620DD35C8345C6EE688CA14B7F2952656AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993382, "uuid": "cd77743e-becd-41d7-89c3-a21eabc47b97", "value": "cf127c635698075a36f068dac0292287", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993382, "uuid": "4f276577-ecc5-4273-a410-6f90861eceaf", "value": "49152:/VbQqXLvrJqKuY3b9Wd6hr1c1hC5jcm3Bj:/K0vNluY3b9lhr1c7C5jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993382, "uuid": "2a6ad687-ea40-4d42-8f0a-d7c0011dee68", "value": 1794048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993382, "uuid": "703a0347-5808-4470-b9ac-fc8fd290cb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993382, "uuid": "f324ac77-2374-4946-9c85-39a6e1c4e9c6", "value": "656a1019cd6c8301bd1aa4dcf1921ed3c6876b237e4b0b28301cdf51c4a02176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cb4c12-e458-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972846, "uuid": "579d3516-6e70-4054-9fb2-d8b9ebcb7e10", "comment": "Malware payload (Mirai)", "value": "1fe3d9793d88129c0b7cce3904b4f266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972846, "uuid": "1e66ab68-b391-4dfb-bbd8-0430df078c64", "comment": "Malware payload (Mirai)", "value": "659392ce814b663b070bc728daf551c0b57f3b8af4d7d99cbffc3519dd8886c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972846, "uuid": "25cad000-756e-40c0-aed2-0271226bd8f4", "comment": "Malware payload (Mirai)", "value": "f1ba5049340b424f1e7fe24fb5140f4a15ae3111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972846, "uuid": "0a455962-8f36-40d3-b896-4498a7398e31", "comment": "Malware payload (Mirai)", "value": "fa261bb6c988768e333e49945d6e305bb552d61ff028c88014ac4f55c2abff984f608ae8d650b29b26cffcc70b46177b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972846, "uuid": "dd9c3de2-9926-4306-97f0-cb4b11d5e8fa", "value": "T167A3C80AEF504EFBD86FDE3746AA0A0535CC554722A83B363674D928F64A60B49F3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972846, "uuid": "04c0d733-33ea-4394-a598-e5cb94412d6d", "value": "1536:k3v3PFMG0WnenOaYxF8wHTRTN09oPn5hXmYVkAx2pNLk:sPenYJISveY6pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972846, "uuid": "12d548a9-ffde-4daf-a3f1-d06a2c5dd4dc", "value": 105656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972846, "uuid": "3bd65881-4929-4926-a10f-17b08f9811c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972846, "uuid": "d504fcf8-4c8d-4c10-94dc-536e8c67025e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68270ec-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986809, "uuid": "feafc79d-6764-4f4e-ab0b-84c9b05e221c", "comment": "Malware payload (Mirai)", "value": "d39a606da921fb251bcc4edb4b422cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986809, "uuid": "5fc085b9-932c-476a-97a6-00513bf47fcb", "comment": "Malware payload (Mirai)", "value": "662e52fb5db8a6e896873918f792baa84c4ac8dbffe357fc99cd97a8e1b3929a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986809, "uuid": "de927c94-c1bc-4a7d-88ff-fd7b70b55980", "comment": "Malware payload (Mirai)", "value": "38738d26d027ed08dfabbf1f2de68e3c349a56a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986809, "uuid": "0e929fdb-ed97-4449-96de-65d2b4f9a1a8", "comment": "Malware payload (Mirai)", "value": "f648d0aa8d64ff27b5ce29cfe30a1713f2ae35488e957de798951aa22365c58c409046fe8211d7eb5c9bc3ff80a3d9db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986809, "uuid": "4ce7fecc-18ee-44b8-9fa1-c4d09e2c3069", "value": "T1C1435BA2B4009D7CF98BEB7F94520A05F131B39514931B37A77BFDA3AC722584C26D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986809, "uuid": "7f03e71a-6d5e-4184-869e-9c7b91b68786", "value": "768:olP0gIv/UYZqR6OGAlewMFXQLmJx+DT2FwOcj2sdk0bUYwSbSUuJ8pOkoMBTcz+m:y2/HqR6axOZK/YaS9J8pOkoqczSIXkPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986809, "uuid": "20e1efd4-2c45-43db-aab3-39950003c482", "value": 55720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986809, "uuid": "851630b0-de8a-4f18-bc87-acd5d615ddb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986809, "uuid": "77ca9697-4748-498b-9e07-49025870dd7c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a68eb40-e4d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027510, "uuid": "8d34da28-497d-44a4-8e50-be2645881993", "comment": "Malware payload (Mirai)", "value": "9eab4418daa61310e89b3ad3fdf4dab1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027510, "uuid": "85938414-2190-4163-93a9-1ce50030dc7f", "comment": "Malware payload (Mirai)", "value": "6665a3865fe38587a83f09b42c9d3deb0194ce0f64b68985bd2fe043353f7324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027510, "uuid": "de6457d5-f962-4ec5-bb8f-728ffd56444d", "comment": "Malware payload (Mirai)", "value": "29819d9deaf0b6809e4cd990470b72adebc3f86b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027510, "uuid": "99c21d27-9d98-4fc6-ab08-0b39763b8341", "comment": "Malware payload (Mirai)", "value": "e6fb4c28a65d2549b7ddbc7c9252c32ad3e87186f15659685a346663ac2e5c7536153bb9f063eb41b68906ccbdbd934f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027510, "uuid": "94c57dd6-d2fe-4b29-a2ed-c7ac3ba6b5cd", "value": "T1E404AEA3B70B18D1CC6106F81BCB5B9D6A2315139D67D6E3BC9E36392E364DE14123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027510, "uuid": "14c82df5-6cd3-459d-8d3b-eeabf14994c5", "value": "3072:CRbWInnuURkXS0abNDRCRWwvsK8DZs8bFruJwung3C2GF+jdub01LZFq:Abnu14sWwv2ZsChGwrC2GFkFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027510, "uuid": "c7177769-8228-49fb-8115-75d750d715e2", "value": 181940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027510, "uuid": "05359899-05cd-472b-b06c-0c563c36f583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027510, "uuid": "39d1dd39-870d-4d1c-848a-7c030ae8d074", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972ec1b6-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996152, "uuid": "66deb937-4561-4950-80fa-9a51cea65b0b", "comment": "Malware payload", "value": "8428191865d0bfc9120b8ccd02f7a928", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996152, "uuid": "fa041bf7-4330-4b03-9ca5-fb98ef2b264a", "comment": "Malware payload", "value": "668269bba77769eedf2baea3a9d0f23ddaa637d487172b974b4c6959d80602aa", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996152, "uuid": "88bf18cd-8903-4e73-a3f7-deb7311b07c9", "comment": "Malware payload", "value": "a1bac4ed232ecaaa21b8847cf96cb8da3dc90b06", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996152, "uuid": "47707257-d932-4c82-affc-2fd164161435", "comment": "Malware payload", "value": "585d351936506ed54b0a222151d9ec4a8cb197bf41c70a641b757bbb50ea11a8e88ab59e02a5d6fc83d646fd51aca610", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996152, "uuid": "90e9cc2c-5eaa-4e3b-8fba-7e3c18a89182", "value": "T154B32F8023C06846C3471B7B722BB0E5EA6B49D939A84547F10CBD90B7A770FE6E5B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996152, "uuid": "64b99163-1877-4122-a337-0e56e890d36e", "value": "768:Dc8NMvEnXArDjpVFVetm2nr5U3yvJpi3EluPWFMRainxZlePfXS9clX4ntuyZYAC:Akh6kvGB6Dccb2LlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996152, "uuid": "f2107ab2-8ae0-453b-9d3c-fb677b438353", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996152, "uuid": "83249718-6bf0-4724-af05-2eb833004761", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996152, "uuid": "f263b31f-ef24-4dd7-81ab-5b95cd83194a", "value": "Standard New Order #PO 354688976.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b85249d-e4cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767022680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022680, "uuid": "113f6af6-2966-46f4-a8b0-956dae67a60e", "comment": "Malware payload (Braodo)", "value": "b15db57aa21680e1c6f38c786ccc4dbe", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022680, "uuid": "87a6c3dc-e165-4db4-a6f2-4861165a2d4a", "comment": "Malware payload (Braodo)", "value": "66bc1af9464575c5e0f7ca33731b118cb69ee652ac1551f1eb19d3cd9a295a1e", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022680, "uuid": "8c95651e-3963-4425-9083-a9ad0a9220ec", "comment": "Malware payload (Braodo)", "value": "385d5be0774de80a3da5092ac37a7b270130d74c", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022680, "uuid": "8269d58a-9e0d-474a-9253-8e4fe4f82e2c", "comment": "Malware payload (Braodo)", "value": "8aad291ce56b2206318bf6aacd52e9cf708714121839c056342c0ab75dee738573ccba35548cc192e9becbe50c824cfc", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022680, "uuid": "af4c681a-cb4f-441e-b9b7-85fefd19ee43", "value": "T1A99423AE38463946879B8848F447C8A7987C4ED73FCF8369815BAD642AED3C4FD20195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022680, "uuid": "c960f105-0f0d-4961-ac48-8506403e635a", "value": "12288:41I8qmB8CnFli8q4ge4uobGIL2qHTYg62Ow:4q8qtCnFHqRh5bGILPUg6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767022680, "uuid": "93b033f5-8e5c-436f-b12e-de3e56661532", "value": 447190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767022680, "uuid": "ef8ebdb5-0898-43d2-9486-f68f3029f4df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022680, "uuid": "2ca7fddb-eecb-4e4c-87b3-c9864ad6b488", "value": "Wedding_Event_OrderList_Decoration_Catering (2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24db1882-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995530, "uuid": "9ed24a18-9e4c-4115-a79d-f9746c35b7a8", "comment": "Malware payload (XWorm)", "value": "8d2b5faddc8c743afae992704dbc391b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995530, "uuid": "7a06b97c-f124-44e0-a286-29c95cc81cac", "comment": "Malware payload (XWorm)", "value": "66bfad3b73dce61945294d681538d1038361cd51c44dfe6723b7becddce6313d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995530, "uuid": "37f666fc-be9c-4c0a-9872-d1553d5a1d01", "comment": "Malware payload (XWorm)", "value": "9a65942b9ec6c8e81c34619c5f3d26f916b7f10a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995530, "uuid": "0231366c-92f5-4e88-97ae-44cd79b9ec05", "comment": "Malware payload (XWorm)", "value": "4880689e504645c802ccd1852ed457f3a1237c568ae8c8209db3218d6ad429b8c17c775dc9ae889d7fa7e39aaa7fa1c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995530, "uuid": "9ad35d39-f407-4ba8-be86-fb4736187550", "value": "T148632AFF7E6363E159E373E4963E0B266F408312495CF1E8714DE1C84AE4A6AAC56DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995530, "uuid": "c463b3e5-17d9-404c-be3f-22b0038e1927", "value": "1536:I9l/AoSSMnkZsaLol72f7PLlzcvGlj7Z44vSlyEGqA8wbhONmlAOlJV4mGsf4qc0:I9l/5MYgusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995530, "uuid": "5d61554b-a4ac-42a3-aa86-942e948f3f12", "value": 71560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995530, "uuid": "8adde81b-d52f-41ec-bf5a-1debd0d5f5c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995530, "uuid": "3bcc03b4-9565-4e76-ad4d-615fccc3b81d", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7726a966-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995239, "uuid": "abcf0545-1340-4f5a-b292-79e9915192ba", "comment": "Malware payload (XWorm)", "value": "5151854748009840101debbfaafd5cb2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995239, "uuid": "6f551704-5a04-48ad-9e27-aff255075b4d", "comment": "Malware payload (XWorm)", "value": "66c82affa993d16e42892f35c8fb5a0464641bf795090c2b4ca30057b43efc02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995239, "uuid": "21ce547b-ca8a-42a8-a64e-db79a71cf6f4", "comment": "Malware payload (XWorm)", "value": "ed18db0378f575373922171c4146a8a46aa3c95c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995239, "uuid": "3e0094db-2670-4050-8537-ce30d0640367", "comment": "Malware payload (XWorm)", "value": "60993dcbd9c680bdc4f1c8b19c9c44e8dc43e0cf4b8ed132bde643c893f5b21c9d21dc2af2bf70f0b38e99697e0f2be9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995239, "uuid": "f1153886-3fc6-4ded-8386-e362ea9c9b08", "value": "T13E632BDF9D1A66C33E5BA4D24FA290C2AA02957BF015431C24AD3F026BCFE69491DFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995239, "uuid": "7772357d-9318-4e36-aeac-b2705955a683", "value": "768:I8w/h62/jWs6oS+xISN0v19SbS5L4vpYVQ9RpIB9+9fM1p/KgNFlULbeEMdTTCZY:I9l/AoSSML0usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995239, "uuid": "b9e5fe21-26c3-472d-b338-b2c2411f4cb7", "value": 71549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995239, "uuid": "9f4c93ce-d564-4c00-a814-ba2996149338", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995239, "uuid": "44246ce1-7518-444c-9160-549fd2c15ae2", "value": "invoice-1645080830.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3149be-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (FatalRAT)", "timestamp": 1766966441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966441, "uuid": "d3aae44f-31c0-4434-96c2-17ad8d1260d3", "comment": "Malware payload (FatalRAT)", "value": "7a51c640dbb46f1cea19d858eed7c6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966441, "uuid": "4e0fb6e3-1456-4cf7-bcbd-f0157cbf64aa", "comment": "Malware payload (FatalRAT)", "value": "66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966441, "uuid": "2a54b7b3-8179-4133-8e4e-ddbfe4b1e521", "comment": "Malware payload (FatalRAT)", "value": "87dfbc797698b2d6312f6f408dc8609aa8d69f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966441, "uuid": "2835368d-f69f-4f5c-84ed-d14db6f7f8a3", "comment": "Malware payload (FatalRAT)", "value": "0421d2ca6224a2f5c672fb047dabc1fe44580ebaf949dd0bd4ad77507042cd81f88d493374c40590e26a267e7990b1fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966441, "uuid": "038892b2-e4d7-4c7a-a8d2-fcb0a19b9e3e", "value": "T180F5227373B50146E5E1C93C463BFDB970F6925A8E81AC7D65FAD8C0252B8E4E213A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966441, "uuid": "fb7c63d6-faad-4da7-8848-512e93a06533", "value": "9b201090749bae06a761156dbad9c4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966441, "uuid": "dd028cfb-9fc3-4e2e-a51a-2023a88b0d0a", "value": "98304:K7TNc/KaF1+n8+06BcpKicYfUyHCm3AceDnH6Bmeh:K3ei04VK3Sds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966441, "uuid": "c7c26caa-e3b1-4ee4-85f7-848a6b6f4c91", "value": 3526656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966441, "uuid": "a304a4af-dc5a-43e5-aa07-cd69560c812d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966441, "uuid": "2d0000d0-fc52-4f02-b2d3-b90f5e59be60", "value": "7A51C640DBB46F1CEA19D858EED7C6E8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbca916a-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011353, "uuid": "8ee7b678-0322-4a71-99cb-23e9a630b817", "comment": "Malware payload (Mirai)", "value": "9acdf01da71fd8a93fc29df756bbf847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011353, "uuid": "06775a52-01ed-4b41-8525-29eee50d2226", "comment": "Malware payload (Mirai)", "value": "682c94197c5a9e95be4c0024d45dd105d43405ee228c179cb9a3762e7094d234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011353, "uuid": "1b5de2d4-439e-456e-94dc-5afc08471a96", "comment": "Malware payload (Mirai)", "value": "c87271db0ecec9208062af2f838284435aa1e2c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011353, "uuid": "3257c711-2cc9-4348-9b6c-ec585dcbfbba", "comment": "Malware payload (Mirai)", "value": "bddd73ab548c748482b64d38daa607de799c075d23730e753d91592480a13eaa1a68ff6d5f349fc89c68c367ce766ceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011353, "uuid": "ce27e357-3f31-4f4e-8f66-1ea242052b5c", "value": "T12BB3F763ED56AF5AC11BA0F0B2F28F781B52BD6A4C470AD9A572EAE44143CCDB1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011353, "uuid": "89f72e93-9c27-48fb-a8c9-8dd65e324067", "value": "1536:6AZOl1SajsYiNjDCs2KXy/XO7rSVFwEdbIBtW77Op9G+8:6eOlh3iZBJXyWCFw2ItWnOp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011353, "uuid": "b416dc31-c83a-4968-89e0-43793f3c71cc", "value": 114684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011353, "uuid": "3e2dec5b-22c6-41c3-91f4-6f688af7f625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011353, "uuid": "dcb157f7-4cf9-4260-9fcb-5b893af21240", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d953f03-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972406, "uuid": "c1168c8b-bfc0-4a4e-acb4-ca4866683bbd", "comment": "Malware payload (Mirai)", "value": "7493fb7a3344e74c42c9e4581dc45e19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972406, "uuid": "a72454e4-33a3-4aa7-a5b5-9b80c8372572", "comment": "Malware payload (Mirai)", "value": "6831f86dc02872836a7c7b22388b0d7128587ecc8e6f120519d30f99d8cc3f91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972406, "uuid": "5256d337-3778-4a58-9c21-09c9b866e48d", "comment": "Malware payload (Mirai)", "value": "9e553c26375c0329cb7bed853f721c6e8bcb6a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972406, "uuid": "473d7047-fd70-489b-93df-6e429f7feb54", "comment": "Malware payload (Mirai)", "value": "f1819285af93be45bbff28e93e8cd4f4cd7f29530874544f40d3ff0c20ecc26d104ebc6a781c8160fba41d8747e53bb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972406, "uuid": "c93015e7-76df-4812-8b80-2b7c68648098", "value": "T149C31856B8829B21C6C216BBFE4F128A331357ACE3DE72139D185F2437CB55B0E7A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972406, "uuid": "c5d98ab3-37c3-4974-b0f8-4b2387fe61f3", "value": "3072:S2vdzztDORGwCqbFwAhrErVzB4PPTLwaPMfRjvc5A7TWKJp6nz1:S2FzztDORGwZFwAtEVB4PPYauRj97iew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972406, "uuid": "1f4dd46a-8f6b-43ba-87c2-15038003249a", "value": 124040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972406, "uuid": "8343f519-a5a4-4278-ba93-ec84bbfee2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972406, "uuid": "597788d0-1f1d-447c-9d4a-07fca0b9bb37", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e5b66b-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969361, "uuid": "b27319e5-fab7-4cc1-a0b3-90e5fef1fb52", "comment": "Malware payload (Mirai)", "value": "5a1e9ea027317f72400543c0e64ea029", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969361, "uuid": "65476a77-dc4c-49fe-880c-eb7a0922f897", "comment": "Malware payload (Mirai)", "value": "68389fb10f8e5e6ac05464f0b0d3d8e52660af91a5bcd29063697128bf8b0cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969361, "uuid": "23331f0f-79ee-4652-847c-dd9b6378c67b", "comment": "Malware payload (Mirai)", "value": "0ab040ecb3af71c007614224f24c678283a06d3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969361, "uuid": "4c314586-190a-48c1-bc14-47949259fbca", "comment": "Malware payload (Mirai)", "value": "5cdedb1dd2eb52149d32e98b301479b1dc98e3aa23c0f93458f1d495659293bfa145b59e7a9e8ecf21d57139711bde41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969361, "uuid": "b08bb129-faff-4507-b662-ab7fc0fee572", "value": "T1CD231941B8818613C6D5137AF66E46CE3B3123E8E2DFB2179D221F113AD682F0D67E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969361, "uuid": "94b0d9e3-e110-4959-9a32-44c408bf5704", "value": "768:KPO8Ax+D33F9DtCgsvPfxcZlm9Qj/cepLww7AorzL/N+tk593hELAw:58Ax+D3V9D4r+u1IL7zLMkm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969361, "uuid": "b15e2518-9387-4d38-a938-b411201981a3", "value": 47928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969361, "uuid": "5b262878-985c-49cf-8f04-fae2bc666991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969361, "uuid": "d7717d7e-1b88-4786-8ffb-13ac4eaa6f1a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fb4e29-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969553, "uuid": "b95abe54-485c-4282-9fed-f4efe798e482", "comment": "Malware payload (Mirai)", "value": "e169492e9a4391b785ab487846187254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969553, "uuid": "7eaadfd5-26aa-4214-85ce-b2fe83a256f7", "comment": "Malware payload (Mirai)", "value": "6896bc220553d45be7a80e388de394031ed9060de0ed46edd6f1573646327a5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969553, "uuid": "4a59126f-e912-406e-bc56-336f7b4a1100", "comment": "Malware payload (Mirai)", "value": "72d2bb0b838f1c68ea18f1e8996ed368e8e6b52d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969553, "uuid": "ecdea8f6-ac2c-43c5-8072-b8c14e93e359", "comment": "Malware payload (Mirai)", "value": "c1b924900ae9a8b356ffc8dce7e4b158b11c18b6ccdf689c2f5fdf79fbb8ae6acf8bb3b705f37078ecfc1e2fd4dd166a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969553, "uuid": "3a96f6f6-7064-4721-ab82-4974e6465520", "value": "T17C739DA7C57AADA8D15D46B0A8B18E761B23F10082531FFB2A99C6394043EECF5093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969553, "uuid": "3bb41188-2180-4a48-b516-b261b64dd566", "value": "1536:3afwtprz+ebz1NnrTP+StyvKfBfF5tOC4+G+0TSuZ7Rj:3sC+eH1Ff/4yfltOqfGSuZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969553, "uuid": "22e6f2f0-ae8d-428e-830c-878b36b84a8e", "value": 74924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969553, "uuid": "fa17d73f-fbed-4cfa-9ce1-5766ee0a7434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969553, "uuid": "b99b04a8-fade-4410-ae60-41dd1dc14d68", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7cb7d3-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031621, "uuid": "07e2ab9c-a2c9-4c0a-a95b-7de2e9d333f3", "comment": "Malware payload (Mirai)", "value": "1c207dd7945b24fa1292ee3c096a8fa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031621, "uuid": "5f0d190a-9c92-4ad9-a7d8-011807193b39", "comment": "Malware payload (Mirai)", "value": "68e0fc15efda53119792a16978549ce986e985ed62c3832dd411ff4f1d6fba73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031621, "uuid": "727b52d2-903b-4180-8400-92dc705b2691", "comment": "Malware payload (Mirai)", "value": "32a5578ae9ef5ca8c2444fdbf67050668ba4e0af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031621, "uuid": "c4963bb1-734b-4847-9423-f790c4536126", "comment": "Malware payload (Mirai)", "value": "d5c5be2b207bd6635b4757277b14da7194b58c393c382ab3721a5bcd980979c823ea29e30e7618f23fc214de3d4779b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031621, "uuid": "7477fa8b-ca8a-48bc-be0b-3c6d6fc01a81", "value": "T11333E68AB991DB15C5D555BAFE0E528C331307B8E3EFB3139E146F246B8B46B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031621, "uuid": "1dc7e59f-02c7-48fe-8438-c01c7d9f90cc", "value": "1536:GhnFP1Pqgj5asaqHwelNYhoihTL3hMhigMLAn2utu+7R:mP1SgIhqHwelNYho/MLAn2utu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031621, "uuid": "ab985db9-a597-4245-834c-b7575429dd46", "value": 54440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031621, "uuid": "96b03471-fb7a-474f-adc9-3a001c89aa43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031621, "uuid": "bc1352be-5e03-4940-9e81-dd129169deba", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcc2ac7-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982285, "uuid": "c13d1d05-6473-4939-bf94-839f7429638d", "comment": "Malware payload (SalatStealer)", "value": "bccb42ceabff0be625306545b202f34f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982285, "uuid": "13d76a46-77b9-45b5-9374-9ecf99f68a4b", "comment": "Malware payload (SalatStealer)", "value": "68ff395122271e7de021bcea1359db83a1d6e3e4ad8b04f726aba86e309141a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982285, "uuid": "d59c66c4-5d42-43e7-88d3-eaf7d61000e2", "comment": "Malware payload (SalatStealer)", "value": "8f577daea84c0b9cd6d753d9baedce2e6f5aee51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982285, "uuid": "47ac88c8-2c1c-450d-8049-8000da862a37", "comment": "Malware payload (SalatStealer)", "value": "83febcdfe2775037d752ac1ceb5760933e3e5dc601b0cb1996c041218ef696f9b8c029ae2bbfde42537d270235fba40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982285, "uuid": "9b967760-8181-4d46-b2e4-47131eb72769", "value": "T12AF52319AAA448F6EDBBD43D89468605DA71BC0647E2D9CF43A10EDB1F233D05E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982285, "uuid": "aa270f95-626e-41c6-9df2-cd1146a1042e", "value": "4664ba11bc81af3e42c54b93e5154f96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982285, "uuid": "722530d9-8572-4a20-b05f-fce8096c63ff", "value": "49152:CIbVJ9KsXdNaEAduEsdy++2orOg8XPgK8joGoQbt5XQ5X17Q0s8yjN9j0McOg3ci:bbVPrtNyp6xKt3t56X17SJjNwKFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982285, "uuid": "b2491e4a-1c83-48c1-9e04-88d94cdb5abb", "value": 3582508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982285, "uuid": "3e1ad0b8-4e79-4be7-a8ba-ffe03c41098f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982285, "uuid": "d766a55a-ffbd-4b06-8c9b-bda1be6ba746", "value": "68ff395122271e7de021bcea1359db83a1d6e3e4ad8b04f726aba86e309141a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3d093e-e493-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766998363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998363, "uuid": "9da6fdef-5201-46db-9bf4-0af47706be36", "comment": "Malware payload", "value": "8b775f86e5c2385ecaf074ca888732e0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998363, "uuid": "7d166988-34d6-4e06-92ea-6d4f322840f0", "comment": "Malware payload", "value": "69682f6098ba1f6c649a4ee9d2085e4dd6e0f57b68bb5afc93c5817c636e0240", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998363, "uuid": "6a6dff8b-34bf-4a03-90a9-97366b9148d5", "comment": "Malware payload", "value": "907aee0a2d6070043abe642d1670da7d7db7a045", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998363, "uuid": "bd5e1002-8077-40a3-abd7-0a83e9916715", "comment": "Malware payload", "value": "9bfb2502edb176345690861565c1bfb880eee2623f4b25eb7f8cf2d478152fdff1eaedcdf20496390583357b13fef2d4", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998363, "uuid": "39502191-4086-4618-9f29-481f7fc79636", "value": "T133062354219654F9EDA700BE8A41A791F9A378834325DBFB00B8E3605F07DE41E3DFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998363, "uuid": "6062d939-1702-4fd5-9364-d550ca4482ef", "value": "f857730f3b2f98df7909878e8b7c5e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998363, "uuid": "d947dbe9-2d4b-4de6-b637-14351a3cd7e0", "value": "49152:4HpW014QLjKlp00tnl+OjdtZPhYvI0W/P7XYW9eBPgLVcC2Ved+CG:ipxiQnW00tMORPoyXUW9eB+58edG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998363, "uuid": "e4081a0c-6b6d-480b-b89d-9dcf33584d92", "value": 3735552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998363, "uuid": "f941cde2-7988-4742-b662-ecbc4451f344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998363, "uuid": "9d530382-6678-4fb0-a028-697eb00aaa0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f37fa1-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995156, "uuid": "de714c4e-f005-45fd-b046-2f7207a0727d", "comment": "Malware payload (XWorm)", "value": "243f264836a2f57447372bb849c7fbb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995156, "uuid": "36627c62-19c8-4122-90ff-8dd2bfacb5b7", "comment": "Malware payload (XWorm)", "value": "696ed5be254530bda84a13e8c51b0f02385a7adb785ca9c77b004f4728cc4009", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995156, "uuid": "73861f48-1ad7-425e-a881-86fa1fd7bdb9", "comment": "Malware payload (XWorm)", "value": "dec2b74dfcb55bdfd4be91e22985ce55173ebf22", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995156, "uuid": "f739f2f2-84c6-4e2e-9c74-0c2856c1d374", "comment": "Malware payload (XWorm)", "value": "b7db4d9d4e9e8d316ed92e5425ad557742c20f864ee44005146bf12f501c5cc5cee5fe9871b3e053690225a7c5682ee7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995156, "uuid": "a99f615c-f0fc-4d90-bbc6-d4a6bca3903f", "value": "T1D2633B86CF446E7927793CEDCD33C9B01019957CC221786967A3B210B23DB85E4BE99E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995156, "uuid": "23cde72d-d52c-4bf8-bb94-06de33d277e8", "value": "768:I8w/h62/jWs6oS+xISN0v9/XAGOdkfScBYrwz2y8kTAlGB:I9l/AoSSMFousrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995156, "uuid": "415254fd-82c3-4103-bf5a-0fef585f9159", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995156, "uuid": "809d73d1-9cae-4df7-90bf-618d5e80c418", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995156, "uuid": "9fce826a-a1d4-4849-bd17-75acf0feb21c", "value": "invoice-1645080830.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a025217e-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026231, "uuid": "dd201067-99db-4b17-b8d6-1aade01455da", "comment": "Malware payload (Mirai)", "value": "43b0371c59d55710688aab79a6a8229e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026231, "uuid": "ad014f73-a856-48ae-aa44-d9af8857d354", "comment": "Malware payload (Mirai)", "value": "69e1e7c522c6584463ec678e541ad054749ea4302433c4b45d8c0d4810f68970", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026231, "uuid": "0098e5b7-096f-4358-bfc5-6f0958ed7aba", "comment": "Malware payload (Mirai)", "value": "2e734101df52e4e2d0341189684ae257ada43fcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026231, "uuid": "ed544c77-829d-4d53-9dd2-4544f967c826", "comment": "Malware payload (Mirai)", "value": "a37242b0c2cd87e06fd0f9f4e31d13b776239da6e8b829fa9cd6f32cb0912500cf3281bb9d1446e31b1c2b352059a89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026231, "uuid": "eae97195-f6a0-4ec7-b031-e3baf53d150f", "value": "T175C30759B8929A62C5C326BFFA0F429D373613E8D3EF7113DD186B3137C651A0A7A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026231, "uuid": "bbc761ad-444e-41ea-8329-d267f39c11b1", "value": "3072:ksvdQkXdLQS1Wg3kOitGdE3Zm3JVTSrEyovu4k4FIA/BJjCBSCT+n535:TWkXdLQS1Wg3kGduCVTSPovRkSJjCSCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026231, "uuid": "6d75d435-1793-453a-bc72-22ee9d82e541", "value": 124076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026231, "uuid": "7839adf9-881c-493b-aecc-007ac75aa4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026231, "uuid": "8aa6c12c-dcab-461d-bf31-e89da7f55e22", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2942108a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995108, "uuid": "508229c8-4f37-48de-af67-dcee6865cb05", "comment": "Malware payload (XWorm)", "value": "f4ad2ce9e01feba399081bde0caafe15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995108, "uuid": "6b20caac-c1b6-41d4-925b-ac997aa988a6", "comment": "Malware payload (XWorm)", "value": "6a16ab0cdfb9d27143038450a454bfa1b4d29fc8346578c6167319d4c3a20fb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995108, "uuid": "b3f3ca3c-04e9-4b6b-9415-e05067d70e7d", "comment": "Malware payload (XWorm)", "value": "b55202872f4ad21a2c5e8b087c6a5a0723bfbf2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995108, "uuid": "32e79335-3f4a-46b6-9c6b-2c228afe0a47", "comment": "Malware payload (XWorm)", "value": "e15f347d44b5f7aac476da70c00066975885726743963dbea05ff14252a2edd81581d5f505a27c8eae1d8f7d21ca3469", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995108, "uuid": "2cbe6a73-8974-4028-bfda-41e36a008b3d", "value": "T11F736D31AF613DE462D580A21F34AC9CA45EBC31DD7EDC6EFE830198F53D91A4E0496A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995108, "uuid": "da3520f6-14c3-4288-a8ef-72bb183b160a", "value": "1536:I9l/AoSSMMAHRXTUOlXW9XT3DPJQEOQNeNNRnTQZtEzFbEzm4gcF91Xz0dmHzflj:I9l/5MD9usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995108, "uuid": "940ec22a-f099-4a33-a8dc-df6ddcee3bdb", "value": 73432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995108, "uuid": "aa2baf69-684e-47d0-8995-af7b9ef6a2e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995108, "uuid": "02c22521-d67b-4e70-8d2a-9be789c32041", "value": "invoice-1645080830.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a041e0-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013973, "uuid": "94c810fc-6a04-4c7e-b14d-b7a2e5693b21", "comment": "Malware payload (Mirai)", "value": "4f2043bfe1916c624148b64116b0dd14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013973, "uuid": "ba8a9aad-6364-4dcc-bcb8-704fb0d0a978", "comment": "Malware payload (Mirai)", "value": "6a43234d3e131588445926be7ca4bf8bf115434c3b047248627b399d4d7bdcbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013973, "uuid": "3fa5ec68-09bd-4ac4-95b6-a8ab16e7f10f", "comment": "Malware payload (Mirai)", "value": "9e4a15a47e7a73e30430fd14c0d056ea563d0a03", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013973, "uuid": "58d322ca-7edc-42c1-a58f-8f0ddd720549", "comment": "Malware payload (Mirai)", "value": "fb923c1e404e9b5d6815c01610f70b9f8742b70678c27d887f54bba0622c539dc7a02d12468e610dd8d81fb9c5e25365", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013973, "uuid": "8f89076c-2557-4aaa-8839-8761616dfe21", "value": "T15F5121DB02847B35D70D855EB7F67674A14AE083A7EB8704EA442C2D4FC9D4C7A85E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013973, "uuid": "0217955b-7b2e-43b1-8a18-9747bc7cb7dd", "value": "24:Hq91b12JMdCfCbiBBu4uuZpBECBEnE2EhEceAyb4bbw81tft0f0JUfBsRwbwhM3Y:o52JMI6biBoLuZjjcvyAGbwf8hM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013973, "uuid": "f051255e-47d3-4400-ae23-bcac630e3b6d", "value": 2855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013973, "uuid": "a9dbbeed-0880-41bf-8f18-6d5f80bca932", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013973, "uuid": "543faa90-25b0-4978-b1fd-5174ef81c4d3", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd777f4e-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996645, "uuid": "4bb02a9a-fc43-4165-8079-655fd5b1d805", "comment": "Malware payload", "value": "3f6476226612a1aae15ed0f84d94f374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996645, "uuid": "4be6ee9e-669b-4a1c-8f54-de33994462bd", "comment": "Malware payload", "value": "6a6487a8fca8b75d22792333413e95a0b1682720880bf12f67bcee2f414eb6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996645, "uuid": "25f98b45-149d-4432-ae81-1db7215800c6", "comment": "Malware payload", "value": "4dbff81732057720ff7633f5ad3a962af5f35360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996645, "uuid": "403134c3-4660-42c3-a2f7-938da14ca625", "comment": "Malware payload", "value": "1e0feeee7703e03dfe4b996dd408371d318ca084c7c608736f15f039c43cb495c5094285ac6dd14c1a5155120f7b3888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996645, "uuid": "a5b47225-2a49-460d-bcc9-5f6a5bab7623", "value": "T176959D14A3E801B8E867D734CA659333E6B078965330E58F0699D6492F73EE19B7F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996645, "uuid": "1066482b-e32a-4f2a-9ef7-febeec4b8571", "value": "091edfe3147290054b3545fa059aa32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996645, "uuid": "46dadd40-3403-47a9-9d5a-c5ec14db34df", "value": "49152:ul0gJCJN7zqSwnBNPlhhDH/WRVwP4aqW1Re25:u3BN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996645, "uuid": "71bdf903-49f0-48b0-8624-740a140b826a", "value": 1973248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996645, "uuid": "eb69237f-0e7d-4294-b6b3-5820728f983c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996645, "uuid": "1d17af5c-f9b2-4d09-8b69-37630c61a5ca", "value": "6a6487a8fca8b75d22792333413e95a0b1682720880bf12f67bcee2f414eb6fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73436f60-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766995232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995232, "uuid": "99abaca2-f117-4b59-92ac-9cbe6031d103", "comment": "Malware payload (Mirai)", "value": "b0235efa927777959bb9e94aa33ebfcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995232, "uuid": "015dccf7-bf91-4cea-a027-478595568808", "comment": "Malware payload (Mirai)", "value": "6ace4959d3143a19ff5ed92bd2aeabd2a4d4477cc8d6623651d77daa9a9cfb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995232, "uuid": "2c6fe4b7-6dba-40b7-97c4-ea369db5cac0", "comment": "Malware payload (Mirai)", "value": "a98fa7fbe46b6c4b0f80d0d4bdf5e557d292d078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995232, "uuid": "f1208a80-8118-4b3c-94cd-74059f0e728f", "comment": "Malware payload (Mirai)", "value": "09c76dc42b538bfec7fd14a8ddb612b0fbdc1ea33f69579f5144856c8d95edf2595f3ecdc88ed581d9639b5308b0ca46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995232, "uuid": "48a40e69-01d7-40d2-bb3f-526f7e985c24", "value": "T14BC2E165954BFFB4C5940C7ECED2AE8A133A4CD4B1FB327822188434688619BD4BFD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995232, "uuid": "b8be94c6-144c-41f9-b041-94177b56e5a8", "value": "768:LmyqymJqGGbc1iRszsMGNhwLezHVntRKCxHs3Uozh:LpqyrGGbc1E3OKTRNczh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995232, "uuid": "f0190199-ce79-4c88-aa8a-f7b3db1aaf24", "value": 26612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995232, "uuid": "c1e73866-544f-40af-92fc-d4d6b5a8fa30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995232, "uuid": "8d47bbe2-48a4-4673-9590-7a53d9a9f88b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ef4ed2-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995500, "uuid": "2f2b3217-abf7-4c41-af89-caec3bd59209", "comment": "Malware payload (XWorm)", "value": "2dc26fab58cba1b71aa0c67713053805", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995500, "uuid": "538cd414-e65e-402a-825d-e3d295b086c4", "comment": "Malware payload (XWorm)", "value": "6ad5304b08f92824c1823b31e7f08a38b91defef6632b3d62cf1b2fc71f28ccf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995500, "uuid": "0789f47b-243a-4df3-b311-915e173ee942", "comment": "Malware payload (XWorm)", "value": "68a83d4c38b7a6aa5285513ac76c705d36aab9bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995500, "uuid": "23f54153-1d7a-4885-8a25-cfc257bbc349", "comment": "Malware payload (XWorm)", "value": "3a9df3843a3738a22b23ebc2a7d2a5f685c1b9481545e7eff3ce6ec002f04b66453dec445a812f5eaa65c7ed5655f6de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995500, "uuid": "6988b60a-0ff8-44aa-a58b-e3737e8467b7", "value": "T165735A0ECD313E24B9068FD472AD04848BA57AAA3CF9497B343579B2318C45DAC56EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995500, "uuid": "d2034b7f-64b9-424e-984b-563b8bf86e3f", "value": "1536:I9l/AoSSMKqlf+Vq8Ln5evvlAN6+ZP29zUZzX4qfLKIF7KIOMm94Q8+GW83BGf8c:I9l/5MQtusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995500, "uuid": "ef464adc-74b6-4f5b-8346-057e96ab324a", "value": 73477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995500, "uuid": "a8bf8e0f-505c-40e0-bada-9e096ba82b57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995500, "uuid": "83d7f850-5cc5-462a-b438-46a15af3ffce", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76707819-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966891, "uuid": "3471588b-aac2-4a45-bf50-32465cf5b3cc", "comment": "Malware payload (Mirai)", "value": "98fcd5e9ac1eaaa10576b14225d29f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966891, "uuid": "7dc2a584-4129-4a79-b700-23e78a6b81a4", "comment": "Malware payload (Mirai)", "value": "6ad5631282f01be20290be6d72f5c40b9abee98fda2c5723e122a686d141a205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966891, "uuid": "8144f3e5-9473-4770-ae65-5ed746e10e5a", "comment": "Malware payload (Mirai)", "value": "98cc04202e80a5d94ba49d34a4a4806833488ea0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966891, "uuid": "befa62da-2de0-4711-bacb-29da046e2f41", "comment": "Malware payload (Mirai)", "value": "0add154e7b5f2c7ee5024f639fbba93fde1cf8f6d1e58aae9476d3537407b77a7451e86bec89074e56e27d0cc68e29f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966891, "uuid": "e0f900bc-fb1a-4ec3-875f-2645d6d4a592", "value": "T118730218ABED50A8C8EF1C3C53C987FB9F53E85B4A8F5A995D400E8C70A0547EB5C2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966891, "uuid": "77b2410e-d3d0-410b-814a-fe392d91e32e", "value": "1536:TRYVQpQzXvK4uyiJlgVlg36UV/WLyRWzIeNgiNcs83OGAjBJTJD:FGQ+bvK4/vytPk3DcsOOGAjDTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966891, "uuid": "3766114b-1554-4eae-81c6-264431aad9ca", "value": 77552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966891, "uuid": "8462cd9c-6d6f-4256-b495-05ebafa64940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966891, "uuid": "10d1614f-8040-489c-ab38-c1c62b67499d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574ef53d-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982301, "uuid": "2bd895b8-82de-474c-b1ab-7f70e0cd554c", "comment": "Malware payload (SalatStealer)", "value": "4f07835e7bd5691afce9bcd68a0bd6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982301, "uuid": "0830fd72-87d9-4b2c-85a7-066b5efb2931", "comment": "Malware payload (SalatStealer)", "value": "6afe7971a072a9654969c152e420978cd54c2762a3e0ebad8518a8beae4ba89e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982301, "uuid": "ddbf2f26-c765-4bde-b12d-92f41e867580", "comment": "Malware payload (SalatStealer)", "value": "506820e436fc07c1b67f37bd18a0902b1fccad6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982301, "uuid": "a9063e89-e449-42d9-a477-37952320c379", "comment": "Malware payload (SalatStealer)", "value": "90bec0588862bf055161f597f991cacf8c60e6ffcda674cc6630f522e838d15df3924c7fb291789e18bc44cde9e312ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982301, "uuid": "21e38e35-ebcf-4458-8be5-8240ff9ecf0f", "value": "T191C66C50FA8B56F5E903583241ABA23F23315D018B28CBDBEB543F3AFC776911976609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982301, "uuid": "c150e0b8-9008-4e00-837b-62b8569c8559", "value": "98304:DrsosaMQ/ObYOlEl2kp/Oy2ywVR1JjdhzyVQnkvlHzPDVdeNUMOp+ifx:16zlEl2kp/Oy2ywVR1JjdhzyVQnktt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982301, "uuid": "ed3ba6ef-bd90-4f4d-89c9-a74fdc90ea65", "value": 12088320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982301, "uuid": "b9fda1d3-54e7-4d00-a17a-579acb9afa4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982301, "uuid": "c0709832-bce0-441c-bb55-f57c3b3b3806", "value": "6afe7971a072a9654969c152e420978cd54c2762a3e0ebad8518a8beae4ba89e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f3ff53-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995069, "uuid": "7dfa00b9-a465-44d9-b9b4-8ea297af1f68", "comment": "Malware payload (XWorm)", "value": "382d7633123045b205519cf4354ff5a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995069, "uuid": "564ec579-f1b2-4049-9e23-d16ccf0f1ec1", "comment": "Malware payload (XWorm)", "value": "6aff1d4739840e515285e51acb82383767618d8825904312719ef3026428d825", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995069, "uuid": "818bfbb8-a07c-4c4d-a6a0-15dd7f9ac87e", "comment": "Malware payload (XWorm)", "value": "ac3a63e30c9b805728a3b5865ec9412c3912e793", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995069, "uuid": "22248755-c668-41b7-8b9c-1149d049e2d0", "comment": "Malware payload (XWorm)", "value": "30de607809ad86a4a6972b8a0ca447f43171cdbb63f15f96060dad4d41cf243e7f3226e70a63e115075a84f93632a290", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995069, "uuid": "81319a08-051e-4710-87a8-4b01ccfde1f4", "value": "T166631B96AC802878B170DE92CBB15FE61E9595D140D3DC7BA209C23503AFEE3D927D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995069, "uuid": "d11aab07-3a8f-4df9-9d75-db9af278945d", "value": "768:I8w/h62/jWs6oS+xISN0vK3S3y3VHadkfScBYrwz2y8kTAlGB:I9l/AoSSMkMsV6usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995069, "uuid": "54e467eb-5ecc-4cab-a797-aa66a0d679d0", "value": 70675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995069, "uuid": "39e4d010-693e-42db-b0a0-0fe4c54223ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995069, "uuid": "1ae05a08-f59a-4a58-ad39-dbcd8ae85aad", "value": "invoice-1645080830.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29461af9-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026462, "uuid": "9f304b8d-f684-4da4-b953-940c785f1ff8", "comment": "Malware payload (Mirai)", "value": "b672109c684efaf215cefa6242c3ff63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026462, "uuid": "68a5ada8-7f23-47c4-a013-0036ca8edd67", "comment": "Malware payload (Mirai)", "value": "6ba962d0e5611e18ec7976826d5ea16e524aa8c5d5d92669aeca4da9cdf325d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026462, "uuid": "53a6df2d-2944-49e3-9bc0-5a3643d85e38", "comment": "Malware payload (Mirai)", "value": "cd9a8870ec2adb387134e8454246db12a44dda1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026462, "uuid": "12f1bd61-3070-438a-afda-d6fe8c5db6be", "comment": "Malware payload (Mirai)", "value": "65457e5c88a4df243f2a92710cf58bd2afeda124498cfcdd1b4bd5ea562e4d54066316a451d3251892e946dcaf0e6b71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026462, "uuid": "84f49cd3-814f-45ec-9ff0-d7a10b465852", "value": "T17F530945BC81D617C5D462BBFA5E42CC332613A8E2EF7217CD11AF157B8A82F0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026462, "uuid": "16e12210-acc3-49ce-a241-0a3adc0ead3e", "value": "1536:Seo3oJq/EsWvmhpSpYCEBJc4LSR3+uM7R:+30qmYvSR3+uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026462, "uuid": "5c990483-df5e-4777-8e0a-2c18b4d61722", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026462, "uuid": "8f99dc57-59fa-4f49-a530-3781374efc17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026462, "uuid": "7a9ee4d4-af4d-45fb-bc89-20c5d33d6f5e", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73206df-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766967429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967429, "uuid": "bf4afc4c-2447-4eb4-89a4-2971d40d19c8", "comment": "Malware payload", "value": "50cb92a3a002a8507d39b69a397bf9df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967429, "uuid": "f8d2360c-1c0d-4d0d-8e3d-fb1b72ce0acf", "comment": "Malware payload", "value": "6bd593814bf13c8d75cc27d29417a76e4d0f869e26a9364fe52cb87e55ced3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967429, "uuid": "3db744c0-848c-4312-940a-171fd9012067", "comment": "Malware payload", "value": "2a34d913b30968f4d46755155468e9b802e5551a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967429, "uuid": "80329054-186a-41ec-a67a-6335fb9d6c68", "comment": "Malware payload", "value": "b73ae73e0062439791227903a9246eeb4ca869a1be468c7fd0a6667f04b0ade7101ec3a90eef8eca4c67d1f9f0805248", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967429, "uuid": "9e026bf7-61cc-4dc2-80c8-8d942f72b884", "value": "T145635B038862E870D99150790A1BD3A08E32E031B467DD1FF7ED27A1FCA6794AB5637D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967429, "uuid": "e6269aac-8b9e-408b-ac20-38de8b63d3fc", "value": "1536:56KoAMquA/kR66FTZJfrLmKmY2JlIJFZfEYCBz42qfS+c:5JCdmY2kr4oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967429, "uuid": "5ebbcf7d-29b2-42da-8fb0-f25a0ddf1fd4", "value": 71224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967429, "uuid": "763ea84e-bb97-444f-b907-71519bb0a929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967429, "uuid": "5009add2-a6e8-4f17-a8db-0c1cd0f784b5", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5c93ff-e453-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970605, "uuid": "3515f767-5ee8-4216-a543-95194fb3d2d8", "comment": "Malware payload (Mirai)", "value": "a2520dbf536b09f91b6eac207a59540c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970605, "uuid": "01b3070c-85a6-45bb-9672-d802c4b3a6ba", "comment": "Malware payload (Mirai)", "value": "6c3bd890c8c6359c1f48831d9b684343d867ed378cca12229ca21f1c86e5439f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970605, "uuid": "81724b8a-420a-4527-9b75-95d850899251", "comment": "Malware payload (Mirai)", "value": "9d0c464258fff24127783a4a0b7e734e1ac91828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970605, "uuid": "5c0e47b0-1f9c-4d3e-b3c3-4ac5005fbb26", "comment": "Malware payload (Mirai)", "value": "7fcb11084dcbab55f593a8b23913b111bb70948728126de9cabd107f6f9bd7e1e62c8647f7428682ca18bdce3b9dec75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970605, "uuid": "e4ecb698-9ad5-4b32-9e73-0da1e97f9ac6", "value": "T132333B21B9761E17C0D1A4B621FB4B28B6F107CE26E8CA4E3D720E5EFF619446503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970605, "uuid": "7a03ddbd-ae87-482c-ad89-6ef7b95fb056", "value": "768:5voBqa53zWAOXtdtP8PxHszRaBT1BwbuhhIJQQcO+s5tYGqww:5v7a536fDP8PR20BxBw3QQmsTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970605, "uuid": "acd643d9-32b6-46b8-9fb2-b6ac000e9245", "value": 50184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970605, "uuid": "9bf8cbe1-2650-4153-93ad-d78dc0954434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970605, "uuid": "9f99ccf5-8802-47a0-823a-08a2fadde398", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a7738d-e4de-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030504, "uuid": "0d2d15d6-bd7a-46d0-810a-30b862f28ff9", "comment": "Malware payload (Mirai)", "value": "d06de9de3e57cf39ea5df7a05a843c18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030504, "uuid": "80adad2b-9d21-4bf1-8f11-082ee941daf4", "comment": "Malware payload (Mirai)", "value": "6c3d85191eedcb0d2d5cd1030b74a1bbaa354caaf3799fbb5aa59c27a60e7cc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030504, "uuid": "d23707ea-5c84-4d11-957d-e6caaf97870a", "comment": "Malware payload (Mirai)", "value": "980a6576b56ee1023a95f88e211266486bd191fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030504, "uuid": "426c0387-603c-4864-ae1e-c2eb791aac55", "comment": "Malware payload (Mirai)", "value": "57de6581ac406bc276834813c6963db14a5387268e02ebf88a616a25d7ce334fd7ebe6b16908d3719ef27d9d837d365c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030504, "uuid": "cb3f95a8-51a1-403c-b934-d3d95fc7acca", "value": "T1AB142A46F9418E12C1C211FAFB6E518D37136BB9E2DE7202DD246FA037869EF0E7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030504, "uuid": "3ade366a-1b1e-41d5-9728-7d0d6df32a8e", "value": "3072:bsEQjBnr77yxAgOQoUmoXupR1aYZuNLVkf0Yf36uS4rj6hh11LtH:bsEWBTyxA/78XupfaJOf0M6uS4rELtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030504, "uuid": "0150d1a9-f8ac-4454-8490-6fc09575f3d9", "value": 205956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030504, "uuid": "32b2b048-1de9-4cf9-9e29-4f2d69c5f90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030504, "uuid": "86aafc61-19ce-410e-9741-f63761cce726", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dc4eae-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1766982318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982318, "uuid": "372f142d-0a09-473a-af1e-5c965ebc6183", "comment": "Malware payload (LummaStealer)", "value": "31bf0e73aa39b95293b409489bbb6c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982318, "uuid": "9f8bb441-2800-41d7-9777-c699342c6ff6", "comment": "Malware payload (LummaStealer)", "value": "6d41e8f5cee67d1d622017ff67530b4d59a70568b8e1eebf3f963f15014bcb94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982318, "uuid": "5a5bbac0-0c21-4a90-afc7-4c8577aa314a", "comment": "Malware payload (LummaStealer)", "value": "8f13944d08173ee085102061680dbde6f1f1dcfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982318, "uuid": "6c969b44-87b4-4c4b-89e0-0e64292f5e66", "comment": "Malware payload (LummaStealer)", "value": "3dd56bcabdd01a5a348742bc73920c82c5d5735f4d39de9780089001b3f4782ea3dc5e69899803a57638e373963fe875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982318, "uuid": "72e174f4-395f-476d-9292-1c589b6bafc5", "value": "T122C65A11FADB54F1F9035831406BB27F63305D048B29CBA7EB587B6AF87B691183B609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982318, "uuid": "2e0180c8-4a2c-42b4-9013-71a403d47657", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982318, "uuid": "e81aa88d-663e-4dbe-9eba-5a8331d0c9ba", "value": "49152:M07EZv9FgEASEHJnOyazd+yzrRAhP521xVc991sC3dN9bp7JP4fI/cr+oo7yaxHO:1EZv9FgjHJOnz0Cj7uWU9bL4lBDQEqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982318, "uuid": "b39a55db-dc97-4427-996d-601d95beb973", "value": 12442112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982318, "uuid": "320053ae-427d-442c-9b5f-bf6343c73658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982318, "uuid": "17f17688-f835-46b1-9636-0138b595b7bb", "value": "6d41e8f5cee67d1d622017ff67530b4d59a70568b8e1eebf3f963f15014bcb94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0434538f-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970994, "uuid": "f6f62799-9305-431e-a40c-4e3f38d2f79b", "comment": "Malware payload (Mirai)", "value": "fc6f70911021a99a412d2fd89554dde7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970994, "uuid": "a7b8c63f-3ad6-491f-8b0d-4fc4c904d8c0", "comment": "Malware payload (Mirai)", "value": "6d901c03958dbe5516f4d20c6b3de5704788f95d2576dab88ce2da723a92e386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970994, "uuid": "f72f0cad-c751-419b-92d9-afd605f003b1", "comment": "Malware payload (Mirai)", "value": "d10129db98cc1c9a63426bf8478c5eb5cdcda018", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970994, "uuid": "a5ed3a92-20ba-4da2-a9e7-728310bbd413", "comment": "Malware payload (Mirai)", "value": "546f1367761d9349ff4d0e88cabc89c071d59a175fb79230f8ef5c450d92e270e1e6c377fd01b606c84663ae68c93322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970994, "uuid": "705d06b3-22db-44ce-8ef3-d0e283a3fc73", "value": "T18BB31A95B842AA22C7C256BBFE4F428D371657D8E3DE3203DD185F6433CB95A0E3A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970994, "uuid": "4af6c336-36fa-4e82-bbe2-c1b43bdd4bfb", "value": "3072:LdrnPjQo8X+Xt/TjpTmxvXO2qrLyaza8nz4:LdLPEx+9/TjpixvXO2qrLyFY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970994, "uuid": "5daf7564-5f60-41b8-a24b-3540e7ad2650", "value": 115928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970994, "uuid": "0ac0d2a6-1e69-4ffc-afc5-2fb5e8199ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970994, "uuid": "181f2451-21ff-46f0-90f3-4c5b858ca355", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13eb362-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995363, "uuid": "98b4455f-f786-4323-ac1c-e6f38d3bb706", "comment": "Malware payload (XWorm)", "value": "cc136cf241e6b476735ecf96b270e9c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995363, "uuid": "c65d8797-beab-42ee-9006-3fe5203a859c", "comment": "Malware payload (XWorm)", "value": "6dca907ae75c3f77b36bcff97d674636fb5e42c61f092cf33e93df1662c3c5fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995363, "uuid": "dcfcd960-0d1d-48e4-9ad3-7b542f230edb", "comment": "Malware payload (XWorm)", "value": "c8c9282ce2783d396d3cf60dce236f561da4e4de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995363, "uuid": "00f2f14a-5103-4d38-b8d2-a1c2bacf248e", "comment": "Malware payload (XWorm)", "value": "ae7dceb8ac63edac909ffd41ddd526e163ec0a0245d9964535e3176bf80cd2e72a97c4183a41fd8ecf1930f0783b9d8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995363, "uuid": "1d902c33-e5bb-49a2-940e-2da6d6ec8b12", "value": "T10A634CF2EF2D120AB41131608B423BC2738A17EFC2EDE971664D56CA0D4D647D9BB99C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995363, "uuid": "bc83c22f-f9e8-444c-a776-baabe14aeb07", "value": "1536:I9l/AoSSMsi5/0qwYNq/IYfImLVstP+I2jzobG61mD8l5FgZgHngcibIRyCLdtem:I9l/5Ma/usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995363, "uuid": "8a4981bf-f4a3-44cc-9f94-388d1543c3ac", "value": 70616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995363, "uuid": "58edf06e-4c8a-4841-9918-0974e039cd2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995363, "uuid": "6f5eadbc-ea53-42be-8890-a6ce74ce6983", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97460b89-e46b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766981119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981119, "uuid": "85951455-74a6-477a-b485-efe454a31242", "comment": "Malware payload (AsyncRAT)", "value": "7576c6b7b3cbe0ab160218eac48611e1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981119, "uuid": "fcece183-d2a9-4faf-8372-f6e837ce8e9e", "comment": "Malware payload (AsyncRAT)", "value": "6dd3846bafb8cb43b5f9cce56a7eebb7f0c98a67320cd473ad519f4ea96f47da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981119, "uuid": "4b49833a-f653-4569-9894-f0b6ae991f93", "comment": "Malware payload (AsyncRAT)", "value": "4b4e3cf792674316fb910def29fab56b39b68b63", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981119, "uuid": "c5facab6-5eb2-427a-9d19-6f4a2cfafbaf", "comment": "Malware payload (AsyncRAT)", "value": "8c14daaec0c75e26f554d547db81da795dc91484f705c7754245cae7844a67de5d1e85e5ce329bdb77847f1ece7fba78", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981119, "uuid": "3aeb4d7e-aadd-45a1-9500-ff7c2f66898b", "value": "T157C22B0473F48262D1EC4BBE4832A200D375E68B5D53DB9F6EC495AD2A337CD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981119, "uuid": "413a4e7e-45cb-401a-92a0-1c18dd41122c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981119, "uuid": "735e75c3-02fd-402d-96c5-ae3a01e244ae", "value": "384:/YBbfn/sgRBzgevoQktIMymrJhxsHqqbuUsJQxnCJf+BWfXWU/gu+:/Yxn/pRBEpQkuMyCJhxCFbHBFBvu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766981119, "uuid": "9d83e16b-6d04-48e1-9fa3-2fd718d66059", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766981119, "uuid": "6f7dd79f-1402-4c0f-abfe-0ae431177030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981119, "uuid": "17037ae8-d0fe-41ba-b189-6675e533a527", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bbee38-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995403, "uuid": "57430366-27bc-4368-a8b4-aec50faf7f94", "comment": "Malware payload (XWorm)", "value": "16caa5fe51a5b50bf45bdefae5d12a1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995403, "uuid": "51ded9c0-dd88-47e7-8c88-9a180b9e3e37", "comment": "Malware payload (XWorm)", "value": "6def2de6420c2159fcb20daaf18ebeff3b8842579840af6adf95933bfeeb09b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995403, "uuid": "e2e1aa41-0ca1-45c5-a88e-41032462e5eb", "comment": "Malware payload (XWorm)", "value": "6bba5aa1168f34399e1356ee021dc2659681a65f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995403, "uuid": "fa7c5142-fc97-45df-bbbf-1b60d71105e9", "comment": "Malware payload (XWorm)", "value": "f5b0f8ce07e21cfbf46f95fc0b555015949382cf62a5f2b3346108355ca4f501460f465a169964480615732bbccb5ad8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995403, "uuid": "3ea535a0-0019-414d-bd7d-aaa048985efb", "value": "T1A8730CD897121DAB959320229C533DFEC60E3E5EFD0C9250AB6619304E396AFE10767F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995403, "uuid": "aa6e4f94-ea37-465a-bbfc-1b8a4a0b005d", "value": "1536:I9l/AoSSMaQIHHqWhQ/jipCUqYTLOIH4pR39fJlOi6qzxqYxVX/lFtGxN+Z2Ad/N:I9l/5MaQIHHqWhQ/jipCUxTLOIH4pR3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995403, "uuid": "5e77f909-6f32-49a8-a4d3-037800f6c8ef", "value": 73393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995403, "uuid": "85c0a0ee-82dc-4e61-b29e-8a44ff227923", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995403, "uuid": "59755d1b-7add-409b-9651-196d63de7daf", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6263e9-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986574, "uuid": "6249ff2e-754d-48ec-8f80-4aef26ec7f37", "comment": "Malware payload (Mirai)", "value": "17ebdf8d52cb2a9f54a3ca28f00f5e20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986574, "uuid": "f05f8ee4-17bc-435b-a0de-15152819132e", "comment": "Malware payload (Mirai)", "value": "6dfa68b943a44a5754e601fb7512772928b45326c747d366e5eafdc04cf32e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986574, "uuid": "84575d0e-0cec-4806-8c94-13f7fbece9a9", "comment": "Malware payload (Mirai)", "value": "3d68a0afbaad1d72f9a641b20e0629cc2365636b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986574, "uuid": "61f33405-c3e2-4bb5-8364-324cf1f35a32", "comment": "Malware payload (Mirai)", "value": "c1533b23751363d8ea105eaeb30d157c5d43dd038c6144afd04012f369ec4ebf18c49da1a944f4bddd9b8a4ea3fd5b84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986574, "uuid": "b0afcd7d-63e8-4a18-98af-6443ea133639", "value": "T179D2D06EE57542C5FD8D5C3E80CC3FA01E1AE681231BEB9267128C4D5B32C5AF16E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986574, "uuid": "274e5525-9f40-41c6-a88b-1ce9f8a00858", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjY1RWGVCz0Nvj:FMYHb62x4ahQ3CfdwLjhWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986574, "uuid": "25eefec0-162d-444f-83cd-2980a806c494", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986574, "uuid": "dad8b32e-ed27-4e9b-8bd9-dde13ac97ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986574, "uuid": "d9d3f28e-2a9e-4ce9-b68f-c468f2d6bb5e", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2189d8af-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995525, "uuid": "b2f7ba39-40a7-4a12-b681-06f8a04d7b36", "comment": "Malware payload (XWorm)", "value": "0ff9121108e38b3ff2b5b1d300d15ca4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995525, "uuid": "ce43323a-db08-4a80-9e35-d4105f2c07f2", "comment": "Malware payload (XWorm)", "value": "6e6066c6fba07c53b7dd7661566b76788fe009090387ee86bec79a2e1eb8a830", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995525, "uuid": "3c13f234-b3b9-4e2f-85b9-1c17f833de87", "comment": "Malware payload (XWorm)", "value": "a7c3729f5296a80a01a28923a86ecf728ba7871e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995525, "uuid": "0d01f481-83a1-4497-8533-657ada71616d", "comment": "Malware payload (XWorm)", "value": "8991c170505fa8447839356f779731b4bead9c81fea249b8861f1d4639971aaa8e0471b383f4b98a8ff5945a860b373a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995525, "uuid": "cc491b3a-4485-4c69-9e56-e49bcb0b8876", "value": "T1C2634D2E3C275DFF3CB9BCB82B0635ECC6161064D63A5B01E674891BC874E620EBD599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995525, "uuid": "4188b121-fdcc-4fe2-a823-b6d4562ea97e", "value": "768:I8w/h62/jWs6oS+xISN0v8KuM52dkfScBYrwz2y8kTAlGB:I9l/AoSSMrQusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995525, "uuid": "68c75901-5c85-4579-98c3-06cd78a87469", "value": 70552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995525, "uuid": "ea7ac2c5-747c-4897-a369-64bb69bf1e29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995525, "uuid": "fa29b146-f16a-43bf-9808-dfd4aa5afe86", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494df8b9-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996021, "uuid": "359f4456-f469-4701-ac7f-2a02fc5b1f17", "comment": "Malware payload", "value": "0f2c837a7344253852ae762017f7eda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996021, "uuid": "cb485e51-d040-4d44-a6c7-0f8f8122e384", "comment": "Malware payload", "value": "6f50c3bfb61791711f38520c990323baeaaec8e53961ff2de58397975a8a0db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996021, "uuid": "32837751-9a86-48c4-8f0b-49bbbf95b7e0", "comment": "Malware payload", "value": "186f1b60f01f79634de8c5da9c809e067ff82a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996021, "uuid": "3630ee89-b804-46a9-94c9-1e5a9279851c", "comment": "Malware payload", "value": "d2fdebd799108660fd27079c744b2ac7a6544bfd977486641a6ad5634ea387f9bb5f9de7c642842abfac11b2ca6c614b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996021, "uuid": "1053d65a-24dc-4725-8e2d-688bc6eb1cc5", "value": "T1B3B53A47E2A350ECC16BD1348666AB77FA30785901387E6E1BD4CB311FA1F60976EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996021, "uuid": "12a9ae26-4fbc-4600-b3c6-8bb1cfddd3fe", "value": "812daaf2a6fe210ada96892c6c58bfe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996021, "uuid": "95684a6a-f39c-433f-b05a-11fdd18bfd7c", "value": "49152:kzcZSYSeMWFb+Tx9Zlhh7LRHCloY3LReuh7FfHKm+zpp:TUnLPh5LRHsHhhSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996021, "uuid": "3f804856-2536-4ed2-affa-9c5226f2df52", "value": 2435584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996021, "uuid": "b920eb66-19b6-4176-93ce-7a10daadd354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996021, "uuid": "6c1316b8-4d63-40bc-9691-0ce1fd3eae89", "value": "0f2c837a7344253852ae762017f7eda6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78e06ae-e4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (TrickMo)", "timestamp": 1767011722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011722, "uuid": "276dbda6-ff32-4bb3-9f53-ff63806ebdbc", "comment": "Malware payload (TrickMo)", "value": "cfa1868536caf83b6746a34acde66b65", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011722, "uuid": "c2d99e1e-faa3-4818-b793-41160e10b9c0", "comment": "Malware payload (TrickMo)", "value": "6f58b07b5ddabc29c9c7e7165349edbd2bee923446514044d67040de2f36664a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011722, "uuid": "7b3a12fa-df83-4fdf-938f-854095be53e9", "comment": "Malware payload (TrickMo)", "value": "ea715db5a02064ebdece9dc9a80800afb5f1bc73", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011722, "uuid": "ac8a1b1a-aff5-4345-ad8c-e667e4f32727", "comment": "Malware payload (TrickMo)", "value": "b0166271dc245ced26ef9950dde12a595e9cb9fa107e94772367a7f8b466c6aa6cfda773b94c42e98510222e5cd53549", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011722, "uuid": "b8e4a316-5649-40bf-a5ae-8edbec212e40", "value": "T1D5761203FF5AD59EC0F7863389B5617101429E55CB8392472958B3AD38BBAF08E4AFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011722, "uuid": "1200650a-72f1-439a-9e10-8eb0d561d689", "value": "196608:uv0m+QSpt3EBvv1lQW8RnLwia6aeB0LmGFj:a0mbScFQDD1maGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011722, "uuid": "05279e7e-dec3-4fd9-835e-c2b9a6887937", "value": 7281995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011722, "uuid": "747b1279-291e-4792-975f-3887e662a346", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011722, "uuid": "888f2c76-aca1-4344-9d64-0c15f9ad63a0", "value": "payload.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71157ec-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011345, "uuid": "c03606a6-88fb-418d-bf85-86ecfc2c5da7", "comment": "Malware payload (Mirai)", "value": "2a7a3719a06c2300b98e5a354030812f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011345, "uuid": "d2a0bd02-6b62-484c-935b-228423dd04ba", "comment": "Malware payload (Mirai)", "value": "6ff629214a73e4d8586851350c81268b1454550247d2c1afcb047bb99307eef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011345, "uuid": "2a7b9ddd-18d4-426e-81a3-cfa502815f1b", "comment": "Malware payload (Mirai)", "value": "232019bcd56e81e94b93cbc9a768aee549486ccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011345, "uuid": "53bedbd8-1d9c-41b2-a5c7-32c92efcf71c", "comment": "Malware payload (Mirai)", "value": "8b8a63428b8dca5c6019ead83e63869885b06a3c2a8c2dbaaaa1878f47661263f30fc78ec67e8a9cddd0103ee4b65cc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011345, "uuid": "81f62c37-4c32-440b-a4ab-bc14fcc91017", "value": "T18183C382BE43DFB7D85310F142F75E618A71FC3A1C36C5C5E366BEE18A111C1A61636A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011345, "uuid": "bd9ca19d-873a-4897-98cd-0a7cb2d17fc2", "value": "1536:8ZdrD/GN5bBJbQKWQwHsqHpX6340elQD3a:sRWhBIpHsqHpX6uia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011345, "uuid": "a03b6860-4615-488c-91d7-747ce9ce1ba6", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011345, "uuid": "d6c7b799-3fe1-43e0-8f2c-0dc04946d91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011345, "uuid": "726ef243-f536-4a6d-96dc-14019e5c2bc9", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569442fd-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026967, "uuid": "9a960437-8f86-470a-b9b5-c77c11cb2ff5", "comment": "Malware payload (Mirai)", "value": "023a3e2eaba2e464641e3f7a904044fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026967, "uuid": "fdff848d-de71-4a1c-9268-6b59bf83befd", "comment": "Malware payload (Mirai)", "value": "701363cb1d691b8741c6ac6688576993ed3e77645e1e7755aea86ec34f5d2ef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026967, "uuid": "6d352df2-295d-4122-9879-48fffc77b182", "comment": "Malware payload (Mirai)", "value": "507ef1f200a437e3eaba01897d5d19e79d7e957d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026967, "uuid": "e9024910-5cf2-42ec-a232-26460373a32c", "comment": "Malware payload (Mirai)", "value": "1dd780fbb3029ad7da907d8e6215fb482d546b8bf620271eb448551bf4ed76f73bc6cf766614106e7b570d9453b702ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026967, "uuid": "f7f21762-f3f0-4cc9-acee-0db354b7bb04", "value": "T175245C02771C4E47E1532EF0263F1BE087AEEDA628F1B584651EFE855231EB22485FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026967, "uuid": "4b172fc8-52e1-415c-8c55-e12c5058b06e", "value": "6144:knR3KKap86nkgl7Q97TfUdxVqytYIJHZA/fw:kRax7nkwEbU9qyjHW/fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026967, "uuid": "867e12eb-f76c-4997-909b-9741a6b4f84f", "value": 223364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026967, "uuid": "282a6091-b08f-4920-b24d-e184f0de3a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026967, "uuid": "3febe5da-46da-497a-8bba-b9e5fdb1f77d", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bce0e8-e45b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766974278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974278, "uuid": "7a6dc44f-e5b7-40c6-890a-5d40264f7c73", "comment": "Malware payload (Mirai)", "value": "93f652ff857c5d475196a664dc6ee70b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974278, "uuid": "e9733c6d-495e-4c01-8627-64699e06a578", "comment": "Malware payload (Mirai)", "value": "712b0d27f9a29bf1eb7bff20c6f8955b73e09ddc89dc88d88c0905c1647df76b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974278, "uuid": "07be7920-56a5-424a-afcf-653d6360f876", "comment": "Malware payload (Mirai)", "value": "1804b93bc2fe69fb00bff9677efd236e4d1b8f00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766974278, "uuid": "8e43898d-2501-4760-bf92-3e90a9d2ebc3", "comment": "Malware payload (Mirai)", "value": "8b52f0cbb4679d656a65bc12fbf04f455dae1aa2ad84e11817045c37ed8aebc8f99b0040cfcc744bb0159a629dfebf02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974278, "uuid": "03ba0adc-61ed-4a25-a004-0af476a59e27", "value": "T1DFA36B02B58084FCD4C5D1785FAFA226C932F56D22B6B65E23D07F263E5EE113B1E264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974278, "uuid": "0acb0c12-cbde-471f-9138-2eb194587a93", "value": "1536:L+uzQuVqx67EvAYmsgaiSYjusQ1pqHlGFuxJebvacLtvm98bjMflf4lw/7k:LU6dYmaYja1pqmuxSvacBm4jMNwlw/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766974278, "uuid": "73a789e6-1773-4d2e-a0fe-9bc1f92f82ca", "value": 104512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766974278, "uuid": "7bac50e4-d01c-41b4-bca1-41ba8c3a1033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766974278, "uuid": "37925017-fc26-44e5-951c-eda5133f416b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2184ffe-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766988520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988520, "uuid": "bb82f4d1-8a60-4b3b-81e1-c0f27aea9a09", "comment": "Malware payload (AISURU)", "value": "8740f60d6411db5fa6619d498822a41d", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988520, "uuid": "5184c23e-f31a-4d89-a8c0-6819ee7e6aa5", "comment": "Malware payload (AISURU)", "value": "7135adc9a9a17830f0e4e7b6aae59fe199193008e66085c53d7ca426256b1a93", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988520, "uuid": "2e024d87-55c9-4275-88aa-a3006dfcb0a9", "comment": "Malware payload (AISURU)", "value": "6a7016adddd068f5355a1f22661ca8651d7132d1", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988520, "uuid": "fef08076-d0ea-4459-bcf4-389bf2c75d64", "comment": "Malware payload (AISURU)", "value": "0c229468028726339f7b1ddb850005af4e2f6a947318c2bd407ff97b4c4eaefc8f427060e31ab6b8fa42db477794c6e7", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988520, "uuid": "d061a3a9-feb6-44e7-a01b-504d5993ff78", "value": "T17ED30856B8829F21C6C246BBFE4F128E331357A8E3DE73139D145F24278B95B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988520, "uuid": "a4299a09-8956-429c-86cc-dc4d70a318fa", "value": "3072:FCJ05Entja/oIuV/dYmwqLShgHZrVWqVKbTMRbqaYfA+lmiaOOFGB3nTW:FCG5Entja/oIuV//wqLSmHZIqVKbAROS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988520, "uuid": "352b1487-5857-4a9f-a9ce-14a2c151e827", "value": 136344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988520, "uuid": "765758e7-94ff-4c4b-9845-66363bb67da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988520, "uuid": "9b26e478-9b24-4d68-925e-9c26e48f12ff", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5999d013-e48b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mimic)", "timestamp": 1766994760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994760, "uuid": "10c156a1-1b93-4a70-9b87-b978f5fbbd85", "comment": "Malware payload (Mimic)", "value": "c24f9935aa6de49e1efaead2c346be3e", "object_relation": "md5", "Tag": [ { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994760, "uuid": "720e8036-80b3-436d-b384-5a3e27755884", "comment": "Malware payload (Mimic)", "value": "713cc4f193b1534ef893a44eeca8b4eb25daab501c5718351e34715d5dfd617d", "object_relation": "sha256", "Tag": [ { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994760, "uuid": "46ff8cd2-64cd-430c-91a1-7f95385798e2", "comment": "Malware payload (Mimic)", "value": "d5b16b6d2eeeae39e02bcaf181f7cf860446b385", "object_relation": "sha1", "Tag": [ { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994760, "uuid": "46583159-e0b0-4b23-9200-4a9073c0069f", "comment": "Malware payload (Mimic)", "value": "4519c29b0648706e2ef01ea81d1cf5e7d5596e6b558ce79ad13d1cca9170f91e53151887cbe0eeb6acbb338895e5699e", "object_relation": "sha3-384", "Tag": [ { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994760, "uuid": "3b4058e7-4aec-4fde-ad86-f2d58d8d62e9", "value": "T17D7533910656BE5DF281AAA4A15FFFE791E56EF44C94063BC7C1103C2EF513732BA028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994760, "uuid": "2377059a-3798-40eb-8264-c231763872db", "value": "49152:TO1a8KFyVCca0FFFPE8CGoCf8QxqsaGKwNbC:TOw8IyVq0FTPEntsssww5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994760, "uuid": "381abb4b-6850-49aa-b4ea-50bfcdba2670", "value": 1692223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994760, "uuid": "dc6dffe5-ab4f-422e-8f70-71337ee63fb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994760, "uuid": "796ded87-35e2-4223-801b-563d0b23792f", "value": "q.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a2325e-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986811, "uuid": "cffe9bd3-3d86-41a5-b4b6-5fb52b27557b", "comment": "Malware payload (Mirai)", "value": "cd76a3516eb0dda5f9432204fb8d5218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986811, "uuid": "946be828-0b28-42ba-89d2-2ebb179e68a8", "comment": "Malware payload (Mirai)", "value": "71a0e3bb7705cef2bbd178a3551edab7cf9c2afaa07fabb9fe6318aed742c70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986811, "uuid": "9fcc44e9-4410-4e48-a5d4-a1184d9b8547", "comment": "Malware payload (Mirai)", "value": "06223933ce474ec88fd5f4e56d05a18a23291daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986811, "uuid": "27b62a42-0b09-4689-9e50-9e7215a04102", "comment": "Malware payload (Mirai)", "value": "fa4f25e2103464d1f4b4ae9d8027404cb26172d9115e2b99e7494479aa180a27108e705ff8e51d906c577409655b14fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986811, "uuid": "408d39fd-5464-431a-b932-132f4f51c016", "value": "T16E334BC19543D8F8D8165571306BFF728A76E87F0029ED87EF95AA32FC41A0292172ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986811, "uuid": "d5a02775-91c2-49d1-a294-b061c8f94f87", "value": "1536:OEj9xHO9IesqzYlaNpLqdk259t6tX/GKiFL:fiIe4laNpLqdkIT69Bix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986811, "uuid": "d1839741-08ce-4435-9374-5c4991868c01", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986811, "uuid": "071a836d-0946-47b5-96e5-ff0a00cec274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986811, "uuid": "9265899e-228b-49ce-923a-de3c56a41f2a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd829b5-e4da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028613, "uuid": "39dd8870-95b6-4f52-841f-4f811c585719", "comment": "Malware payload (Mirai)", "value": "2cbe73de609b2c9aa7ba91a796ebb0e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028613, "uuid": "a836cf45-f279-45d5-858f-494dc6d833da", "comment": "Malware payload (Mirai)", "value": "71a60a44c5d9d54f62025e40bee84a4511c7e08cc4202896179af1aaba2d6f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028613, "uuid": "bc89d069-4b48-4531-a19c-b85b6a691f63", "comment": "Malware payload (Mirai)", "value": "373a74e8666ec1ae3ef84df1d81c9c01d1b47e2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028613, "uuid": "4069ac8e-ef5b-4026-967c-1abfdc3f8576", "comment": "Malware payload (Mirai)", "value": "46cf968408ebe708ab9d7e98c2151f99e0815b04439324f434f07ab98058e0065bd41e48e4be12fc46ebd242ff3fb136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028613, "uuid": "d2c58d8b-e109-4a6a-a232-53f22235e80f", "value": "T12B232945B8819A23C5E413BFF66E018D332567A8E2EF7217DD212F15778A82F0D7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028613, "uuid": "5375a06d-c9d6-4a0a-955c-35d539a85243", "value": "768:i9FUWdwPMRczoh7c3KaAv/4VI296xM8VOqRTrr4hlFNlHkIq1uuu:fW2URmAvAO29UhVOIrrYQUuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028613, "uuid": "7378e765-8b69-4d57-81da-f132f71011e3", "value": 50044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028613, "uuid": "8f2c8c81-398d-4ea5-9c54-40b2f617f207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028613, "uuid": "32e44757-6095-47cc-995d-010e9d4cd732", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237cf284-e46f-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982643, "uuid": "9e70f8f7-a8af-4375-a24e-26137621f926", "comment": "Malware payload (SalatStealer)", "value": "e0f6d7039cb0e9c641bedbe3623799a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982643, "uuid": "42f2e1e1-a90c-44d7-a9dc-0a1464c9e61e", "comment": "Malware payload (SalatStealer)", "value": "725ccbf0179bc527949cfea5db61f36de5f0604e16e028d1aba8dd81c977dfb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982643, "uuid": "a604491e-e440-4842-b5dd-ded74c8e3a66", "comment": "Malware payload (SalatStealer)", "value": "9687719eccc980e16e30bb15aaadf6e928acc642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982643, "uuid": "01ff8526-9f06-495f-887d-f34d69e9be25", "comment": "Malware payload (SalatStealer)", "value": "babaea295e49d55efadb3affad8df620a791aaacdf8b61e3d67d383333e42c5a319a8736872dd77a218e51752b538f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982643, "uuid": "cc2710d3-1a12-4c76-961e-c8e5cdba86db", "value": "T168462361B68A68E9D8A7C038C74246636A717C960B71BDEF12D441353F5FAE52F38F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982643, "uuid": "90ee0fa2-7ac7-49f2-a93f-6a83e1b480d5", "value": "48b1adc68ffbb241ed613bb4a911f3bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982643, "uuid": "b0fd946f-7bc5-49bd-b6e5-a00cf0553c0c", "value": "98304:0AqDFZ2nxQJSiwrbjAyw1YrGbLc/xpxYq8Km+mp5RFMhNW0ihrsOJBlm:0AMFM2JS3rAyw2YqA+mDEhNW0ibBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982643, "uuid": "077ed467-c708-4dad-a746-34edfad13cbb", "value": 5606005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982643, "uuid": "c040d414-7ef0-4274-bab8-6860e640b212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982643, "uuid": "0dc0b6b7-f02f-4d69-b310-9ea9524bc2d7", "value": "Seliware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b1c04e-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766996198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996198, "uuid": "18418fd0-bd44-4d60-900f-76e0223d3400", "comment": "Malware payload (Formbook)", "value": "69a88212c1f11c370825b7879a673d78", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996198, "uuid": "be3947f6-356e-4d57-a805-67c14ffa3184", "comment": "Malware payload (Formbook)", "value": "72ab0487b05dcd39f369953343d683c4ecf31b2ad7b659287c859fccfd50c967", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996198, "uuid": "a4c3b321-479d-4c7e-8607-93870d27dc5e", "comment": "Malware payload (Formbook)", "value": "0336c9190e5032aad22b675f69fcfaba9e9c1e42", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996198, "uuid": "ac8d5388-72e0-4e7b-ac81-f4cee1a3ddb0", "comment": "Malware payload (Formbook)", "value": "58e7c51b35bfacd8f1c9ad9e22600160ea6fee5c4e90090b39af27c393cd5f8ffdda1671d5331981f46942612898bfa8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996198, "uuid": "30c61af7-2066-48a6-aa9d-d474e183450b", "value": "T1A66533307EF3FD7185AD433590BF0D0A51E0CF5A500CE8D7755EAAA11BFDB22529AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996198, "uuid": "7ed6e5a2-ed69-4443-9de8-cc2ec67572c1", "value": "24576:9SMEc+70mGyFfj9Nn6RGt/eSIdTfrTJTSGbti2AGYTd2v1CM2EgDB:EFQmGihtEJOeM2zXKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996198, "uuid": "6690f712-a655-4fed-82de-9248805e02a1", "value": 1455988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996198, "uuid": "05e48f76-2ac4-4758-ac6c-6510a629adf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996198, "uuid": "59c4ec8f-4f71-4aa5-b2e8-48ffb3a55c80", "value": "Server_Encrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842eb1bb-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766989248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989248, "uuid": "3a0ea542-9711-4df0-b3b9-0dbb67f88293", "comment": "Malware payload (AISURU)", "value": "87dbf291e6f3d80960bbc37f5b7442da", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989248, "uuid": "ae9bf908-4aa6-4ee8-a200-bf9a871b3cd7", "comment": "Malware payload (AISURU)", "value": "72b0121682f1deb950d138d0095f4a26fc4a9e8912e4527658d91ac908d7393f", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989248, "uuid": "f06d8da2-520e-4cc7-8430-691afbb41bb2", "comment": "Malware payload (AISURU)", "value": "8feffda77a4aa00f775c1cf0bc61f862658ec0b4", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989248, "uuid": "50afcf55-871f-4477-adfa-fc2311ea29e3", "comment": "Malware payload (AISURU)", "value": "ac6c66436e022ac3090c6147affae2ac95e8b16227c24aa8e817814fa12c53e39fe129ba4e536347caf6813b3022f58e", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989248, "uuid": "c17e4f9f-d92b-4049-9ae1-e69f0fc7fc1e", "value": "T1AD937E82EA92E4B1E8121079167B93668B33F1353035DD47E7A42E31FCA2B41DF563AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989248, "uuid": "4ab93dde-d125-4e73-bd04-b2816f97a7f7", "value": "1536:OpOQm5QXdo7dh5/5eFQwYZrhRZtqc1fEYCBT4+ZsyHl39N1u46iD3IASreZoQ:O6NB9hVH1+ZPHl3f1TXDroQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989248, "uuid": "0d27d065-7570-41f0-809e-44b4ea72c1be", "value": 91376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989248, "uuid": "ba020b50-95a0-4a6d-85cb-2562fb3a9c9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989248, "uuid": "a49b3ff9-b4f4-4c60-889c-c9fff36c5929", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1f9185-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967065, "uuid": "152e2a62-91d3-4887-9c0d-7c75f68eb8aa", "comment": "Malware payload (Mirai)", "value": "dd5234389a502efd37a0ae7d8a56eb30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967065, "uuid": "d9183170-7f69-43bf-bb44-bed4e06893c8", "comment": "Malware payload (Mirai)", "value": "73034b5f701945240ae3c9c5a23957113d7ea05b4bfb10bff35d3e52a9ab2499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967065, "uuid": "3ad90ff6-690d-4491-aa99-a2713a9c6e4d", "comment": "Malware payload (Mirai)", "value": "82253d62f8ff7919dfab71c036ca20a4c2e08374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967065, "uuid": "aa8f861e-8951-4b68-bfaf-71a70c43f848", "comment": "Malware payload (Mirai)", "value": "f749ab11df4c066a1b833883f6542e30520d979f67358aeff3f2248eb41fa3bace491df570fca6778849dc9457841e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967065, "uuid": "fe9c3fd1-abfa-4a6b-9fea-265259f38c92", "value": "T1ACA35C22B8791D2BC4D4A43A21F34331F1F6574A21A8CA2B7E710D8EFF64B502257BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967065, "uuid": "f7a3ebe2-8698-43e9-9c69-56dadd8f913a", "value": "1536:6TZSyH7Scn5sZxhi/Zeyp11uRRn/eI6BQgM+tICY65IKwxkVth6epchYh:og1SCZiRbmx6i+6CYKPKepXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967065, "uuid": "fab3487b-142e-40ba-b7f0-bca9f1ea2776", "value": 99512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967065, "uuid": "8c280a51-d1a4-4ca1-b0dc-51f73f924ad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967065, "uuid": "523eacd9-532e-411c-83cc-98b9c3332328", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570b5d5e-e4e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034699, "uuid": "3a9b0a67-933c-4489-adb6-e1aab8abe7d6", "comment": "Malware payload (Mirai)", "value": "baaea18f71b87efcec9a6230db63f902", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034699, "uuid": "d7f9c3e8-df08-483a-891b-d96d924d8b3b", "comment": "Malware payload (Mirai)", "value": "73f0030e0dc7b11fca405d9222f539b35c2ff39f59de8ec34ea0fba7b9ddc7de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034699, "uuid": "44c93376-9329-42c1-bccd-687987caee4e", "comment": "Malware payload (Mirai)", "value": "b2798ab84a383f00421963d3d69d39b11c3b1eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034699, "uuid": "65a477bb-d655-44b0-bfd7-185ee12566d4", "comment": "Malware payload (Mirai)", "value": "994c2551a5e99c23077caefd75bd562fe17f805ceadb9302fe3455e3ef999b77786be0ce2da74e088448a834cd20ad3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034699, "uuid": "01525a60-5e3a-454c-bfb2-9691aa48e51d", "value": "T101F38C73C829AE9CC624C4B5B0B19F792B53912551835FF6A6B7C2B1804BECCF5097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034699, "uuid": "04a45a8b-c797-4787-add1-1de9a6b2384b", "value": "3072:V6geI+4gh5usAdaSJ7+yXkwj9ZUxxWogsFru6hh1yL:Vu4ZseT+yXJ8codrgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034699, "uuid": "d1b0d5b5-b41c-4f02-aab9-8609d7285baf", "value": 168864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034699, "uuid": "b390e9d5-2d2c-46f8-ad96-d5768c65cc05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034699, "uuid": "10379308-4897-41ce-b6d0-86d4ccc63b72", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a002a3a-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766993365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993365, "uuid": "ceb92839-92d0-4d9a-97b9-d10e05bd80ea", "comment": "Malware payload (HijackLoader)", "value": "e346ee47f3ed3b11dc35b8da1309d842", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993365, "uuid": "743f0ab7-e5ef-4c73-bb6a-2a4220d637eb", "comment": "Malware payload (HijackLoader)", "value": "742d8ed0e966bb41d2e942beabdf8aa5311317cbda89965dedd21032378127be", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993365, "uuid": "5e88465e-d8ed-4f19-8508-91ff75601a31", "comment": "Malware payload (HijackLoader)", "value": "68c64277de9acaa6a5fae7a0e4d4bf3f84eb6a04", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993365, "uuid": "a8422ff8-3159-4cc0-8478-2b880eec38f9", "comment": "Malware payload (HijackLoader)", "value": "7a3a814fd26d630f1dcdca0a5c18bea2cfba17811dccbc4019f7d0a212b6518e6996905d12a9862979d786b5a2e55508", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993365, "uuid": "d665f7b9-49c6-4dfa-9311-17c7287f6502", "value": "T128363342F9A48B25E7E7347ED1DA9E9C223C1F4493F769D3C828F2452535FA4886F842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993365, "uuid": "c247aa0d-9179-412a-8c1e-f28750df34aa", "value": "98304:WFJmfy06gkMGlyDO5jdR3ymWJUYzKwh2mzSXhWJkkxFDP:WKy06lY65jbmJDzKBeSXhWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993365, "uuid": "b84826a6-4c3e-47d5-827b-d86801f650c2", "value": 5201920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993365, "uuid": "8bc731d0-dcdf-4c40-806c-a09922f18e31", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993365, "uuid": "f21642e1-f276-451a-a8d5-29575a1976bf", "value": "742d8ed0e966bb41d2e942beabdf8aa5311317cbda89965dedd21032378127be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81785488-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013295, "uuid": "ef261074-0f88-435e-8b7d-7326788c2e3c", "comment": "Malware payload (Mirai)", "value": "fc9f786b2669d16173b55c219fdba295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013295, "uuid": "63673371-fc6e-44b7-a901-a0ee045c0944", "comment": "Malware payload (Mirai)", "value": "747ef9376b4ae86cd0092dc6d6030f51f3cecd00cb2b0069106b6014a2ae51a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013295, "uuid": "4bc2cb42-3550-4fda-b90e-3f26dd209984", "comment": "Malware payload (Mirai)", "value": "dc80bbcabd08b4f462ce2295b472feb2f9609dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013295, "uuid": "5d085d98-a6bf-4807-8cda-9efc68cfdba0", "comment": "Malware payload (Mirai)", "value": "dbfd22ac3fa3cde6f5a55539f8347024a18851d712e5d397b8a5e355731d5719077be44f437c15f96dcd217dfad4d1ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013295, "uuid": "8490bb6b-7f78-42c2-b6a1-402fdbb90ece", "value": "T1B283B6097B610FB3EC5BCC3706A92B4128DD651B22B97B36B534D858B91B25F26D3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013295, "uuid": "df2bf608-cd19-4dae-959e-48375d1d5d51", "value": "1536:HfStzeG8gOXZOXVuK5dil6lXHgXr99o06RgZyn4+UC41:HIeG8g2edi49XRgB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013295, "uuid": "8e1e0834-0c14-41f2-82d3-ed0f86fd3b91", "value": 88516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013295, "uuid": "20f68f9b-74e2-42e8-925b-de49f46b70ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013295, "uuid": "cf2f2258-315e-49f1-8c5b-748b4b0c8d04", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eb4694-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986571, "uuid": "ec0a7104-704f-4da0-86b8-89ac5ec41ce5", "comment": "Malware payload (Mirai)", "value": "827111e629d8e439c62a7ea9d1cfa897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986571, "uuid": "9738986a-53c7-4121-8bf6-d9d3090e84b0", "comment": "Malware payload (Mirai)", "value": "7547603f4f122786e4dc2c4dd0015aea9df136fad7190936a55d6af0fe8d77d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986571, "uuid": "f29370a6-3022-486b-ab2d-fb8fe694dbd5", "comment": "Malware payload (Mirai)", "value": "51afe006f8ef017a816c944a293f6c3d0baaba45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986571, "uuid": "1188f5eb-b46b-412a-abd5-39cb4da729be", "comment": "Malware payload (Mirai)", "value": "5b6673e7670b65592f7d6d1a22038410a6db7e9fde5da30849f60a3ea4cdfe15e3c78b7157ba1e519b9caef467d8aa40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986571, "uuid": "4240d652-6ef2-4187-84f2-de5022733c4f", "value": "T13FC2E06360BACA07C8B3837B6E3D59A221649835630EDD2E37795BC477420D0657BCDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986571, "uuid": "586e171b-e8cf-4139-a607-c77c7e95869e", "value": "768:t5+Kcrb9VDJeU8ETgdTHOBcK5ZCAySPtym:Olrb9vegTg9QB5VjtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986571, "uuid": "20b06403-c46d-4520-baf1-80b95ebf72c5", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986571, "uuid": "bbe5bf27-9f64-4ba2-bcdf-d9a6ec03593e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986571, "uuid": "1f963328-1707-4768-bd1d-80bf518bf261", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b587eb-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028066, "uuid": "ca9c32b8-1d4d-44e7-9e1a-be6280d96df2", "comment": "Malware payload (Mirai)", "value": "1aaf52ee86427701970871716ecdc3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028066, "uuid": "38435639-3b67-459d-b027-ccdecc526f6a", "comment": "Malware payload (Mirai)", "value": "754cdd66de5730baeec59adc0543c57b8134f66d7d1618386cbf46abe750d83f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028066, "uuid": "5181d198-d15c-4e9b-b5d4-5da90197faa0", "comment": "Malware payload (Mirai)", "value": "d0f68ca3f6e6afa3fab7400e2d0791d74dbd09f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028066, "uuid": "7ec206bc-a85b-4efb-a53c-99bf15fc131a", "comment": "Malware payload (Mirai)", "value": "f2b9b7b39629a308550c974d80db8ac1c7c86855c5ae0564c535406f31fec39577e3f99c1c80acb9d89a5d47d674f5c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028066, "uuid": "48a94515-985c-4282-aa85-07181f5274d3", "value": "T1BE240946BD918F13C6C222B6FBAE418D37166BB9D2EB3103DC216F50378A99B0D37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028066, "uuid": "fc62fefd-d926-4716-8e24-e8db3e2c5082", "value": "6144:QevDEzjKP4qFJHYzHSo9EN4M7/ORUroTy:QeIzY4qFxm0N4MzJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028066, "uuid": "852940d7-1e37-40b3-90e1-23c5ef425b61", "value": 225664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028066, "uuid": "c27f1ea7-d1e3-4c8b-bf36-fc9c7236941e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028066, "uuid": "a208fee6-d2a3-4392-b975-99dd5e7ca739", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8128e6b2-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971204, "uuid": "ec58246c-e55c-4427-a984-01c8b0101490", "comment": "Malware payload (Mirai)", "value": "b2de2740c9b4f25c1db17a807a5928ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971204, "uuid": "a0367f8b-355c-4289-aeff-4cb0e01b88e9", "comment": "Malware payload (Mirai)", "value": "7565ddbf0a248f9f0974666473dc95997307f392ccc8bfa19e607d2d72898302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971204, "uuid": "5c24619e-a923-4375-b811-c3167b1172d6", "comment": "Malware payload (Mirai)", "value": "bd30f94314303015db248fc315a29fb8f05875f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971204, "uuid": "4090a124-3368-4817-aa83-32fcc6c7b5a6", "comment": "Malware payload (Mirai)", "value": "cea04677fcee6f02ed4c7691a86d1efefde4dda5cbf309578f255a153e8fb5f99cdf8d1ddc8ed64f00faf1cba1521a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971204, "uuid": "7969ff3a-58e5-4e75-86cc-dd736f4620d2", "value": "T105B31A95B882AA12C7C2567BFF4F428D371697D8E3EE3203DD185F64378795A0E3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971204, "uuid": "ad0f508a-cccf-44c1-a6ad-3a9ad0a68a5d", "value": "3072:MOsBPaHkUK/jkmtfaJpgs6fmE+V5awynz4:MOmPaEUejkmtiJpgs6fmE+ja94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971204, "uuid": "8356e0d0-3e4d-4eb8-b8b3-284a2dd41e9e", "value": 111832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971204, "uuid": "ae101389-6f50-48a4-86ef-8ceaa49a95ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971204, "uuid": "c8fdfad8-05c4-49be-834d-9f1680343c69", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e4960d-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (TrickMo)", "timestamp": 1767012787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012787, "uuid": "8da43337-1ffa-4ba1-987b-e6811be8dcdc", "comment": "Malware payload (TrickMo)", "value": "5ac2337c3e4e237c6d461d32c7697a9c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012787, "uuid": "c8732a48-8348-4450-8349-10a551746012", "comment": "Malware payload (TrickMo)", "value": "7593b0f4bc4c52cb359196f35868636b319641b01c8db9f662076285739a0505", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012787, "uuid": "da26f755-297c-4868-af0f-6f130f4257f3", "comment": "Malware payload (TrickMo)", "value": "4e1beac5095996943e47f7f6766362fa35b7121d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012787, "uuid": "8e0dae94-132a-4678-8db3-0708c3aff590", "comment": "Malware payload (TrickMo)", "value": "e8b8f664502c8528a9300ad302eebddf0b912def010ca958c8285afdcc4b5ae629dfb2ef5e273c68835c5bd24c095f70", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012787, "uuid": "ea0a6d2d-4644-4bdf-8663-34ae4addf914", "value": "T1E0762243F31DA65BC8F7D3325AB60A3551078E2A8743E2875A2477787CBB9D04E86BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012787, "uuid": "c4dd1e36-7aed-43d2-be5d-9059ae3641e7", "value": "98304:lFgehwI1TepCeaDMBiiMcIpa+rY/pdzpOAXebnO7oZtEq4amDw+0fmv44f93Lhf4:l60ZDK7+rY/j7Wj4E9+v5fzJ1PawU5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767012787, "uuid": "0e45813a-e5e8-4fb2-bcb8-f81d01f3c778", "value": 7615683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767012787, "uuid": "eafe9075-8e49-4756-81c1-e833716b9b56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012787, "uuid": "896770c1-dcab-45d6-b59a-3ebf6a023e4b", "value": "75.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f538bf65-e451-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766970110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970110, "uuid": "9c45a917-a6a5-430a-a016-9e9088580625", "comment": "Malware payload", "value": "b87ab2c68c9e70dc2be82e3e47460be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970110, "uuid": "2125061d-0f20-400c-a41c-6723b9a3d154", "comment": "Malware payload", "value": "76301a6fb8c273df3a0590b5332163ff3cf64000e6f8e483e478ea91d3ab9132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970110, "uuid": "06e4edc4-a43f-4c24-92c0-e700669f5fd0", "comment": "Malware payload", "value": "d5c9739192c7132905bd057e11215d09fa2cf23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970110, "uuid": "88823844-ceb3-4066-8e8a-0e0aed7df22f", "comment": "Malware payload", "value": "cc42fdb949895737131d5fb51af5f99528e513e57ba9fb0a93dbe9419de2df0bb29b4f6848ca36b2a49abfafe07dd79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970110, "uuid": "a5ef6105-be43-426f-8652-6de92405ee04", "value": "T1471523AA7BA78AE1DF5111768D7E47D08F667CFE082E041B1F91451D0A3B399EF90388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970110, "uuid": "263670b5-4b07-4c04-a128-10762b1c2cc2", "value": "1f6d6b8261119bc96407d03811834fd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970110, "uuid": "4e6b88ff-3bca-4cc3-9aef-069bfd40aed3", "value": "12288:/bLPO9Phmt+M4eqpnCoSuelY1h20REI5bnMBi0GtRMa://EEt++qpCoSur40REkbr0ERMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970110, "uuid": "eebad5ba-35bb-4f1e-b7ac-168c1d1c889d", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970110, "uuid": "f7d0f56b-3ff2-4b21-9469-f3900137376e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970110, "uuid": "8aec93ed-5a21-4bda-9f1f-c5cdc674033a", "value": "\u65b0\u8bbe\u5907\u9a71\u52a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54a6eb0-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986807, "uuid": "c1e96069-f6e8-41a5-8fcb-2abeb058b037", "comment": "Malware payload (Mirai)", "value": "8f69468caabb6c0d97eb45785c345c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986807, "uuid": "88973eed-1b77-42a9-b658-9c505f31fc71", "comment": "Malware payload (Mirai)", "value": "76fbd5fdee93de96f0e33c2558956efcd38b8cc32492e1e6a13ab00b32ec685c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986807, "uuid": "3fa74369-4b63-48b8-b4ef-60372b03d1bc", "comment": "Malware payload (Mirai)", "value": "4b1378e2c399901de4a7e1df90c16da080678491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986807, "uuid": "28c2601d-8f23-43f7-bbfa-c8b38530798c", "comment": "Malware payload (Mirai)", "value": "b7763438f6a4a15579da1463ed63ca29dec48a27869f10f89ffe6ae5a24d7ca859a294ce43fac56bfcdd9970de60f83d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986807, "uuid": "2cafa815-1f53-4076-9cfd-8bea83e48395", "value": "T10763B60E2E618FACF76D863547B74E30A75D339626E1D580E15CEA015EB034F642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986807, "uuid": "423ed010-84d7-4051-b61e-04e25ebe3684", "value": "1536:guOAcviaUXP1ySHggxdgjIWP9yTpZTzO9IvkekQrGde5:EvifXP0SHggxdgjI37znvkeLr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986807, "uuid": "ddde178e-5294-40dc-b98a-22dc85a2c5c8", "value": 71740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986807, "uuid": "3a3ad239-4191-4707-a1dc-c63c7ef91d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986807, "uuid": "89cb4176-83b9-42bd-8c64-e67be8a01202", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffc1e17-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995281, "uuid": "41423733-c90d-42af-a60c-a0355c8f2b97", "comment": "Malware payload (XWorm)", "value": "a531d723ca36041023b368085411f5a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995281, "uuid": "598b42fb-6d37-4872-aff0-777401a2495e", "comment": "Malware payload (XWorm)", "value": "77573a156f5c490668e8e1cfca2646cd17ae7d10ee5abd27f9325f2b024b94e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995281, "uuid": "7f96687a-e252-4c73-aa26-df2dd6b3e477", "comment": "Malware payload (XWorm)", "value": "bbf6ccd3f4abe4cb2e5e09790f38438e33f67002", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995281, "uuid": "2c416e74-8d34-4051-a38c-be8d8587e29f", "comment": "Malware payload (XWorm)", "value": "8bfb8b09b7b49e53c2640909259d68171d391e68a78a6f2abc79f4c220a5f2a6e652f035ad93315e83d46c0209f38d3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995281, "uuid": "55f41f11-52da-4bdc-8f66-f82b32e8c075", "value": "T1BF632A2F57F10EFEB471C7844223015DA84A1B56EF77C99269D8AE21B6E1CCE9D390E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995281, "uuid": "434953f7-3ba3-40f2-ad4b-a4b688a81a82", "value": "1536:I9l/AoSSM4l29eBFSZEh2tXLlcfI07eBVqrVB/hZAgrU/3KzJNb0d7tk63E/f9K8:I9l/5M4l29eBFSZEh2tXLlcfI07eBVqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995281, "uuid": "1427eb92-308a-4b61-9269-620dcb0826af", "value": 72499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995281, "uuid": "38aaa36e-b076-4978-8b05-edfa5b894054", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995281, "uuid": "2fdb9dc6-a60d-4236-b308-9ce004587c49", "value": "invoice-1645080830.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d4d3c9-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995243, "uuid": "f7b85a31-ffcf-4e3a-aded-477327ab8450", "comment": "Malware payload (XWorm)", "value": "8757900da2f5cf578689db189a6ad0d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995243, "uuid": "e325a9ef-818e-444b-8172-9758469387cd", "comment": "Malware payload (XWorm)", "value": "775e8d582386ddbfd4d9fd214bc0efb88baffab44c5324eb63cac878b3775e29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995243, "uuid": "68838fb4-80b8-4ba4-b086-09be0d0f4f4c", "comment": "Malware payload (XWorm)", "value": "9f973fa558d3302bc70599852b5cbf8d59930e1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995243, "uuid": "7971b864-55bb-4adc-bf08-9c8dea1850d2", "comment": "Malware payload (XWorm)", "value": "8955b506bb5d0506005e1a685466a150673bdd56c91bd7d2b87ad5b0bcc5dae510186c07c6a033489a50c352afd5648e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995243, "uuid": "8811d45f-6a51-4bae-bc27-4a68a4cbe617", "value": "T1896319B367A8E6E027D077C8A4D6A2E9FC151C7C5C36D2895BC6D9C01463C385C87AEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995243, "uuid": "949d0928-653e-420a-8398-965a5cef4c35", "value": "1536:I9l/AoSSMEy4pbLSpurPb8ya1c5y538f/wkT4JTfJ/DICffpb9JRr5AQ7mWlyCux:I9l/5MbJusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995243, "uuid": "dfc64b7b-8eec-418e-b03a-ec340b8de45d", "value": 70569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995243, "uuid": "9ead4510-1e30-4fbd-a69c-206e00e2f61b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995243, "uuid": "c4ba732e-25fb-4dfe-9103-cce67b89031e", "value": "invoice-1645080830.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2f015a-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013501, "uuid": "99079d7c-7eae-4da1-9cdb-a9e94cb417ef", "comment": "Malware payload (Mirai)", "value": "4d23916d31dad71d8c8a82a2d665fcf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013501, "uuid": "5d4a1e5b-0f5c-4f4e-86a8-0d7b8b4e3e32", "comment": "Malware payload (Mirai)", "value": "776565bbbd7d4c27e4325f541225d52878e9c200cc43e267a3ba93c868182eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013501, "uuid": "ab8941bf-e52e-448e-82fb-fb85e42f32ae", "comment": "Malware payload (Mirai)", "value": "94e112088507056d56af0e5a62d35be4363f57e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013501, "uuid": "406fd277-8a06-4b82-90f3-cc3b48cd5992", "comment": "Malware payload (Mirai)", "value": "23d8aad47bc1a90a0b14ee4ccf5473ffa1e9fce5d9479d7d56f1e411cb6019aec75012252bafa225a309379cbb70c958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013501, "uuid": "5f7bcbeb-5afd-4b4d-87b8-92be8fba2b63", "value": "T1AC935B21BD7A6D17C1D4B47F21F74224F2B2274A21ACCA1A7DB30E5DFF256502143ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013501, "uuid": "0bb05968-9d26-493a-9509-99ceba27b4eb", "value": "1536:IFvXSGzDgfQ71X75DluLZeqS1ACSHsOTYSoQM3cFuL/jEqPpzm7uhl:giP471XLot2ibpgH7zmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013501, "uuid": "f6b4e4b7-f418-411e-b2a2-5226110d7db5", "value": 91340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013501, "uuid": "d9afab03-1617-42e5-aaad-a26dedb9ca87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013501, "uuid": "a7b94ecc-b2c5-4192-942b-92635b26c2c9", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b378aaf6-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766996629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996629, "uuid": "04980b1a-fa85-4c95-9fce-d2802e0c1b32", "comment": "Malware payload (CoinMiner)", "value": "4a78ba1471e224ef874a528aafbc271d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996629, "uuid": "c5e78268-ed93-4c60-9c56-28b0cc9cd376", "comment": "Malware payload (CoinMiner)", "value": "776ed0d80f384c1c36bf9e561d4319ebb356c20b265223745a5a3cc01d8a771d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996629, "uuid": "8dd7b190-d9f0-4dfc-86b8-5a6c804fef19", "comment": "Malware payload (CoinMiner)", "value": "7d78bb902a045d46005d010c02ef9d772543b823", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996629, "uuid": "2115f470-a5e4-4fe6-904a-1bf4edab35e1", "comment": "Malware payload (CoinMiner)", "value": "d61f987b3210080a5ddec2c89fdee8fc2bbbee2441807a55c17e23c0181344a0ff1eec3461b04cd44116fb7190d7ba35", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996629, "uuid": "9efe261a-6062-4671-a126-1f92782101b9", "value": "T13F06332E9F33A5AE36B1A48491F74BD711E8120403A1D7F85029E9BF7B154F699A03CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996629, "uuid": "1e7ca70a-e489-417b-a2b7-36fad2faab67", "value": "98304:klKy9b3rQPFoC7Rb8wPT4+QY+BE+yIXaBpd2heJSro+8iM8pTYW:8KejrQPF7tb8wPTpQY+GRIUdFwz8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996629, "uuid": "ebcfc752-849b-477d-a71c-9bf834e02ae2", "value": 3787470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996629, "uuid": "4d966fca-4b09-4582-bf65-3bc127ac399f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996629, "uuid": "8089dd96-2076-4e61-899d-39148ef2dd7e", "value": "776ed0d80f384c1c36bf9e561d4319ebb356c20b265223745a5a3cc01d8a771d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823adbf7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995257, "uuid": "b741daf7-fd76-4dca-8646-3fc7dd0d473f", "comment": "Malware payload (XWorm)", "value": "eb77092403653b4f6a63695957222f9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995257, "uuid": "bb66af4b-2b96-41d9-81ae-dd3e4b3fc2a5", "comment": "Malware payload (XWorm)", "value": "7772a078dc9e916fca20809f68e7f41fbeff7ffaaa4df2f9269534e4330eacf7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995257, "uuid": "e0dee827-b7a6-4621-924d-04bd0a66ad54", "comment": "Malware payload (XWorm)", "value": "1f037f92d64261ebea78ce59793d1aa4a00619c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995257, "uuid": "94abc811-4fec-4bff-825c-a2fd64ac16c0", "comment": "Malware payload (XWorm)", "value": "d44205322fa080f67a5fc5bc34c1ce764853dac4d08ba7f313328cd67d01c24ac9e474ecfe24f3649bd93ec18834ac4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995257, "uuid": "16acf163-80d4-4e0e-b207-8181fad8c9a4", "value": "T1EA633C2AF331E0DF38D3A95901D90E88610928F95A7F2DFD28D5F71DA5AC19F16228DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995257, "uuid": "6a83d0c0-6584-4cd3-b890-14e1b10d53cc", "value": "768:I8w/h62/jWs6oS+xISN0vkEWP65dkfScBYrwz2y8kTAlGB:I9l/AoSSMTlusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995257, "uuid": "d16f305a-55f8-4109-bc96-0b289da8037a", "value": 69723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995257, "uuid": "bbdc497e-82c6-493c-9bba-fb0e6ae8e2d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995257, "uuid": "6cc01512-db37-4c62-950e-768004934c85", "value": "invoice-1645080830.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f6cdfe-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011350, "uuid": "de11eef4-b877-4f01-948d-d266c938ebfd", "comment": "Malware payload (Mirai)", "value": "33808128d2ccd3233257aa3b2a27eb9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011350, "uuid": "de346b35-d63e-4051-a8a7-110f53deca2e", "comment": "Malware payload (Mirai)", "value": "77ad81315e12fac54c2e5c59c92ccd0626da2629cd87b4c54654013ccd53a07e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011350, "uuid": "564d520f-33c5-4177-96a8-b1e988e36be7", "comment": "Malware payload (Mirai)", "value": "c1f0eb8956c2ea0e042736541bc978f735bcf644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011350, "uuid": "17b77fe8-64b6-4d14-a8fd-b8a7a83ed030", "comment": "Malware payload (Mirai)", "value": "60ae6fb014fc73ce17cfecdfdf7a2dded9c391b0a8d00284a7ad6573bd98c8da28946fff589a6ee1dfb550697de2a2bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011350, "uuid": "33e09002-7e77-4e03-ab5c-80f6ad93fda5", "value": "T1F2E3E787FE01CFBBF80BE37244A308157530BBA64D524A73726779AB993A0D41463F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011350, "uuid": "af0a2bba-2adc-46a7-9a09-d0f5aa1cf63a", "value": "3072:Ob03Uh94X3yygtvmr3mc6GgGVBjbiDLr9wg8:hHyyWvu3wGg7LrT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011350, "uuid": "c9e92a46-39fc-42e4-8b33-b66353bbcba3", "value": 148664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011350, "uuid": "ee70cea2-150f-45a8-af94-10f31944c4d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011350, "uuid": "ba0ff42e-213a-4f95-a44c-c21787302d13", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980088d5-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995294, "uuid": "b2a79a39-34ed-4bfb-bdef-9feafc611011", "comment": "Malware payload (XWorm)", "value": "5f40f955e409de5f22ec8ee75ce13dff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995294, "uuid": "a349facc-e1b9-45d2-82ea-3ab7927fa6ab", "comment": "Malware payload (XWorm)", "value": "77ff2bf12e64728f8b076d06c9c6f8dbc45fb377bfca855a7e321736f71d7bed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995294, "uuid": "6e73a0e9-eb9b-433e-b0da-d237bd9046ba", "comment": "Malware payload (XWorm)", "value": "8cc0c012270ec76e44b3e3e0939f99fde3b1d2c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995294, "uuid": "5299a485-7a80-4874-9927-fe871e006d8b", "comment": "Malware payload (XWorm)", "value": "feca4310a5b7537874941130d652c618507fc704204ffbcee3670bdcd242fd1b8685aada1b444eefabe86f629901d541", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995294, "uuid": "7ea6890b-bd2c-48d1-bf58-8a15d581f871", "value": "T1E6631B79FD1B463C037658A0F12E29EE6817DFC1C8039DB84A617AB2470BB7C6791E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995294, "uuid": "5ea971c3-001e-46ce-992e-011bab924523", "value": "1536:I9l/AoSSMZwiVwiEwijwiWwiUwiDwiUwiRwirwiOwi7wivwidwi9wiKwiuwiqwiq:I9l/5MWiqi3iUitiHi0iHiui8iFiMi4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995294, "uuid": "318062e9-a59b-4b07-9902-29b4690ada96", "value": 69642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995294, "uuid": "5fcfa105-4693-4512-8973-c219e10abe83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995294, "uuid": "6572fffc-1571-43dc-adc9-24f32836d079", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ed85b8-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029912, "uuid": "e3899faa-2076-4ef4-bf5c-b09916913d65", "comment": "Malware payload (Mirai)", "value": "d321aa6ef22e8b59f153949e0fe5cd18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029912, "uuid": "d5b3bf4d-b7e7-4596-a75f-368363515522", "comment": "Malware payload (Mirai)", "value": "78286c2878e50f20765297357331aeeab469d94d9341d44e9f6fb45652e27797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029912, "uuid": "e0123622-822a-4696-9fd1-f904a457b3ff", "comment": "Malware payload (Mirai)", "value": "9590832ceda2ef3ea45d3eac6fcff62b25f970eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029912, "uuid": "555fadde-901b-4e76-b3d3-1bf3e14e6d82", "comment": "Malware payload (Mirai)", "value": "af2e5c7b0efb0584fd47cbcde9674dd3e1bff164293ef526e379718306847410a47214f087fb2b70ebcb33bca03ea579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029912, "uuid": "0c8a2d5f-7f9c-47f8-a3c3-7b45b33ed345", "value": "T1CC6312A9F0A23E7DFDF77E35E00096417BBD554E43EA9860781ADB83F6662E132604D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029912, "uuid": "0183bf0a-3d93-43ab-8d98-ce04efe58b75", "value": "1536:ozrDFzTY1x4dFe7rxax29tuAZnLjot9pc2zG+ir9J4u+qgw09G:GrDsVTLjoXu2zxYz4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029912, "uuid": "4a8a259e-116b-4f9a-8078-7adf5b3c2030", "value": 68460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029912, "uuid": "5bb06c84-22e6-4146-b484-0ee00841a319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029912, "uuid": "46e14476-3222-4cd8-9fc7-c254beb16ee6", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e362ca-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026966, "uuid": "c5b112ad-b937-4159-8086-c7eadafbea93", "comment": "Malware payload (Mirai)", "value": "3ea9b3888be25adce6d30301cb46999b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026966, "uuid": "3a90af6f-1048-4923-ae33-40236743ed26", "comment": "Malware payload (Mirai)", "value": "783a9d88cf07dc47012a19abc5feb8fae60a25e529d51a95f2669c4731d6ff59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026966, "uuid": "805de38f-064b-4b62-9371-97587b29b887", "comment": "Malware payload (Mirai)", "value": "bb18b33d9a90613385353484f99a7538326744c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026966, "uuid": "a143e53c-e469-448c-b9bd-64dbe8d69761", "comment": "Malware payload (Mirai)", "value": "7c413be448dfe834cd094baf7e5d25843dd475e6a4e645bdfbedeb339c04e93dc90cd5db7429743bb596d704b2f61f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026966, "uuid": "7cb98631-4de4-4bc8-af0e-f56776492f3c", "value": "T17B6312386B2576B189F23DB77A701AD776BCE7ACF52410264CE1988C9493B81E38F614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026966, "uuid": "dedd9df6-3de0-44e2-9bb8-39cdb18defd4", "value": "1536:fIHDi2MKpzahoyaYJ1H3GJ0K8f16tPPh0+65x4EX6h1z6jPrsk1xwE9DLl:fIzptlYJ12+K20Ph0+65x4o6h1z6DrVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026966, "uuid": "c3cd8941-7f9f-43be-abed-5e5fd0f69f63", "value": 71200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026966, "uuid": "7a033c6c-9821-421c-b25d-df2ba3dbf98d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026966, "uuid": "aa73c8cc-4c75-4c37-a50a-fa1ccd4d8cfd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c14a7d4-e452-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970390, "uuid": "9bebcbfb-ea77-4e0c-adec-cbfd0208ce16", "comment": "Malware payload (Mirai)", "value": "fba9a1062b1f0cac7c259b41c7266d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970390, "uuid": "d6e767e1-b05c-4fa0-94fd-42eab05d443e", "comment": "Malware payload (Mirai)", "value": "7946b4662987f46f0e50a74659ea25e4cc3dac89797693759e46809fd8de81f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970390, "uuid": "dfd7da1d-1ab3-4bb8-a835-f279ceed0906", "comment": "Malware payload (Mirai)", "value": "fd81d3e4994b4a60c85a815c6196a3f6a83ad5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970390, "uuid": "7e04dc7d-bc4b-4658-abc5-c703d4b839d1", "comment": "Malware payload (Mirai)", "value": "11c0a8e8973b9615d6b18dab8a95c4724143940ffb241147ae7363cfac04d16cc3b63bf15459fd5d43b4e2bd99130d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970390, "uuid": "d8eff2e6-32cb-4f69-b829-eb4a3a7dad8c", "value": "T13F734A227976291BC4D4A47E61F34324F2F1474A25A8CB2E7D720E8EFF24A5032937B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970390, "uuid": "f1b560ea-d187-4f24-b1e7-c7aa1025f551", "value": "1536:4g6Sp0R/EFv1z6Xkm1/yEQIdeKMtJtyY652ntjemA:xTlDATXejxyYK2ZemA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970390, "uuid": "f3c70e14-86d8-4a82-8653-53f84ddb9ed0", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970390, "uuid": "707896b3-33fb-4947-baa8-8b56adedf95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970390, "uuid": "facaa30d-f8a2-4f1c-97b6-66158473b363", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44159cf-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971397, "uuid": "a186f1fd-473f-43ed-ba10-3bec9ae4e823", "comment": "Malware payload (Mirai)", "value": "365ac3177316ba0df2912642989e0449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971397, "uuid": "123ff678-8ca6-4440-ad9b-e81480b41bb3", "comment": "Malware payload (Mirai)", "value": "795284564bc79e7c7ed073d28d43eeb2dc2377078b669f8fe199c9867451c09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971397, "uuid": "4b5d9fcb-1dc6-471d-b698-7e9353240716", "comment": "Malware payload (Mirai)", "value": "f7fae754364f5078b4e3a8ce061e8d08ee0d0e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971397, "uuid": "f8783688-5e5b-485e-9f6a-4f99e5078761", "comment": "Malware payload (Mirai)", "value": "afe406a4780d860bcd37910eefeb1c0475edfb0f3a348a3a35f872e9b070bfcd81a8f3b4a74f5ba1f2eb231eec18b5e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971397, "uuid": "eac8457d-c9ce-40c8-b860-6cd9cc2cd1cf", "value": "T104634A81FA57C4F5E8670171507AB77F8B32EA164031C64BEB199F32CD27942AA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971397, "uuid": "cc2c4e90-b438-4b13-8d48-a7a13a842f64", "value": "1536:4Wzm2jDW8KUG2GkudMVZ68z+fr1JcUDQHdg:a9/+GkudMVs8Mr1GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971397, "uuid": "bf9bc323-5a63-4f63-97e0-a6313a170f8a", "value": 70820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971397, "uuid": "de2cdf45-00b6-4634-abff-72ecf9cd3128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971397, "uuid": "692ffb68-9779-4a76-8149-d2d5769a5b80", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10917a7-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017294, "uuid": "60611955-7746-467c-8a49-f9ceccf07582", "comment": "Malware payload (Mirai)", "value": "74fc1475c9eb4dab7f024424e9466ee7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017294, "uuid": "092a99e3-695a-453c-9f82-a99fa73845c4", "comment": "Malware payload (Mirai)", "value": "799aa5c2a2a2ada91e52a5ee1a9b80b9ec739ded75e87be006a12b8542812326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017294, "uuid": "3ddafc2f-bf76-4d51-b76b-5546e8072f74", "comment": "Malware payload (Mirai)", "value": "ba88cd666238e190cad81ca99745a05254c27486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017294, "uuid": "08095539-63d9-4cdf-bf0c-c02f3643ce90", "comment": "Malware payload (Mirai)", "value": "57ecda598855c217c5820b57318bf290ff392180a4c2215f0300a91bb405620908f39a83051652a955bce7fe861add65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017294, "uuid": "f1faf721-a607-4e18-95d3-6f277ea7d8dd", "value": "T19A236C76C47EAD98C19942B8B8248E781F53F504D1531EBB2B8685A64043FACF65D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017294, "uuid": "ab344dc0-fe68-4e08-8144-6d926f542515", "value": "768:vaTwtgIOwXre9UlecEUZTccvpwQr0EpvrWjUGpCMoEflwCLTu:vaTwtgi80euTccOUBjiUuYCyCLTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017294, "uuid": "e1d1a0dc-b195-4932-a91e-ce4caf054c6d", "value": 46260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017294, "uuid": "251f8432-0557-4eea-a915-27520b2333a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017294, "uuid": "c5a28b80-0e35-41bd-b3cb-896c130b222a", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8668260-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969176, "uuid": "e88d4ba1-b8ed-456e-9abe-2e9ba573286c", "comment": "Malware payload (Mirai)", "value": "ae4f4fc8b5ac36baa0efac3f4f4bb2a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969176, "uuid": "c200b45a-e26e-4fe9-978e-c4360c5553b0", "comment": "Malware payload (Mirai)", "value": "7a5b902c31e465bd7ad9a520f9e1de858adf4765d997ef1503ee375867ef25dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969176, "uuid": "f9d09867-334d-4f9d-b89f-5a6b95038347", "comment": "Malware payload (Mirai)", "value": "4d696268a93b264b701450b22fb70819c0b32dc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969176, "uuid": "47efee2a-4438-4841-a123-605166c12df1", "comment": "Malware payload (Mirai)", "value": "2b009cd4dbce10f1768fc28da9ac990c378b3119689c62a60497c5467159539f4c5c2ac7ee54085ec7e29d82dbb18a69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969176, "uuid": "51c65fbe-e2d2-44ef-ad82-74fb75069964", "value": "T1C6C3D60ABF610FFBD86FCD3706B95B4525CC594622A83B357634D818F24B24F5AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969176, "uuid": "73b8370d-e02c-4431-8e02-344ede5bd7d4", "value": "1536:6T49TcHNDF8wV+9J52HAMNZq3cB2nHRSju4PRR6hg7Pc5Ul/sYDgEHVE0uZ7R98:6M9wHNDFL+9H2PEjCIhg7vqoVE0uZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969176, "uuid": "adcccffc-5e06-42bc-b80f-270609ad20e9", "value": 119276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969176, "uuid": "531127b0-a08d-4d8a-8742-dad377055ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969176, "uuid": "c4f663cc-f72f-42c0-b070-b99bdbd7c8b6", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5ee121-e490-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766997100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997100, "uuid": "8f1217ea-bc4a-44eb-ae54-5e504b215edc", "comment": "Malware payload (CoinMiner)", "value": "f2f4f712a5889814fb98f89c681ade91", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997100, "uuid": "2f4cec1c-0563-4e15-b1d5-97cd81a7d1c6", "comment": "Malware payload (CoinMiner)", "value": "7ae66d6e53f0c878e31a75ee24c1b6b917896417ba1c627091888e6319f1bc90", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997100, "uuid": "5072c69d-212a-40e9-a9da-9dacdd717f69", "comment": "Malware payload (CoinMiner)", "value": "d0330e932bc485514dbaaa10ce738a8609a45c63", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997100, "uuid": "f2eab75c-b4d4-44c8-8da1-4d6d586d1377", "comment": "Malware payload (CoinMiner)", "value": "50278f156ed6743883021215fc5387a7a9b6de870f3cc4647e2898d351a4b72070ed41a11de2bec473ee48e258502e1d", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997100, "uuid": "6bb7bbad-5fac-41ce-bddf-0b53630b58b6", "value": "T15F616F9937016291C1F12B76DECB124ADB0F517F43960954B89CC2CA3F31C2AD799E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997100, "uuid": "56ad27b1-af04-4421-80a8-82afb415a5aa", "value": "48:w1M161L7dz7cABXS4yI7Uudf9xYMYLG2SzlP93JnFVAcwbmjYAY9LjDYaoef+bcU:6tzA3BudYejUNpYUg0R0VRVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997100, "uuid": "710fe27b-c093-42ab-b2c8-5b7380d192d5", "value": 3441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997100, "uuid": "bb3dfaff-e840-4037-b452-0346c2a6719f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997100, "uuid": "eef6b68d-8c87-42cd-9861-533f1a7e3ef4", "value": "7ae66d6e53f0c878e31a75ee24c1b6b917896417ba1c627091888e6319f1bc90.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bcbe5c-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1766968078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968078, "uuid": "cdb091bb-952c-427d-8a00-5e468f0a6928", "comment": "Malware payload (PureHVNC)", "value": "7cec695b5af24500b34eeb17164c24bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968078, "uuid": "b5a9d1ed-99fa-4059-b509-6edbcf6fa837", "comment": "Malware payload (PureHVNC)", "value": "7b180e232ac075fad7ebe3754801ac2b591b795fbb0f842912b978ee391a114b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968078, "uuid": "50a6f2d4-e705-4dfb-a589-88045701d698", "comment": "Malware payload (PureHVNC)", "value": "29fd5ce555625ac2e78d8b021d14b95fa9ad7dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968078, "uuid": "d93dc604-7fb2-4c3c-b92a-357c03fe4c31", "comment": "Malware payload (PureHVNC)", "value": "d56d3d8625ee736006ffd7009b03d73bfd5adc9a7a1abcb5bae31bed5bd4f8d9b096d57b5f53fe30e6b234c2721b7a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968078, "uuid": "3968a61f-7a49-441a-8b39-3ed7db8a40a7", "value": "T183E633709F72895BE53702336FC2064467DC2EB920A15B773BAC3FD6A449360569E38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968078, "uuid": "68f4c2f3-a11b-482d-887f-0a723ef64f8f", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968078, "uuid": "afcf5842-5a4b-48c1-9687-a544bf097330", "value": "196608:5H8QtP009tb+5gYypzskn+TtQyq1m1A0sTSz2ERyfZnpFEjJkhwhisMP6UMLmxdP:N8QNAOVmtQb1m1LmA28RblSde/HYBOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968078, "uuid": "0ecb459c-1da5-4e8a-804c-62ad6564223b", "value": 15203328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968078, "uuid": "eab953bd-2c99-477d-9c34-a966e92c9eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968078, "uuid": "ad926c98-ef7f-4c39-8b7e-6a52c23786d9", "value": "Installer_v2194_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502ad86e-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029963, "uuid": "8162da93-f2f8-41c3-9681-fda732473914", "comment": "Malware payload (Mirai)", "value": "147493f9858f37bcd648413fa11f8d7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029963, "uuid": "4008e52d-0bac-4fd5-971f-ea566dd96ed3", "comment": "Malware payload (Mirai)", "value": "7b64778de61c535564cad186e3697f4b86404e37351403f4ff0f1e2a76f9eaeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029963, "uuid": "79e7a754-1a04-4221-8c0e-6daf2b6a10e8", "comment": "Malware payload (Mirai)", "value": "271806690ac07a5ba70f607f2546322c60e4b3ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029963, "uuid": "0a4eb395-28d3-4466-aa9d-a2858481cdec", "comment": "Malware payload (Mirai)", "value": "9333f6bf21051c0ffdebf0841cf899ebbe67691e5cbdff997b642ddf0c086cd4c41173fa48a2dcbdc8b5bad2e69a82d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029963, "uuid": "c71cd308-7792-40c8-967a-374eb63c7929", "value": "T12B045B02B31C0947D2572EF0363F27E183EFD9A225E0FA85655F9A8A8171D371589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029963, "uuid": "3323c450-9ca2-4585-a1db-1a6378482111", "value": "3072:fmKPkHcYhxYjh57Y2yWE4RHJq6hh1qfrWyN:fmLJhx+7Y2ylIH2frt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029963, "uuid": "7830b46e-1d72-4abe-99e1-1a27548e5b02", "value": 188124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029963, "uuid": "4e247b61-c71a-4b7b-aff2-5f1bc888361d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029963, "uuid": "179d2627-155e-4a0a-a8ec-49870ff5a9d6", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd54ece1-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967064, "uuid": "3bd52f5c-f12c-41e4-ad00-1e224d7bedc7", "comment": "Malware payload (Mirai)", "value": "2de43fd9472e1533626b7cdffdf4cd23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967064, "uuid": "2e72a72c-8c52-4d6a-a2b6-ff4f8f1be59e", "comment": "Malware payload (Mirai)", "value": "7bf076aa6e0aeda2e902041b21d5806f8b50c8b95190bd8101b2c473bb27dffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967064, "uuid": "24d893b8-9995-4f16-ba15-e2d1e9107e60", "comment": "Malware payload (Mirai)", "value": "a523e22c72cf77e4e8afb65935c9db846ba67d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967064, "uuid": "0222c43e-c5cc-47b9-bc3f-0cb231ba4bb6", "comment": "Malware payload (Mirai)", "value": "a292e1288faba36fefb3de5b8a4ca797d2012f431c507069fa24c0fd4bb65bad645f093663d71a29aa911a7f333f5e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967064, "uuid": "4219561c-bcd4-42af-b1f4-fc6c45371f67", "value": "T130933A95B8819613C6D562BBFF5E42CC332613A8D2EE7203DD25AF25378B81B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967064, "uuid": "80f1d6a0-7efd-4d75-962b-7ff1d9e0da78", "value": "1536:3da96zsrshmMVRqhpysxBSKYSms9FhmCTBuotgFU8vzuZ7RAg:3dc6vRqhpyszYSms9FhmoYzuZWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967064, "uuid": "359e695f-ff8f-482f-aea7-307bc427f6aa", "value": 95408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967064, "uuid": "968e9a83-8531-40b6-8f3b-e570c8b0091c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967064, "uuid": "8f26317a-4645-4e76-b8d5-eafc4bddf0c5", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0209e755-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967984, "uuid": "c8d1eebd-f66f-441e-801e-30a348d8f8e3", "comment": "Malware payload (Mirai)", "value": "5b8e0e64b9c212d96b3aa3f8e977141e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967984, "uuid": "7cbb9598-5e2c-469f-965b-bad49e4b2a62", "comment": "Malware payload (Mirai)", "value": "7bf67b177b1da8900af33d491c1317b48329185afba7ee01fa68da58addaab83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967984, "uuid": "315e2a2f-c98d-4f76-bf61-c682a39a5bbe", "comment": "Malware payload (Mirai)", "value": "d9fa210cdd7e81fbef41779d5b9dad6d3376f448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967984, "uuid": "df8f85dc-b423-4780-9eb2-69bc12b95dff", "comment": "Malware payload (Mirai)", "value": "c1e33e2e08e9d9f6b57a99d8173cea3818b36eefb710413e51ca2d62cbe4c9ecb14a7aaddfe5acdd972c7b5d81e9d45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967984, "uuid": "f7c1ead2-0b47-4d87-baf0-96c3ff0faad6", "value": "T1CA631267D33FCBD0BC801D31278A4E7537465196C07B35E68B4D249A6EAA11B93F9807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967984, "uuid": "8b93f52f-f129-44fb-b799-a57d6b1e675d", "value": "1536:xEAlb/HZQ+FI4ngcgmpY5TNOOiY9iReJhZ+ol24CqNvQldyLoz:xHlV7fneXOxpehl24pNY/yLoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967984, "uuid": "c83eed24-ece5-4e73-b022-abcc41f7c918", "value": 72244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967984, "uuid": "b95e2702-2132-4d50-bb01-a8b2329d85bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967984, "uuid": "0a42a800-2b36-4ad1-89e2-85a8cb98d6f1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9308ef6-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995350, "uuid": "95e66124-3e75-45c8-9582-76e4149baa22", "comment": "Malware payload (XWorm)", "value": "df1dd20d740adab589118dd8558db162", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995350, "uuid": "2d048a52-47c9-4935-b406-4a30e6113ea4", "comment": "Malware payload (XWorm)", "value": "7c137887fde3620ba625a7e251689c2508ae0116a66d56a0791b9701c553af55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995350, "uuid": "5eb8d913-f3e6-4e49-94d2-0b7dc7c2a70f", "comment": "Malware payload (XWorm)", "value": "5ed99864d5f277f62e6384d92cfd6f4d69b074b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995350, "uuid": "a8798ee1-e238-4f94-b0d6-514e0505c0cf", "comment": "Malware payload (XWorm)", "value": "0f1d6a6fee250b61c9c049b0aea3d4dacf391656f0501e6faa1bc138940abd7f954c04e57277a53f4e630aa40f496d1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995350, "uuid": "d00874a8-4fd6-4e34-bca9-28de0e8bc76a", "value": "T142633C5EA3D90C7FAC7D4B529B543C2F976B42921ECFC8510548A7308D940A83BA76FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995350, "uuid": "3d7d5eb9-c2c6-4f28-841d-2291d175b21c", "value": "768:I8w/h62/jWs6oS+xISN0vlW0BFpdCdzIdlQV70L1rSw9hKKbaGsL8TsItGmBx7aw:I9l/AoSSM9ttQusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995350, "uuid": "0630245b-aee1-4fe1-981f-d10653fbb0c8", "value": 70587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995350, "uuid": "ef2372de-8bce-4028-8af3-2b120e6d0c5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995350, "uuid": "94206511-db20-4c64-bdb2-9580c11db489", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7b527b-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982336, "uuid": "7d9931c7-6c81-44de-b604-a2dbb8cae1e0", "comment": "Malware payload (SalatStealer)", "value": "4a573eb1f8428d8e8ad33205ea2fd2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982336, "uuid": "cdcc2ae7-7ed6-4430-9eb3-4ee12865900e", "comment": "Malware payload (SalatStealer)", "value": "7c8a93058bb049b9a6069ad6668a09be4d223cfce8157fcc664c1a5998c25341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982336, "uuid": "7ee87835-f78f-4012-b6d8-f81948a53254", "comment": "Malware payload (SalatStealer)", "value": "786addcdf92828cc6d9c7e74eb81006a5f9c6632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982336, "uuid": "4e16549e-af11-4772-b51f-21d12dd948b8", "comment": "Malware payload (SalatStealer)", "value": "a091d78f437bd0535e55db0689b2d1107e7111227bffca9715409e7dff189f2da6d1e4bcfee42b055c1cbe93f9b274b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982336, "uuid": "1027c3d9-3e4f-491f-97f1-c6187683f068", "value": "T1FFC65A41FACB54F5E9031831419BA23F23315D058B28DBDBEB643A2AFC77A911D77A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982336, "uuid": "6166dcad-21bc-4f88-81bc-dbb0ea97b235", "value": "49152:7Dsh8FXe4qjl5/Y3poCyxk94Z6xfU29qvOJncwyfccwNoUOJ14DqVkc6elLg4Gb1:fy8NRoGpo/kK4y085xrO5ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982336, "uuid": "b00a3b73-d444-498a-ab79-b8b36620a137", "value": 12101120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982336, "uuid": "d1b5f0ab-3fee-43aa-8dab-5ee1c9cb59be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982336, "uuid": "79c0258d-9376-4c5a-8db1-90ccc7e52259", "value": "7c8a93058bb049b9a6069ad6668a09be4d223cfce8157fcc664c1a5998c25341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629e1dd4-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995204, "uuid": "298760a2-de1c-49a7-92c2-85f47124041d", "comment": "Malware payload (XWorm)", "value": "8faa4d6b1fe2948cc4bf00eb54d50b54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995204, "uuid": "f3b78516-33c3-4227-8e52-93d328621f94", "comment": "Malware payload (XWorm)", "value": "7cd9c15733ad95a26623b6ff97a6417e0bebe6535ea6347546e546174c680bb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995204, "uuid": "1c660fdc-3a7d-4af1-86fc-ae0de1abf7ec", "comment": "Malware payload (XWorm)", "value": "e8f593a42add410f4b5e43d0897379f2f6a1a586", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995204, "uuid": "1d63bb59-d003-4d7d-ac1a-7b99dfecce01", "comment": "Malware payload (XWorm)", "value": "f5d26dfaa7a5656920f9d736d6b997710674c4182f7052e64ebc36a2b7d26f05cc0a430587fbdcf8fa3c42580881b5ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995204, "uuid": "492d7f36-d5c5-47c8-a02b-699a2adbb623", "value": "T15B630A86B323CA6994D17F7F60099266A1A2D47C249B0DDB6A09B3CC43647C1AF349DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995204, "uuid": "139cb2a7-a15f-492c-b459-313c62aa50b2", "value": "768:I8w/h62/jWs6oS+xISN0v4xlUxlCxlIvxlzvxlZxlExlNxlKxlAxlKxlNxlMxl3D:I9l/AoSSMMlUvusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995204, "uuid": "b200c1a9-37e4-4311-b1a7-6098d7d9a773", "value": 72498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995204, "uuid": "154bc58e-a79c-4058-bb05-a394f6c553f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995204, "uuid": "2c7dc2c6-77be-421b-8651-b6502cc961fb", "value": "invoice-1645080830.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30588983-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995550, "uuid": "08e00e92-3774-4db9-984b-c595bc8fe872", "comment": "Malware payload (XWorm)", "value": "5e091f6137c7200514d079736c9da326", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995550, "uuid": "bb35d8d4-62f4-4969-8935-37412b48c44d", "comment": "Malware payload (XWorm)", "value": "7ce0f9e681eed40a6132be8caa6c45b58f683b4941f58822d65e8047785072de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995550, "uuid": "7bc2d163-f5c6-4252-94cd-6dcff3c3199f", "comment": "Malware payload (XWorm)", "value": "f0e2a22163e5d5e318b3b6cc050d63f5dba42b99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995550, "uuid": "3657afef-8c60-4b50-bb01-6b40cda6564e", "comment": "Malware payload (XWorm)", "value": "2572705ac899785558b26c223582eda9f3a70705719503a20a009b5cab02a671ee00719e1aff1b41d2a6ff75e031bfc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995550, "uuid": "cd9c1f40-0469-4576-9a85-f132ed5695a4", "value": "T15C7309AFCB3666CD0893F9AC1F9962904A03DE741DD024613C1AE4EDE294BF22C57D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995550, "uuid": "8ecd66da-848a-4eab-9c25-3c94a497e3bd", "value": "768:I8w/h62/jWs6oS+xISN0v+0NaFCdkfScBYrwz2y8kTAlGB:I9l/AoSSMe4usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995550, "uuid": "961dcaee-0c40-4a2b-960a-03c66f23805a", "value": 73451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995550, "uuid": "e54f095f-1d74-4af4-9d5c-25031c9ac8e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995550, "uuid": "0ba7bda1-87f0-42b1-a190-5330be3543eb", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4385124-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767051659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051659, "uuid": "31d94364-536c-4b07-bd83-c97e2faab39c", "comment": "Malware payload", "value": "504216021b74471ef4ca77e6738fb35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051659, "uuid": "2aaf148b-a288-4fb8-8cc8-d8bc57f477cf", "comment": "Malware payload", "value": "7ce1e3c391c36c9b8d8dd9e7ffc48443eadd68e787688a26a2a8a47310adebe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051659, "uuid": "89b85531-98dc-4610-a4cb-d27a131a7522", "comment": "Malware payload", "value": "30965715e16de7109485688f8e5e531f7cc54f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051659, "uuid": "d84ae2e9-70b9-4ab3-9d76-b848d9252623", "comment": "Malware payload", "value": "28aa6d9b1e9eda82769515f31d63f2a457da6f031eed9439533a45abf09f12abcf4ddd77ae7fcfbcc3d98c0d6fd1b1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051659, "uuid": "31776e41-9576-4fe0-9e68-b7741bc012ec", "value": "T160134B0477914750E2FEAFB019B2B1060679F90B9E23E75E0CD8959A2F23BC0CE517E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051659, "uuid": "fd65ba42-b223-44e4-9be3-541a12118eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051659, "uuid": "6db1dcf8-eb18-4972-9f34-f589def201f4", "value": "768:8kRSRsQr1y9hLS+IWITFPI96T6pO9hIJy9j:8kRS2h0hFA96T6pO9WUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051659, "uuid": "15687d4c-f8c8-4a82-97a1-43d2ce1fcea5", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051659, "uuid": "fa6fa101-a82d-408e-840e-5fddfb29f427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051659, "uuid": "85d3ee77-23db-4b1c-b178-19e48c245fed", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a92da6-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013975, "uuid": "5f0fcdcc-6721-417e-a912-74f59c09fdd8", "comment": "Malware payload (Mirai)", "value": "3b7f30fec2a4a6512eb0f47f889c6834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013975, "uuid": "355c641c-4b99-40a5-8909-9e1ec5ffb422", "comment": "Malware payload (Mirai)", "value": "7d075e0d37c9bb897721df4b44adb188319d0902df36d4b30079240e9034b060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013975, "uuid": "3409d77c-95a3-479b-8e3e-0703e7462fe4", "comment": "Malware payload (Mirai)", "value": "c995d377069493aa2afeb55f5e1bf16c91acda38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013975, "uuid": "e743971c-9d04-4707-9b4d-06d1546a62ca", "comment": "Malware payload (Mirai)", "value": "73fc64e8d3096e82870ccb27dcfadad17842b080539fcee809e1a0c4655915d0dcd969283a8fcf937212522984362ce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013975, "uuid": "1defbd3e-6a73-4c5e-9d0f-15e15a799a19", "value": "T150A3F78AF9819B22C5D522BEFE1E118D331357B8E3EF7202DD105B25778A92B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013975, "uuid": "d6001f0f-4a32-4372-b8e5-6c1accd5d675", "value": "3072:BpIei30tZeDsoRg+YfsR/KsG8KO2bX7csLP/5T2:BpID0tZeDsJkR/KsG8p2bX77T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013975, "uuid": "1271b125-ecb1-4f4a-b10a-5658de27a37a", "value": 103776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013975, "uuid": "4f3d8428-cb8a-4c3d-bcb2-2fd0845e11b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013975, "uuid": "9bd4e491-79fc-4b36-a900-f6069a964bd3", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9e243b-e47d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989020, "uuid": "ad95c3ee-330e-42b7-b28c-c100b4024311", "comment": "Malware payload (Mirai)", "value": "f959e02657bd5405400a254babd1b7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989020, "uuid": "830bacfe-eb54-40ae-952c-5cd189161caa", "comment": "Malware payload (Mirai)", "value": "7d17d1187f130808f957bd9762f1915ed62e99f46528a96d916126c3cb78b38b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989020, "uuid": "10ea6bba-b576-4f95-bb8c-01a56bb38f4b", "comment": "Malware payload (Mirai)", "value": "2e0903029c8dec8abf1566246837e4bede283134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989020, "uuid": "78d5c86f-d0b4-4648-8b61-8ff8a8df8cfa", "comment": "Malware payload (Mirai)", "value": "2bb4eca14ee3f55676889aa04eeb1f8a07c53c6eac867b49ff8f1ee4fc7570217b4fe288bbcf0f552de879528cbfb6f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989020, "uuid": "63ba0c8f-4976-4e60-a811-fff7f8936a44", "value": "T173C3A24FAE618F6DF26C833647B74B21DD54636266E0D985E26CF6006E3031EB41FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989020, "uuid": "70d3ad58-070c-4859-a823-1918ebcb74a0", "value": "3072:ZA49AxgwTawRoUVK0D7PukVsWL37VRSl2a83qUTstsK2L27GonuucuTZqGYB45fJ:ZA49AFFeP97jPBmFLzgiXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989020, "uuid": "ade1cd40-6ca2-4974-9545-235856bb73b3", "value": 118708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989020, "uuid": "2ffbbc77-3dca-466f-afec-3f6bbe06414c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989020, "uuid": "40cb2423-fa18-4545-a133-de43600c1223", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476194f6-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967241, "uuid": "deb7d50c-14f6-4589-9260-944fdbf44eae", "comment": "Malware payload (Mirai)", "value": "3a2b608c6b3361490e3cd047a039323b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967241, "uuid": "e1fe8117-0074-45f8-a025-bce1b2b50052", "comment": "Malware payload (Mirai)", "value": "7db44ab53deb1290b443570e4884d4e488d8ef512c97366dd642ef2874f33449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967241, "uuid": "83fa2ae6-94a3-48a8-b017-6401083f1e97", "comment": "Malware payload (Mirai)", "value": "aa961b2925f983fb18aa836584c0a94660ed5f41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967241, "uuid": "692ddb53-7652-41bc-8fa4-afd474f4312a", "comment": "Malware payload (Mirai)", "value": "ba70d1b21388c22629aea7f6d8257e3218792c8034fbf0a487bf90f8ae638dca9db91b731032e81be6d3f0ab79f79336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967241, "uuid": "4f9b05c0-d4d3-4de4-9c73-89e857165a5d", "value": "T19D933CDBF400DD7EFC0EEA7B44570A16B530A3611E920F277757F9A36DB2194482AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967241, "uuid": "5a8a879a-e75d-4277-9203-e060739bf531", "value": "1536:C/dnO5pqxTqRXNo0e0XcP2PrRRHd9jS8inXHB1VpuKJfDDl47BA62iNcPhI:C1nO4TqR9o0e0XcPijHd9j2x1juOQBA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967241, "uuid": "69014da7-1029-4d71-a386-98a3d01d4c0d", "value": 91208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967241, "uuid": "437134cf-02d0-43b7-8d7c-3153de95895d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967241, "uuid": "f51170f1-2ec4-47a5-aa14-1dc27133a235", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0242486a-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051307, "uuid": "af5c1fd2-3df4-4c65-9b2f-67c942fa7e83", "comment": "Malware payload (Mirai)", "value": "62f649880db436c1b7f142088071f306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051307, "uuid": "39c5f6a9-f9bb-42b8-a12f-d4e03a69473b", "comment": "Malware payload (Mirai)", "value": "7e777905fb12c6ed77b029ef2ef50beb7adf40d1424ad8bde45cce63957ec9e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051307, "uuid": "05d2cf3d-8de5-482d-aa1a-60a0f14201a0", "comment": "Malware payload (Mirai)", "value": "908007942ad59382e221e0de8e92c2e1d5a8a6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051307, "uuid": "30756cd5-3128-4c4a-ad16-009938221df8", "comment": "Malware payload (Mirai)", "value": "cd02902b558ddef438dba77030145488fad478c5a3a7d42db26b2013c1ee1fd18f4488f9856d2f21f09a8ebbac5586db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051307, "uuid": "346cf3c7-bfc5-45bc-a0a8-3002f41896d0", "value": "T14604981E2F228F6EF269877047F74E305B5976DA26E1D680E1ACD5501F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051307, "uuid": "d494fe77-7e98-4cd2-8845-648f4e8e6d9a", "value": "3072:PEdUfO0tYuBcJY47r6LxVBoCAcW7T/zLIeF0JNQD6A6q3P:cdUfO0tYuBcW47rQLW//zFkQDRJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051307, "uuid": "6dc8813f-a30f-4a11-bab0-6234a561d6d0", "value": 187504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051307, "uuid": "b789ecc2-ec1f-4165-920a-eb6d2af22d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051307, "uuid": "0880f72c-bfe1-40c7-816a-218a98771c0e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae97c7b-e481-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766990440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990440, "uuid": "ea499ac7-53ff-43ba-986a-3e57a96fe74c", "comment": "Malware payload (Mirai)", "value": "88a94c9468b23404d32c0f916bbde621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990440, "uuid": "77928c5a-f1db-4ec4-af2e-0e7f78af3008", "comment": "Malware payload (Mirai)", "value": "7ed19ef8ffa7a93ecd7aabd8c86174de1eae6ba89cc4bb7b2b71be0291c0f76c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990440, "uuid": "68e35e8c-ce92-4c32-8cf9-acb80556eacb", "comment": "Malware payload (Mirai)", "value": "06487181b25b4dffec0e5efe129f84e6597c8dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766990440, "uuid": "264661b4-f7db-456b-bf41-84084d6d66ae", "comment": "Malware payload (Mirai)", "value": "332f41c6764a8b6a437fa54efa4f4b12cac82bbbe1d7af66f478ed8b4301d977798500d67d9880e34a9bb63f57a30a0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990440, "uuid": "e7b7d7a6-96d3-4401-9afe-4a76899c1cfb", "value": "T120A32A95F982AA22C6C21677FF4F428D37165798E3EE3203CD195FA433CB95B0E2A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990440, "uuid": "f2a69337-82e0-4de7-93d8-b62995aa2dd0", "value": "3072:JXXIRqfeAPk/FgkyfkIwAhEOhgPHWXInMnzTI7:JXXIRKPk/WkekIwAhEOhgP2YnoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766990440, "uuid": "b319d6c4-cce8-48e0-857b-e48ce2773391", "value": 105816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766990440, "uuid": "fcc1dea1-bb16-4912-8869-a1bb4322446e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766990440, "uuid": "2d47670e-244e-422f-8813-0786bf48d7f3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dfcead-e4eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035843, "uuid": "67b075a4-d28d-4315-9239-e834a0044d6d", "comment": "Malware payload (Mirai)", "value": "dda96cfb3548699ff8d7bd8984f58452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035843, "uuid": "6f1fa829-fd41-4a53-bfe1-ccde003721dc", "comment": "Malware payload (Mirai)", "value": "7f4fbf13a3be2e8b78ca4f6ecfab38b97120d56cb0fb06bb734a61eb86b1ae39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035843, "uuid": "fbadd4f9-58b3-4405-8d54-7cdb17cec8b3", "comment": "Malware payload (Mirai)", "value": "52d5492ba8504ab0d001e6d204eb1dddfac83c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035843, "uuid": "8203a15d-5756-4578-9b12-08804c1c9a45", "comment": "Malware payload (Mirai)", "value": "e5ce485d425896637e25abfc60373ba34e78c5a76598137611104979e3273996d1375a698a9bdb428c1d1e6eecb5f6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035843, "uuid": "0c9b3fb8-f6af-4f96-9422-b8058794d69e", "value": "T138F36C81FA87C4F6C8174A705067F73FDB32983A4077D68DEF999F32CA239419216299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035843, "uuid": "cfe6e5bf-a0d7-483d-b224-9a0592e2da85", "value": "3072:YWVu8uSLZaO3Zmo53q8o96ENtpYgvfpAsvoxNZ8s7lohIB1nN:hu8uSNaO3V53q8oYsvSis7lpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035843, "uuid": "57f35d89-d70c-4457-a0c0-8dc26ddb4f9b", "value": 163176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035843, "uuid": "114ffd17-5bc0-4a8c-92af-d8bfe1d78628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035843, "uuid": "8c5980a2-f1f5-47cf-aafc-15c696ade93c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e833b7-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030212, "uuid": "d93723fc-5f69-42d2-9a24-28c0461f2c38", "comment": "Malware payload (Mirai)", "value": "409468248046215867ea0173c588d14b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030212, "uuid": "94204185-b21c-4cbe-aa96-bd1bd1886b3c", "comment": "Malware payload (Mirai)", "value": "7f59c5e7a0880e33ccdb9bb6f2e754eba7d2497ba2bf66d841ce5238e349332f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030212, "uuid": "9e4b29f3-979b-4d37-9615-b273996c03c6", "comment": "Malware payload (Mirai)", "value": "472bff977e56bfb425f4835d1fbe8f94f7b1c797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030212, "uuid": "e2d0c8b7-836c-4201-9f24-51e2fb23a3df", "comment": "Malware payload (Mirai)", "value": "5c620006191427c3c3708648c1ea303da95c6b861d1e69b3d7c0eb6a232702cef507b4e27f5acf8d51ed406a1449542d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030212, "uuid": "f9b2daa7-72e9-46dd-ab43-2dba1399d45b", "value": "T10E042846ED418F11C5D622FAFAAE014833536BB9E3FA7102DE245F6033C6A9F0B76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030212, "uuid": "042f2340-c0c0-4e2e-a799-4526ddea2498", "value": "3072:ALQJvkgnhFELUhEPrMj4sM83naw10ZQ8ULqKdEsGu6Nz6hh1knR9i:AL68g4LUhSMj4tEnaw10ZQ8U2Vsj6NR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030212, "uuid": "64292e3f-f568-4d60-ad10-2fe411a99b02", "value": 182596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030212, "uuid": "49f1367e-fb16-4899-9910-bec148c57db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030212, "uuid": "50d0ea38-dab4-48a7-b861-02d28b2a2ee8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b2bac8-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971401, "uuid": "9a0c2050-c1ec-48c9-9750-39ecfe87dddf", "comment": "Malware payload (Mirai)", "value": "6f44f28ddd1f314536a5ddbabd4c8540", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971401, "uuid": "630e9fb7-4187-4926-9f4d-c107ccf21394", "comment": "Malware payload (Mirai)", "value": "7f92e1ae9fdf7231572d7153aeacb2e82e4e37477814c1fc178adf70420df068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971401, "uuid": "524159de-e87e-4782-8b74-328110b7807f", "comment": "Malware payload (Mirai)", "value": "e1cb9965eeb1b0a2eeec447a5486b723979ce7d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971401, "uuid": "55289e6e-8be8-415f-8923-47ef5c000be0", "comment": "Malware payload (Mirai)", "value": "62b9d4b25d8a8ef49bd48dcd377f32f2edbe829dc8229db047f98bdbfda1f529c849b3d97fae93c62b958a9355a7cf55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971401, "uuid": "90ff03c3-80f1-4243-a7ff-dafd1cc61e1d", "value": "T16893F74ABF650FB7D8ABCC3706A90B0525CC695B22B53B393934D828F55B14F1AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971401, "uuid": "2db72f0d-f934-4ceb-8134-97e5a30daa67", "value": "1536:5Ag1+GZFdy5Il/HYZLXW3AeoxVcWZeB4IBOLUuEG33ep6:511+GZFd2Q74VcWZ6ELUuEG33A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971401, "uuid": "e7040ed8-75de-4b73-bcf2-8d02f808922f", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971401, "uuid": "30ed5293-3b84-40ea-9de7-f77ce036a1b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971401, "uuid": "dbf56339-3501-4dbb-9a53-318e89aebdb7", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e09b2e1-e4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034227, "uuid": "89c43bb4-5e97-4fd5-bec5-ea1edebbd2aa", "comment": "Malware payload (Mirai)", "value": "107fc38b4046f3d4cde7b30e827d9a4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034227, "uuid": "ffba0bdc-b960-4d21-8804-c2d505c6fbbe", "comment": "Malware payload (Mirai)", "value": "802637ce33167b6c0776a6267f5a56b4c3da554485a18e23e7a40a27acd329c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034227, "uuid": "6cace073-3df4-4046-842f-3597d6157b8e", "comment": "Malware payload (Mirai)", "value": "4f08e68d5a84857122ab2d989086af0edc9f6461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034227, "uuid": "20e43cb8-aab4-47b0-b6f8-2e38152c4307", "comment": "Malware payload (Mirai)", "value": "b6b2b1c071218b6b7b891ce094d5037aa8e7bc51df6a4a6cd641f2034b72441fa51592465ee0fba3fc9295310069d507", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034227, "uuid": "a4be6125-cadb-4361-b789-2715bbd8cf73", "value": "T154E37DC6F783C0FAE81605711177BB269E73D53F242BEA83D3B95A32DC52601C51A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034227, "uuid": "ff2f4bff-8f39-4d7e-99aa-8e71acd97f5c", "value": "3072:D/FA3EHzUa5XfMZ5qly5yplXQ8yXzM4+PF3CKKWGJhIB1JG6:LFAUTUaDpX4OLKWGl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034227, "uuid": "40d272e2-117e-4f84-b045-6c12648dc77d", "value": 154056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034227, "uuid": "a7ec544b-5494-4f8d-a58b-b2dc23bc3045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034227, "uuid": "79fb8870-4a4f-4cf2-8795-64044cd5d3a5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebc3aef-e494-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766998607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998607, "uuid": "edc2fa5b-7add-4f4c-90be-c5406de429cd", "comment": "Malware payload (Mirai)", "value": "47039871ba29d14173143cd400cbbd88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998607, "uuid": "d76692be-5466-4073-8bec-4748d65afa8a", "comment": "Malware payload (Mirai)", "value": "8027e72941597181a5559c88a2fd2ef1d3655cc384fab8a9d79776ed86517aff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998607, "uuid": "f5da55d6-c514-47d6-990c-8b27fa27210c", "comment": "Malware payload (Mirai)", "value": "549666bfa895e7474ed85ca7eb8b3a1b59554458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998607, "uuid": "07c67e8f-7820-4dbc-91ac-d3fdd7b040ac", "comment": "Malware payload (Mirai)", "value": "ad3b7c6360b0419f439b95b1822eec59fb5c9f4e8be6f44df59567c5d23d1d2e634bcdbdd214079f9d65defc3cc852f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998607, "uuid": "79b19989-865f-4e8c-b405-e91534be6037", "value": "T114041A46EA414B13C0D627B9FADF42453323AB9493EB73069528AFB43F8779E4F12506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998607, "uuid": "a13b7dc1-3232-4e8f-84d7-e99bc597fe1a", "value": "3072:is+G9rXs9hDw6fiTiS+/ae1bVnTmilOaXIWZPdP6owM/RTa2e6fL:i4s9i6f5X/ae1bVnTvfIuPxbwM/R+2es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998607, "uuid": "f78bf4b5-d35b-4c4b-bffc-a9dfc0071b31", "value": 188821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998607, "uuid": "7fee4fa4-7583-428c-9a72-273e203848ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998607, "uuid": "78d7f278-8872-4e6e-8058-49bd584d8152", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab24226-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026974, "uuid": "34436c41-b484-4b6a-b1b9-127d9fe93994", "comment": "Malware payload (Mirai)", "value": "4b3954765e6563208c18a93871bad22f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026974, "uuid": "af1baf45-e5e0-45cf-b44d-3e5b3b27e311", "comment": "Malware payload (Mirai)", "value": "80ddcc065d43d1536148c9c690fdfa7b34f7123b183f9313f5f04421ef4b6a90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026974, "uuid": "f12e8ccf-b31b-4041-a0cb-0bf3a5cbbe7c", "comment": "Malware payload (Mirai)", "value": "2be8427a4d9519ec39c88ecd7c99b847a3059bdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026974, "uuid": "aa82a95d-e206-4bd2-9cc5-e22f4996afdd", "comment": "Malware payload (Mirai)", "value": "285b46a402585238608845f82a558fbcc93e28d52aa8f34ce157f12b809849397e5cab12254baa427c4a02b16d2cd096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026974, "uuid": "b70c9715-3dbc-4537-87c1-c934daca4564", "value": "T1A2D3F79AB8819E22C5D216BEFE1F51DD33231BF8E3DE7107DD086B2076C691A0E7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026974, "uuid": "02815590-82f1-4696-b12a-0322fe0cd946", "value": "3072:+xH5H+QitP4x7ksDT5kzJ8jOthUEFcRWymD5+VXiJAYzJs18n537:+xHN+QitP4x7ksDFkzaytzufBVyJAT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026974, "uuid": "d41bb8ca-00d4-4e42-a7d2-04471beec191", "value": 135916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026974, "uuid": "9b0c1720-b359-4918-b109-71f34b3ab664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026974, "uuid": "ac4dd675-124c-48d0-b294-64130ed2e3da", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7537871-e476-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766985951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985951, "uuid": "e7bac812-8a26-4c52-ac29-a9da345eacf6", "comment": "Malware payload (Mirai)", "value": "1fc5c601be592a6dde25aa47b95d2bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985951, "uuid": "0d95de38-a988-482b-8efe-2a7b7a38d1ad", "comment": "Malware payload (Mirai)", "value": "813ff95d1ceab73217cb20b592bd4321c3074b9ac31814e349576b2e707dc84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985951, "uuid": "f778c765-7e4b-4c55-b048-5df3b45a53f7", "comment": "Malware payload (Mirai)", "value": "8373b4b23ebb149f52e68936c6af002e902857b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985951, "uuid": "c4976c14-38c0-473c-969d-d873cbe2361f", "comment": "Malware payload (Mirai)", "value": "051de09d9fc1065f352b50b014813495fec96103eb33abfd29d8017cd27bb7f11c1a8e8e7a8f201dd357912f8956e6d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985951, "uuid": "d2540b1e-b435-457d-b681-f82cc29f433e", "value": "T1B4A39E33C8396E68D1199AB5F0B0DF7D4713A511D6875F9AD0A6C3BA8043EC9F84A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985951, "uuid": "a275940c-5807-48ac-9449-6ab045b99e7b", "value": "3072:9qrtY85cVAsSw1iw0huPfqhKwUgoqEkazS2+nTR:9GtY85cK0B0huPfGVUl2f26R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766985951, "uuid": "220151ff-4291-43f6-ab79-57005bea4114", "value": 104760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766985951, "uuid": "5940ef62-4af7-4bf1-a3fb-b2fb1046f81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985951, "uuid": "d589b475-81d5-40c4-a412-cd339bf7bf27", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626ca7f6-e494-11f0-a129-42010a9c0007", "comment": "Malware payload (VertexRAT)", "timestamp": 1766998640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998640, "uuid": "2a68357b-d9a3-4337-aafa-7279e99ccdff", "comment": "Malware payload (VertexRAT)", "value": "66864919579944d57be50627067624a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998640, "uuid": "82c60610-e191-449a-9022-905b39f7d23a", "comment": "Malware payload (VertexRAT)", "value": "81556f171a662c9206900774779d130b02915dc30a73cea3deee617d7700c512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998640, "uuid": "a1a36604-fc42-4187-990d-c2451116200b", "comment": "Malware payload (VertexRAT)", "value": "931bb98cbd1eeee038e5d37cab45fdf4c6558c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998640, "uuid": "08015fdc-4ea9-412f-aefa-39e999e0e35f", "comment": "Malware payload (VertexRAT)", "value": "67b19e6ef79c1370ca54bc586c4707cfe44c2b676364b2efd018328f12dc921c49bb11cf4c02a6576f175a669baeb6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998640, "uuid": "d600ddb0-1aa2-4d90-bcb0-ffc93d82ebcd", "value": "T1BDE38C2279D0C032D06B11715A79D7B5996AFA33177484C7F3840FBD6E612E09B7E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998640, "uuid": "01ab8e9e-7c2b-466b-9ea7-1a1f0cfd6987", "value": "eb6f4bdf978fc07ec2cb56d40474a6b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998640, "uuid": "48170a15-4350-4a88-a218-10d2439e8328", "value": "3072:RsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:RplzpTVDVa2en/V6Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998640, "uuid": "5239e7d0-8ed9-43a4-9761-b26a18219a84", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998640, "uuid": "73f80d5a-bcca-4ab9-9698-802f0fb9e930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998640, "uuid": "0a667d90-94f0-47d3-88e3-894afb497005", "value": "vmoliza.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadc94e4-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013499, "uuid": "7ac6e8df-4b9a-4fb5-9e64-c3a1329290f3", "comment": "Malware payload (Mirai)", "value": "11dd357843322c0ff91d542980d09e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013499, "uuid": "de6c2c88-27a8-4d0f-b951-e42dd2e351d1", "comment": "Malware payload (Mirai)", "value": "817bcc80a4f506f399226baecc1fc22b3b1e11b10360ab6b58f54a57dd54e492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013499, "uuid": "aeebad5c-5845-4c9d-87ab-a56eec79c7ff", "comment": "Malware payload (Mirai)", "value": "e790a861deeb8f5e89424eef6a87dce7621d9501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013499, "uuid": "7e33399b-3898-4480-80bb-e90727a087c7", "comment": "Malware payload (Mirai)", "value": "8f4c759de0d1ce3935d7fe3772291da05882d8ea0ad3b010326736da6657f5699bfcaac4de13d2adf462da146b8eef0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013499, "uuid": "084df4af-56e2-4400-b97b-f679e308f5c1", "value": "T135735C4273180A47D9A60D70283F2BE193FFD95121E4B38A750FEB5A8277E36544AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013499, "uuid": "34b7d55b-44b5-4cd9-8e2d-ef169e1ea79c", "value": "1536:XxGF7pVSuLkUIi6w5pIWLESg5bscf6UrctTAbVRvC:4B6w5WSglMtTAHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013499, "uuid": "6f734b50-d830-485b-9b17-db71d6d72d60", "value": 75044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013499, "uuid": "2a6ed822-5ee1-41fa-bfae-a2eb8ca2723c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013499, "uuid": "6aabf003-0dbe-4b52-8456-7bf57230250e", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a45af66-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968159, "uuid": "48bb5602-63f6-4af9-9b1e-98d25ea8d404", "comment": "Malware payload (Mirai)", "value": "fcd281d996bba95372ada4b84074930c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968159, "uuid": "7858e83d-e3d6-4199-afbf-295fe9e1772d", "comment": "Malware payload (Mirai)", "value": "81d67250a63d09175d71bbdad548d48168df23758724dfc71f46cabb37b23d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968159, "uuid": "9eca8f45-73ea-4730-8d7e-efbc4aed7b74", "comment": "Malware payload (Mirai)", "value": "a197dd2a306e96638bcf04be6624ad7092f7dd31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968159, "uuid": "eb7af71c-8097-448d-a529-26d96e15efb1", "comment": "Malware payload (Mirai)", "value": "4a053a38bf993c3f347154fb0b43df381fcda9b725e935face437cf7ea9f6d5969a492b4b19e2d50de7a35cb91274e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968159, "uuid": "16d12ce0-2a6c-49c0-8be0-0b40401d5ce8", "value": "T18C53F182F653A15AC5CEB0B39CFDAE450830FD2718388EE6B6C8307644E675A721D6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968159, "uuid": "2d23ae38-cb51-4edf-964b-5242aa230f6a", "value": "1536:pcjq615yhO4EB+NDpaG3mN8g2+J45UR2zSxnouy8tyE:yq6nYoB+aG3mNg++E2Sxout1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968159, "uuid": "469348f8-83b1-4593-80e8-3c22f8c65f40", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968159, "uuid": "db49a372-b12f-4189-b39d-1a186484e318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968159, "uuid": "c0898062-a77a-4c89-95b4-b2554d1fd581", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7562f669-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986646, "uuid": "e5d05707-6bd4-4d26-8be2-df653b531b49", "comment": "Malware payload (Mirai)", "value": "ce00aecac81d2c2522a91f69e2609044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986646, "uuid": "ec0ea508-247d-48fa-b110-3c084c75cadb", "comment": "Malware payload (Mirai)", "value": "8202c1d3a953f12716dcf2e3c478ecdcd9a600b5f261fbde0d3227a7d1df1c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986646, "uuid": "5259e605-44f8-4ab6-8a1f-c997057eef57", "comment": "Malware payload (Mirai)", "value": "72f00677a604f1c749b44f77d3feadd5d2a37710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986646, "uuid": "297d80e3-188a-444a-bfb7-c72dd8cfc30c", "comment": "Malware payload (Mirai)", "value": "fe5caab06c1875347a184a0e013c11ac88a2808e53eea6c433187843aa5cbfb0df93d4cf9024c1e5cd8cc7d3e380e95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986646, "uuid": "bee1df38-84d5-4d99-90d2-384a271c5e07", "value": "T17683C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986646, "uuid": "e106a5f8-ace9-416b-9b16-5352267de23e", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAygR:x/8RHTgMcJ0fmqJZOpkM/JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986646, "uuid": "38dc4659-8988-43bc-b736-fa94e629a108", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986646, "uuid": "dcbabec8-5b47-420d-bc30-a1d447c95397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986646, "uuid": "3a193c8b-7a57-4a5b-886d-3424529293ac", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa52bad-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026464, "uuid": "5ab2f7e8-2fe2-469d-8521-ed9554499964", "comment": "Malware payload (Mirai)", "value": "8f3df91c8f0bd0fccc4dd1073b737241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026464, "uuid": "9f2b643c-63c4-4191-8608-bf14480de123", "comment": "Malware payload (Mirai)", "value": "8232ffaf9d981fc19bb74328f04f5364cf7af2af15e6a988e93768095694e22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026464, "uuid": "87eb69ff-ec31-4354-a668-03baa1e0e1f9", "comment": "Malware payload (Mirai)", "value": "4f9714bca68bc0d4579c9a1efe9afdfeaaefc640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026464, "uuid": "ec2b688f-3247-4864-8670-d397dca19982", "comment": "Malware payload (Mirai)", "value": "dd94b2692cda17a0c089b957abbb87eb2105f06d709132c709938b570ac56a1400d2966863ab48beb1622896667b2cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026464, "uuid": "16d8faf5-fc08-4223-bb89-f0c6b2f6ca68", "value": "T1FF342B46B8918F12C1C112BAFE6E518D33136BB8D2EE7102DD246F60778A8EF0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026464, "uuid": "3c36f5d0-e6ad-43da-9e9c-ba4be06f3c61", "value": "6144:LgbwQwkNk3t0rGlMO6d/p0DzAbVjrXdyyaLrniToQA8gX:kbrNYt0rGlMO6d/pczAJvXAyayTo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026464, "uuid": "0b477d42-b163-4751-a67d-f6e9dd5eabc8", "value": 234804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026464, "uuid": "42db3453-ba70-4bc1-9761-7dc863463209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026464, "uuid": "07175b32-b9d3-42ba-9a15-9e75c949e54e", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8340f27c-e4c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767020170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020170, "uuid": "6b945c16-1ca2-4cf0-af95-19e275426613", "comment": "Malware payload (Mirai)", "value": "f678402ed5bbb36384a9ed5c2ed00163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020170, "uuid": "6ec92e61-4cdb-409c-9a09-6dc6ea4a0692", "comment": "Malware payload (Mirai)", "value": "82b51c89a459fe15006f48974fd90fbc9641d2e33dfa10095374535edcfebcd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020170, "uuid": "a8d6a650-cc4d-480f-a392-35b63eabf40c", "comment": "Malware payload (Mirai)", "value": "119f9053646534e417c5b329869d9806ae572374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767020170, "uuid": "1ee628be-5820-46ca-8170-319d28890b7d", "comment": "Malware payload (Mirai)", "value": "32a37ef77c21441e3d725e3e1bda2ef5d56e0dc0bd84d2f901a706f21b1bf824368a0deaf114d271525a91b8113693a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020170, "uuid": "77030919-059f-4d09-ae78-890a90f2a193", "value": "T192234BC49643E8F8DC0A0AF42577F7325A31F4791079EADBE364DA33B9A2740D55628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020170, "uuid": "fc73192d-29e0-43e4-9b19-c2fe64097190", "value": "768:PQHAUpGpiSoHh3xVS+BuxWE+H3GZb8N9EtT7JbBQaufHlHh:PQHAUpGpiSoHcAzE+H368N+tX5BQRflH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767020170, "uuid": "785bd74c-6901-48aa-9c9a-a60d71155cb6", "value": 46012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767020170, "uuid": "572f785e-8522-4ded-b3d8-6f49481b3598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767020170, "uuid": "8ad3de57-cfcd-4ca6-9454-cb7d6ebf353d", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2366291f-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995098, "uuid": "268f072d-b8b8-4fb3-bdad-0651ae57210a", "comment": "Malware payload (XWorm)", "value": "2c3aa489ff351cb9d60772e01efdfb4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995098, "uuid": "23407a80-5a39-4f82-88db-981e457a22ba", "comment": "Malware payload (XWorm)", "value": "83297175eb53da3e9ba06d6e8caf849b7c2530a2e1a439dba48037986439bf66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995098, "uuid": "a7b80f02-a13b-45f3-a4c1-8f8b2118294c", "comment": "Malware payload (XWorm)", "value": "3017bd570c734eb72e0764567fffd7ff382d57ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995098, "uuid": "e3a5875d-5812-4914-a649-08fe41cd0c9a", "comment": "Malware payload (XWorm)", "value": "ad4fad166014483ff4552276fa91c75c062b9b721aa214ba50ad7522d3b110fbc688a4fbfce9bf2a2e4ffc0d3f224aaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995098, "uuid": "a7d6f470-0cfb-4de0-be21-c45a41010b24", "value": "T185631AA12F25400E967164BACCE46D36D45478B97C4C88C9E5BF23298F59CD1EC1B8BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995098, "uuid": "bfedc35c-94e0-405c-a9c0-68868fcaa1ba", "value": "768:I8w/h62/jWs6oS+xISN0v/+ooz+o2+oE+oh+oZ+oN+oj+oQ+oJ+oH+on+ol+on+u:I9l/AoSSMfuusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995098, "uuid": "99424a7f-6945-4fe8-9c75-148b0432ff1f", "value": 71573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995098, "uuid": "8b55d648-2b81-41b6-9f88-30dd0f5c74bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995098, "uuid": "82c4a852-3f75-4c86-954e-99fa17ed95f7", "value": "invoice-1645080830.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7110150-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028068, "uuid": "2e4871ad-57ab-4f86-8251-fc58641c146c", "comment": "Malware payload (Mirai)", "value": "5bbde46653854157cb0426acbdc0a4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028068, "uuid": "f51e9a83-ebaa-4b3c-b4fe-a98af7b51ef7", "comment": "Malware payload (Mirai)", "value": "8397125d6df9845b6f16f709624119130d0b738b439d9778b82664b08a287d47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028068, "uuid": "159f2c2b-21ca-4e83-b07f-22df472b45a5", "comment": "Malware payload (Mirai)", "value": "286349e96b31c677665a604ca3ae9da96da9c54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028068, "uuid": "6dd42478-817f-4689-a80f-328cd9c4d201", "comment": "Malware payload (Mirai)", "value": "b5d71a3d4a2560a675cc56568079b6b30a37eb7ffb4d89d716930609ef497632523fe60258c94c40059d2e4ba4959c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028068, "uuid": "5aa1b9f8-2a3e-4a30-a122-1c0ac43de4d4", "value": "T16383A50E7E219F6DF76C873587778F209798239627A1C242D1ACE9005E6034DA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028068, "uuid": "8d521b35-cb48-49e0-a1f9-511bc7e22ab1", "value": "1536:Daj5eEYBZ1VMHd0WiNv4rY4AP1qyC9182G2iu3jZcP+3Y+3P+3P+3P+KbniTG1h0:DVEK1VpP1qN3DG2iu3VcP+3Y+3P+3P+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028068, "uuid": "3dcbad69-fae2-4f33-b1f7-636897c8c6ba", "value": 84368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028068, "uuid": "b0dd6590-1068-4a62-bb50-fb7aa74f5cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028068, "uuid": "5eaf0ff1-c514-4142-b612-db25bb45b515", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41b29f2-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766988523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988523, "uuid": "2d8c925b-7267-4e16-8eaa-83e2e74ff9a1", "comment": "Malware payload (AISURU)", "value": "1c04f8208c17f1c8bac721f0c460b1a9", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988523, "uuid": "247d35f9-017b-49b4-b444-e096bb208622", "comment": "Malware payload (AISURU)", "value": "841e2dd3a028c6ec806f6868caa802973afe2e9fa39036a521b8f032668a436e", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988523, "uuid": "49b004e7-f54c-4f81-85bc-5bd474d3a3a2", "comment": "Malware payload (AISURU)", "value": "f3042882ec4f67d09e39de0cd9d7305abaff3ece", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988523, "uuid": "09d61dbd-a025-4c31-8f67-eda07fe4a349", "comment": "Malware payload (AISURU)", "value": "9070dbab73e81454b74eca3fa253c804716b54fff50941a86a63b5c2abc3f0bbd8b44664ad8dc6ef42814bd1501bb338", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988523, "uuid": "9727bb55-0004-459f-bf7a-8f694961c2f0", "value": "T128C31895B942AA22C6C3567BFF4F428D37165398E3EE7203CD185F64338B95B0E3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988523, "uuid": "7d028aa8-3c30-4104-8407-56a279d6bea0", "value": "3072:oLIk8WMw9PFxWPsJxoe5FDXLy3PpMO3Aa1ooxDMkN6nTTc:oLIk8WnPX2sJSePDXLyfpMO3Aa1ooAkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988523, "uuid": "96d1fa20-329e-4e61-85e0-b44dae59e028", "value": 124136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988523, "uuid": "6417696d-c340-4905-8943-ea46b2a51d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988523, "uuid": "b277251d-80e9-46a9-b31d-6463fb167750", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0159c8cf-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051305, "uuid": "ed317946-f369-4501-baed-42f512377a26", "comment": "Malware payload (Mirai)", "value": "8fc47a8342f509f1ec43bef22a805e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051305, "uuid": "30b17a6e-5cda-4bb5-8f58-e63f340a19ee", "comment": "Malware payload (Mirai)", "value": "8478a6e5dd8953253685393e706bf21368bd540461b19d49e5cd79c3da9d42f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051305, "uuid": "e0e33c19-8521-4cb6-92a4-93b70768e806", "comment": "Malware payload (Mirai)", "value": "c99aeb8d313c9809d36c414f6710e5daebca7e21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051305, "uuid": "4bc12b95-1902-4e61-886d-6db0622bf435", "comment": "Malware payload (Mirai)", "value": "34eafddca8090bd4230d6e2441814d59a9692f83fbe97ff090abc4db1f2d61bfc885276b7ac3e8b86ecb187a60738bab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051305, "uuid": "3ba10e1f-566d-496f-97de-2396c66f214f", "value": "T11404C60AAF520FBBD86FDD3302E90A1539CCB81B26A53B753534E924F60A58B59D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051305, "uuid": "f3e19de8-ddae-4477-8bff-564c473848b4", "value": "1536:XK5ebYaaCpMBU7B9rvHMQuAeCwqplPkNdD3n7bWd1upXhuGZHlYW0ZhsyWk1ZDqq:hbYaaWTrvswi7id1hGujPBDqdZyf5L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051305, "uuid": "4462f631-8b4c-4235-8eb0-84457ae542ce", "value": 187504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051305, "uuid": "52770f4f-ef60-4a1c-a4ca-bb222bf5668f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051305, "uuid": "1877fa4b-a337-47e5-9dd8-fe4b19574c53", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a336ed6c-e507-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767048141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048141, "uuid": "7695b88d-fe79-4295-877e-f807f0ee0afb", "comment": "Malware payload (Mirai)", "value": "8d6442aa3eda171feff65b2c7d0ed7ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048141, "uuid": "48ae70f1-2379-48d5-9bf0-34411ca22e2d", "comment": "Malware payload (Mirai)", "value": "8493bf2db62b3857c9095594581b5c34e0b85cf486793f445f8f8047fa75eb5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048141, "uuid": "cd50e271-31ca-4619-bd9b-7a475bd273dd", "comment": "Malware payload (Mirai)", "value": "85b2fc025ce09e6fb3a4af2942fcb149ebbf71a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048141, "uuid": "1f875724-ddc5-4f3c-bc24-89aa1086f6d3", "comment": "Malware payload (Mirai)", "value": "226658ab8605f539f562ec1db185b03c9bbc47c71d940a49c8509338f33e450ea5a2cded79027e3d59a6430c71431be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048141, "uuid": "fc1f172b-a52b-4318-967e-263ae07f3b58", "value": "T16CB35C02B328880BD6F71FF027BB53D1A3AAA69056B0D2C6760993455076B725F05FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048141, "uuid": "01ab5da9-435a-4fa1-a6b7-f40679ee6a74", "value": "3072:H/fSU8drHeO1wcvTBaSAZsln3n6wkPmsbi:H/PO1wcvTBaSAZsJ3n6w9sbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767048141, "uuid": "6c40d058-284e-49b1-8672-b5b8505e6635", "value": 116248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767048141, "uuid": "b992b933-03d5-441a-b855-64390479b108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048141, "uuid": "0777cb8f-0772-41fa-8f50-c7150936d2d0", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a159a2f-e46d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766981822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981822, "uuid": "64ae0600-483e-4927-ba48-f54c97b105b6", "comment": "Malware payload (Mirai)", "value": "4d03c3cf369415ea91db02f57643994e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981822, "uuid": "2f4439bc-ccb1-4c30-ba27-9a856d573feb", "comment": "Malware payload (Mirai)", "value": "84e272dfb755a96f1b6fa002eec7e66f8ece4337efef98ea7a4b40d835fa03f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981822, "uuid": "c8f26bfd-0bd4-4e4a-b3c1-ea17f97a5135", "comment": "Malware payload (Mirai)", "value": "46d2a226bff44e57e57daa0e5edc100b23b5caa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981822, "uuid": "fe063c57-f78b-4b0c-af64-051fb929b998", "comment": "Malware payload (Mirai)", "value": "40b682f22ba1afbcf2ed804f9c56acf2ffc86f8ed3ec2f76fe60ad47d65999065c776335455d3c2f6058afd8786e27ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981822, "uuid": "f55a6f1d-194a-4188-b508-b8f551bc127b", "value": "T121A36C93D953D8B1D862007A122B97A18A32F1313032BD0BE7A52F79FC69741EF5639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981822, "uuid": "806036c1-7444-43e6-8182-4a53119adc72", "value": "1536:7hzGbRRQE+oqK5iiV6c9b9mREOHZN1egI+8A5OKQWfKrM7ozper0xzpznPX2:7k+4V59qHHb11SySrM7oz4r0X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766981822, "uuid": "38d2df9f-5cda-458e-83f5-88e034b2c546", "value": 99568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766981822, "uuid": "250dfc18-a21a-4381-b016-840dbf753f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981822, "uuid": "f2881cd1-b676-432b-a375-f32bf7edf32e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e859e0-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967611, "uuid": "52ee554c-2a38-4783-862c-1921ec86bc87", "comment": "Malware payload (Mirai)", "value": "5edce04f780a48c4a21f22c6a84a20d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967611, "uuid": "42de5e98-7f27-49fe-a4ea-6134ab3a017e", "comment": "Malware payload (Mirai)", "value": "855ef4f00580625aad2d17951ac1242b6cfcc4bcc02951ec30159f9cc025a77d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967611, "uuid": "c4acbb57-b95b-4c25-a306-13f1b8477a23", "comment": "Malware payload (Mirai)", "value": "deba03272660a1c76965ba2306ff58bd8cf42cbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967611, "uuid": "f270135d-70ad-410c-bb90-7ffb09d7f72d", "comment": "Malware payload (Mirai)", "value": "f91f2142c00621e8bcfc9d0cf928cced8112c29958ec7a6cca7689076d8d4c142eea5ba7b1fb2f4b2b69e6757727c0b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967611, "uuid": "7df40301-544f-4a05-82e9-13c375a206e0", "value": "T1E3632B9AF800DD7DFC0FD77B4463091AB630A3510A920F36665BBDA76E731E45C26E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967611, "uuid": "24effb31-7a74-4a6f-84cb-0693729a59b2", "value": "1536:hhwYFhPilYWt0GMgq/78i+lwNA4QV/dO+fzH1U3hJxF:hGYF0YWJMgq/4z4QVd9EXxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967611, "uuid": "2a6eb9e3-945f-48e1-8c5b-0f2a60a08279", "value": 72852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967611, "uuid": "3181157f-e73f-41b7-9a12-2cf40d00ad06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967611, "uuid": "e7108983-9bed-465a-93c4-905ffc8c10c2", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69ff3cc-e476-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766985950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985950, "uuid": "9f730489-daf5-43b5-9537-5a57c0253cc2", "comment": "Malware payload (Mirai)", "value": "cc56a5737e40628ad7261834c7f88a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985950, "uuid": "f55ee0d2-5d46-420e-a430-1dba58d97480", "comment": "Malware payload (Mirai)", "value": "85b32839d2ad7efc9d39ffb01190bd76cd99acaa4ea248e82fc47e8529a9f3bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985950, "uuid": "67f6996f-05e8-4504-a18c-f84472e4b4a7", "comment": "Malware payload (Mirai)", "value": "50915205698ba29f4f420e8d9f5b7b9acf9b9f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766985950, "uuid": "6e98b738-273c-4592-9b57-c57a8d9dc14b", "comment": "Malware payload (Mirai)", "value": "cff197a6dda763826ef288029b91f9d79ce7d46cb0882ff485855ade8952129f1c4d401c6dcb8c5047d70566f5365837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985950, "uuid": "cb4811ff-892f-4547-b790-68d289dbdb6a", "value": "T145C37C86E643F4B1D41A0471225AE3BA8935AD722023DC5BFBE47F31ECB5B52DA0532D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985950, "uuid": "8eab78bf-204e-444f-9f24-d57ab9e7233e", "value": "1536:exnZAxmQ32r797dT29nHR3mhSksjGmsvqFHyUYEDoIyCCgdUz31kOwoTWfCt8eMd:eZZd2HRBxsvwHyUYEDoIyTO4qXfSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766985950, "uuid": "e6fdebc2-1a2a-4414-ae3e-95615e775275", "value": 119560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766985950, "uuid": "7281d55b-8e4d-4e02-840a-778f25b80bd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766985950, "uuid": "626b3e27-3af0-445f-a8d1-7c672af575dc", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebb5e41-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016753, "uuid": "ed1ba072-a139-4e89-94f6-ca0439432b8b", "comment": "Malware payload (Mirai)", "value": "0b4b9ed94d46e81046b0b2b911b5a7a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016753, "uuid": "4c3465bc-4753-4dc0-8ba4-15458b49b540", "comment": "Malware payload (Mirai)", "value": "860cedfa55eee8e754d8b9d861ce3dd2639b7a5125b7c9043be739ea288a6421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016753, "uuid": "dbc73617-2700-4ef1-b541-fbb02bd0a08a", "comment": "Malware payload (Mirai)", "value": "926615e08ecf37b6a6dd6c907ae12070984c949b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016753, "uuid": "df826397-02a0-441e-a2e7-dbf471bd7d8d", "comment": "Malware payload (Mirai)", "value": "ae0ee588b7436075355dcf8b8b49fd1bf64c1cf37f992680df2acb22b400c324da04b7651b82cc5a4dcec14b4b82b9f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016753, "uuid": "150126a5-d4cf-4e66-ac81-26abdc909b84", "value": "T1D4B3F809BB250FFBD86FCD3B06B90B0525DC564722A83B367934D818F25B25F5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016753, "uuid": "2401ce8f-6418-4bb8-9978-1e41cc04ef61", "value": "1536:ZdNehP/ErqtoBASNxR50VK97MN8AqO+N+KmNuT3GRan1Ep4L0suQ7RAoN:ZahErqiBbNJtj+tPunL0suQmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016753, "uuid": "385c0188-9bce-4410-acfe-b48dd3a12bb9", "value": 114216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016753, "uuid": "f4646cb4-2b9b-4eeb-9a2e-e8df4fe7e9c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016753, "uuid": "87022fa7-1a76-40aa-addc-eb25cab0d408", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631ba53f-e4c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017539, "uuid": "21f05846-b006-4e1b-a9d6-1f138d201e79", "comment": "Malware payload (Mirai)", "value": "f6919601c01b9233f67c0641cf524b7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017539, "uuid": "fccede59-8d80-462c-a1ae-ace6d01023a1", "comment": "Malware payload (Mirai)", "value": "87496059b862389171d5d990ef21c36578790d475a23580318d0c3af7ead136b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017539, "uuid": "8a1a0760-cc84-4af5-92b7-24f85b436545", "comment": "Malware payload (Mirai)", "value": "87b5854d622c2a9cb95a0c3ba2f37e20c7a8e0d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017539, "uuid": "1fedc6fd-4b54-4d22-b5dc-4a2ef3085fe1", "comment": "Malware payload (Mirai)", "value": "d1ec0b913a6ac80808692de9a3e302161215a12afec47c44369d813831b59fbdcb2a7c3af5bc14bdd95f167c0d3df460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017539, "uuid": "1f893300-3246-4de9-ba9a-db684928336c", "value": "T17B630985FC81DB12CAC5657BFF0E439C77264398D2EA73039918AF21779B86B0E2B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017539, "uuid": "572181d8-02e4-4778-99df-e17ce2d2f8ad", "value": "1536:eRUOXo2W+3mYjMGQWtR5YiwcDkcuQ7RV:eRUO/XMGNXY1NcuQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017539, "uuid": "7b829d1a-f7bb-4112-9492-b06d4bae5fcd", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017539, "uuid": "c34cc699-4fcc-4d14-b0d9-1b33c2d56715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017539, "uuid": "67b4c83b-d56e-4cd5-86de-23bbb512bd2e", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76714994-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982353, "uuid": "ca50f7b3-6ca5-40d2-90a6-c2db1ad6a999", "comment": "Malware payload (SalatStealer)", "value": "a667bf8482a6ac28c514ccbe3993ecdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982353, "uuid": "c24b9c35-1888-43e9-9669-4b1eb612ed85", "comment": "Malware payload (SalatStealer)", "value": "8767c2e2d0c482d7aafd8648194a1cf688b27f862f401c3bc02061c63f720d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982353, "uuid": "4dda9559-8a8b-4be7-ab2d-e735264a43c5", "comment": "Malware payload (SalatStealer)", "value": "af8141aa06ca3ad29b98d3669b79b71e7194f70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982353, "uuid": "e3a610c0-c884-48ed-85b8-a1db74f306a3", "comment": "Malware payload (SalatStealer)", "value": "23b579e0fb0f192ea8e3fec86c6f92cf65fca3ed3ee8699e96531e15de35421e756067315ba350f4303e8619469b6a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982353, "uuid": "5c4b97a0-9308-4b34-a46d-86ccfaf421c9", "value": "T1B1C65A51FA8B54FAE9031835805BB23F63355E048B29DBDBFB543B6EFC776811826209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982353, "uuid": "f020d01e-9a75-4b06-ae0c-2c5673368307", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982353, "uuid": "d39ad88a-673f-46ea-9948-7a99c4e27164", "value": "49152:qcDgmP21ELLKiQtZMGuJ5K5RuTjTYQWSQWn49DhvqkNBA+iIWj9TS2ujy9dTvjje:vkmO1MUZMxK5cqvuPXP8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982353, "uuid": "103a8ad3-4f46-4870-80bf-7fd0a086c0a6", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982353, "uuid": "78d5393b-807f-40b6-9055-21d4251b0dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982353, "uuid": "52df98df-2e11-4558-8836-6727817eb624", "value": "8767c2e2d0c482d7aafd8648194a1cf688b27f862f401c3bc02061c63f720d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04bedf3-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (GravityRAT)", "timestamp": 1766996167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996167, "uuid": "992048b6-d974-488d-87bf-77d4a891e564", "comment": "Malware payload (GravityRAT)", "value": "01ce49690ae99dff17b90ecad243f764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996167, "uuid": "885b5ece-84c6-49e4-9b20-0324f8a1d9ca", "comment": "Malware payload (GravityRAT)", "value": "88a03051494fc82d49b0cb772b451e47f5ebab3c2a0bd59ad4f29aa8480ad2b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996167, "uuid": "9fc0b826-730a-46a5-844e-34e5e7b30251", "comment": "Malware payload (GravityRAT)", "value": "d363202dc9111e66d49607cb079d1f2068128ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996167, "uuid": "b0e073a6-c025-4b74-bffa-b2764a04edde", "comment": "Malware payload (GravityRAT)", "value": "413a6b2393a5685a8e956df84dec94aa7b76108c1fc007bc561c63d3758462459ff8cd4ec32b47a3af8a3d01883a62b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GravityRAT", "colour": "#4729DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996167, "uuid": "abeeb96f-0f01-4734-b2ed-80a6ca46c947", "value": "T181C6B032F6E405EAC2BFE274C06246217EB1B8675326FB8B5F8055E91D63BD0AD19313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996167, "uuid": "f6f7639d-16c5-486e-8471-e6477d7fa136", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996167, "uuid": "308f2a0b-ac90-4790-bcaa-c882f283d88f", "value": "196608:I+D5q1SGs2yRwtkpqShRWhR1hRRhRbhRmhRrhRJhR9hRs:DAkLRCR3RbRtRSR9RDRPRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996167, "uuid": "3813b028-97e5-4786-a7da-b4be7119cd48", "value": 12407601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996167, "uuid": "7655cf76-f317-4dcc-b22c-d21643f92a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996167, "uuid": "8419c551-6856-43cf-8a09-2033c2a2bd35", "value": "88a03051494fc82d49b0cb772b451e47f5ebab3c2a0bd59ad4f29aa8480ad2b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1c3e2c-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028344, "uuid": "1070eaed-3378-4980-af51-4a40dd901de2", "comment": "Malware payload (Mirai)", "value": "d949767c1aa1869e67013fac05320582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028344, "uuid": "5336f199-3158-4dc4-a968-2f66bb29a977", "comment": "Malware payload (Mirai)", "value": "896446c58dc961fcac1dc5bce041411ba741fd171e5f091d93a0fb250005789b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028344, "uuid": "3f5e275a-3f7e-438e-851f-392c7aeb4253", "comment": "Malware payload (Mirai)", "value": "8cd186ae25af9c34e60f022eee444036cc86a2c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028344, "uuid": "293f94e1-10c8-45a5-87ce-ed0bcd67acb0", "comment": "Malware payload (Mirai)", "value": "53ec58428bead8de3cc043a4afa990ca7f0c65ef78a0c1e516e54bf7b965bc909d8ebe0616baf818369307466b723dbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028344, "uuid": "2b2c7557-257b-4463-84a3-a7552d09859e", "value": "T1ED434B86A409EC3CF84BF67AC4170E05F9247745B6D30F27E7A6FC935DB2168981AE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028344, "uuid": "bfa6db12-e9ad-48bf-b7a9-470aca79cde3", "value": "1536:aBV8s64XShZMzFMXI+WnKusg37yJ8uwxA4/neQHhZPF:aBV8sW36nKi328dnxB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028344, "uuid": "455f0e86-79ff-4042-9e88-f83cb8f78dde", "value": 58624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028344, "uuid": "99b56288-0df4-43e8-9302-9e6a267f82cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028344, "uuid": "9cb3bc7f-67cf-4fb2-9db8-296f0d6eba70", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d167c880-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766988518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988518, "uuid": "f732ffa9-bc96-4e28-a89e-f79f1bb15033", "comment": "Malware payload", "value": "a0e1e36be7cd2b018e6d28c6ed95368b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988518, "uuid": "56a4b65f-1049-4e3f-a2e8-6c7fb40ae901", "comment": "Malware payload", "value": "899f9fd00c1076f5f26068acb1db48cc8ae7653ef370c0539344939a47901eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988518, "uuid": "bc4799c5-514e-44ac-9139-e5cb5eaaa27e", "comment": "Malware payload", "value": "95ee2c34312ce8e3234e7af3e07da273d403eb85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988518, "uuid": "6764fa69-42c5-489c-b968-4b27ed784442", "comment": "Malware payload", "value": "4c4bfc722105039bec6c43aa6af383bd896f4ce25e734796d1e2fabe870c79f851df931a7f9efbdf16470a14e8a7f2b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988518, "uuid": "6fa53b60-9416-45c0-8c39-0266cf7bc456", "value": "T176C36D03B3289C0BD2F75FF02BB723E1636AA69116B0E686760D53494176F725A05FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988518, "uuid": "e721cbdd-de16-40a3-bbe4-e91505c99863", "value": "3072:hE8Lbh8fYUC7ymgjbPm9LqvB1oTOYPmKs+:hBL98flUHg/Pm9WJ1hBK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988518, "uuid": "cd298aeb-08c6-495a-8493-e829fa5df7f4", "value": 124456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988518, "uuid": "42d53fad-5a30-4452-af25-d2e7ece3902c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988518, "uuid": "92954b9b-c332-4152-964b-2514e5cab11f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd33b372-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031005, "uuid": "897ac568-dc31-4d53-983b-f370b1ae1e66", "comment": "Malware payload (Mirai)", "value": "007c837aef5b9598ffac377953b9c361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031005, "uuid": "5437130b-89bb-4bed-b6f4-2d78961f2e1a", "comment": "Malware payload (Mirai)", "value": "89a0d0f11fa238d2e57137833eee1cf0041068a1c464a6fe7452b0d204ceee9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031005, "uuid": "621cdc09-3731-4807-8175-fb7b7dbe6105", "comment": "Malware payload (Mirai)", "value": "24b2d07aae23ebceb650b4d0350bdd1077529b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031005, "uuid": "c7d6c585-697f-45ce-8017-95c978f2babb", "comment": "Malware payload (Mirai)", "value": "ba9fdbb2807fcbf424aad0ebe472c0195efdd623d9f093567d1e5e58b9f6ee7edea7c8877c90d9543bfb399cf945d8be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031005, "uuid": "5b2ed286-7c66-4ea1-a8dd-7ff73e9921e5", "value": "T1AF041995F8918A16C6C652B7FB4E428D772A27A8D3EE3103CD255F20378B95F0E7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031005, "uuid": "b072d6e3-9f56-4b38-a703-7b858dcf9968", "value": "3072:5VZjX43AjSnskEXx8QnnRDq8LedVM8nze48/UyGwg2xOiKM5:5VZjX7Sn4Xx8QV4qCS46TGhEO+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031005, "uuid": "392295b4-5e9f-4e26-9c9b-17d57ca689c4", "value": 179424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031005, "uuid": "0c5f14f6-dfdc-4788-bfe9-a0447b8a8b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031005, "uuid": "7025ac41-af0f-4982-90a8-2d4cba8ea4fd", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f548e2c0-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767011342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011342, "uuid": "a9a1d1a2-e79a-466a-bee8-6a7bc379669c", "comment": "Malware payload", "value": "c795325ad79c3ce5b7291b897d18432e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011342, "uuid": "98b06558-112d-4856-b8fa-5190bfc274dc", "comment": "Malware payload", "value": "8a7fc3290b7405c98b7b362c8098ac0e0be201b88e6f8f3f7b04a3ca03fcf1c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011342, "uuid": "793d0cd1-34e2-4cae-a3d2-19833bffbc15", "comment": "Malware payload", "value": "14d4bc4662b604945ff558f3ec4198099121bba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011342, "uuid": "a8c3bc39-c71f-4f34-9a16-a0c782836023", "comment": "Malware payload", "value": "75666ed10db88be53b9e91b1d277c8c6815b38452e2b1f2bb4b17d0ade0192530295b69e8a0a2096679f388fd0144dca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011342, "uuid": "f903bb93-cfab-4c8b-8683-8fe0d66f984e", "value": "T157C3D742BD418F13C5C721F7FBDE42983A257B6DD6FA3202E9257FA037964DA0A36241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011342, "uuid": "b5b4eca3-115d-4365-bb38-da5e0ed1d184", "value": "1536:oWGyj+45oaMxvbO5Rtb22uWF4Vb0dbH0WtaAkD0J4Oroaz4z4Ox+lEkWwywSn/NE:oWbjnGakvCLtb7F4qdrJaAkwebzXUnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011342, "uuid": "d91c511f-d232-4819-8a13-690766d19a3d", "value": 122756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011342, "uuid": "fe8dd8d2-ca6e-4d3b-b867-044b2a62c3aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011342, "uuid": "278ba56e-3593-451b-bd1a-4fe5efa999b0", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dea53ce-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997747, "uuid": "c1b4120f-4abc-48c2-b9f7-5543eae50ca3", "comment": "Malware payload", "value": "5834274215c9ea182586fcd9c968ca0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997747, "uuid": "ba27e711-164b-4bc4-8d5f-7a3e4ea6b8da", "comment": "Malware payload", "value": "8a8898037ef6c3a6cadd927e66eb93edac44687198d34c9e7e694e842e2826da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997747, "uuid": "3a08b7a0-6a2b-47cc-ba02-0a0e571805c5", "comment": "Malware payload", "value": "897334545b427bdf5f09f8c375e4c5d5f8e06d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997747, "uuid": "ed5556c9-3d03-41b5-b795-fd656933eade", "comment": "Malware payload", "value": "590852ed63095e01d31724a6af3292af53d0b43a1ba9979deb714d7a5d24e562ee49a69eae3d8829860eda7434debe45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997747, "uuid": "5eee207d-d05c-423a-859f-b8b97c9b1f5f", "value": "T1DD75233DBA58CE71D39CCB39CC91440142B1830219D7DED1BE8A2DDA4B99BB42FA56C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997747, "uuid": "d54c8791-75ba-40a3-a8d5-f2377a7a6657", "value": "49152:TgiK+xf9q5w7+WWoPZKs8wfWCBxwDZh+wnZnG+k:k+t9jBdjHu7+2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997747, "uuid": "49ba2de2-8960-4503-a250-ea6f84116127", "value": 1617920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997747, "uuid": "a555907a-015a-41ec-8525-0c4e8eb7c104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997747, "uuid": "28667d77-a6cc-4653-ba38-f84505c0513c", "value": "grjioqD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c73758c-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766996456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996456, "uuid": "50085c20-51fd-4d56-b460-a8da977cfbce", "comment": "Malware payload (Mirai)", "value": "6aa5eb94961e1cb801edae56fd004f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996456, "uuid": "77158c07-c014-4eab-9a46-d5765ed5a621", "comment": "Malware payload (Mirai)", "value": "8ab7978006dd71aa1e5cb11f3e043fe3317e314b3d9ce95a1d8946a3f02373bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996456, "uuid": "621d1657-c9ec-4738-a08b-317d3bad55f4", "comment": "Malware payload (Mirai)", "value": "48b3cce7eede18a4e24a9d4b5af345f7542f44c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996456, "uuid": "f7f96f2b-beac-419e-8e08-157860acef44", "comment": "Malware payload (Mirai)", "value": "dc42f461833380ddf1f7a3c44aefa58889b712d13592b708c826782c307a7100de838f2bfa29f162d1d5bc83630cefdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996456, "uuid": "1f0a6f56-9e63-4916-aa47-47e50c1211d7", "value": "T1E5533BA9F8018D3CF90FA6BE50264E09F96163D112831B27A7ABFCE3BCB21555D17D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996456, "uuid": "33d1f4c7-f643-4744-aab1-15f63bd388fb", "value": "1536:8h6wyxCmT6/Bb8Tx6HH2IcH8qWC6KacwX1aMO8U:8/g16HWRMCWt1Z3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996456, "uuid": "e7534d8b-9a70-48e8-9542-51deb66b4eab", "value": 65256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996456, "uuid": "fc8e44fa-0712-415c-8e08-a2f458bc6ac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996456, "uuid": "3b55decd-1bef-415d-a19c-a0abcc28a27f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7451cf6e-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031312, "uuid": "aa704d6a-aa8d-4b98-b9d9-946a5ee47a5f", "comment": "Malware payload (Mirai)", "value": "d979508e416f2af13e2b43440f90fd59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031312, "uuid": "d9e6d2b8-505e-49f4-bb9c-c1f9d8f9ef7b", "comment": "Malware payload (Mirai)", "value": "8b5c05cbf6da1879694c31c5102266ce11df845d99fec7ddbabd247e402bcd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031312, "uuid": "8e1afb6e-a62c-47d6-b908-c2183cf48a33", "comment": "Malware payload (Mirai)", "value": "a0575ecab2f82a00c463dd71e256edb7d6c318fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031312, "uuid": "df3ba0dd-9b07-4aac-985e-bc0fb248f0b0", "comment": "Malware payload (Mirai)", "value": "38312ca4400300f480f4036ffb8a9b568ae546af09d4998933a4fc5d63fb870be3a1b8a05042d31ab4a21fc08dd81271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031312, "uuid": "b99c2dcd-1181-4f9d-b397-49f380a826cc", "value": "T15C136C76C87ABDD4C1AA46B8B9308DB85F53F500C2932EBB5E8295624047EBCF5193F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031312, "uuid": "fe42b373-cb85-4a16-90ab-0c07d770fff7", "value": "768:8IatwtqNEySUJreJUMIcPaZAg2+ZlSrPDpvDejUWCpoX4LCG6u:8IatwtqNvhwlI3AgVvOd76UW1ILCG6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031312, "uuid": "2ecf1938-3e50-4c5b-ba96-8f7c8a2c1f41", "value": 44108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031312, "uuid": "7ce75921-53e8-4422-9746-770a89c2e1a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031312, "uuid": "fb0e6ecb-6a4f-48ff-b73f-2f4a05ee86ab", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6db6ba5-e466-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766979105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979105, "uuid": "adad59c4-54fa-4419-9a3a-3077373602a1", "comment": "Malware payload", "value": "356cf12f884006c03d79624a40ca7284", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979105, "uuid": "ffcfca21-90c6-43ca-8040-6cf753f09114", "comment": "Malware payload", "value": "8c515cf0b2b39fabf9d2dbe2a50d4de49bfced2514d36cff257b71880f3d778e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979105, "uuid": "17b51531-67a9-4f8f-90ec-9896c7e86782", "comment": "Malware payload", "value": "b54c3d52452cec2869d573b155944ba31fa7a228", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979105, "uuid": "c86d6706-a45b-447f-9e10-e80dad84f0e1", "comment": "Malware payload", "value": "5a10a22843c24e950662262e6dd579806a07dc6c053e521a554179d72ab1446a8b8542de7e83912d92462c67fef1cb68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979105, "uuid": "1b203613-f28f-498e-9aff-06e4c1caa9a3", "value": "T19B327311B96867F1613C80E1791F2184F71895BF8E993DB9B4AFB53C3224ACC54FA263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979105, "uuid": "227c7572-45e1-4002-8a9a-77a86bc86bfa", "value": "192:miFa1ZIJvH8czELQ+IXo8/3knBdpdlfb0iA98sdrUtvwZMIKopVVFoGpKueJAYdL:miEHe8LFIXo8GBD0irsdrUtIZMIXpLa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979105, "uuid": "a0619a70-d946-4dcb-8cda-bafb5bce086b", "value": 11013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979105, "uuid": "0237ad4c-c4ef-4e17-a281-0fd4ac477955", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979105, "uuid": "a5402771-751b-4de5-a783-e4afcbaf57c4", "value": "setup.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481b7cfa-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766967243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967243, "uuid": "20363e05-9ceb-418b-8ad5-d1924f5e5f4f", "comment": "Malware payload", "value": "4221f5a4bf78958334d1ce0177e66f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967243, "uuid": "0211f446-56ec-434f-8336-805d1298f78d", "comment": "Malware payload", "value": "8c942b65ef8b145443f7223d7818036a84e81bc4088e989fc0c94a224bb3fbb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967243, "uuid": "467db45c-4f2f-41da-bccc-49906c673ba9", "comment": "Malware payload", "value": "5de4f7ba433318fcad0d360de73d9e3a25dd540f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967243, "uuid": "981f71f7-ba94-4a18-b0cb-0ec089dfcb53", "comment": "Malware payload", "value": "3924d59c6c28ad4282aa930e27d4dc339e2a61f6ea54c1d8c3d866cd7f3c7a27349d2614bf3f1ea6dc7ff84820cb0c2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967243, "uuid": "9e36ee15-448c-42ea-bf6e-fa0247c1e41d", "value": "T1CC735D027328850FDBEA4BF013E713E1A779578197A1E18A760D635405B1BB2AE09FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967243, "uuid": "5d60674a-7348-4777-8ed7-1ea898e82650", "value": "1536:0RJxiYFU4Jfpmtmj0PY3cYeGjCyAlUNjkMFK9j:GFFUwAmA8b7AlUNjFUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967243, "uuid": "eee39d80-0e42-411f-aad1-d9d6f76333c3", "value": 76428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967243, "uuid": "2730a349-018f-49e3-b28c-c3fa092abe4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967243, "uuid": "e958e421-a24d-41c6-93ed-96d0ab6ab3a6", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dc4f61-e4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034459, "uuid": "6cb627ed-5ec8-4b8e-897f-7f1e6aba8220", "comment": "Malware payload (Mirai)", "value": "def6e68d0ae0832ab6f3c9c4261431ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034459, "uuid": "7c7810e7-0f67-4f0d-844f-a8660ab44304", "comment": "Malware payload (Mirai)", "value": "8cabccb7903b5a470786533142c2554625e668350650f084f112bceb66acca64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034459, "uuid": "d3b9bfcf-fa53-462a-9d1b-d348d62749d9", "comment": "Malware payload (Mirai)", "value": "b198f873d5e431ba6a10d4068efc085e759d9f4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034459, "uuid": "2eb51df0-38a7-4f39-868f-55297c423df1", "comment": "Malware payload (Mirai)", "value": "6bcf9b8a95def5cda2004295c4e518b4f3a9332e1e9dd20dfdc832fb199b7c307a2460681e2d20ad3875d3660a7f8507", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034459, "uuid": "f888512d-103d-48b9-8795-087cec57f65b", "value": "T136834A42BD928A6EC6D0137AB67E268D3352B3BAC2CF7253DC154B6037C561F0D67A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034459, "uuid": "7331e98c-b29e-4f84-9e8e-ac9e4c4154d3", "value": "1536:iLfViTjvEjSEDe5rNVMg2DPf9LcrwsSrC+F2Fp6c+T2IymQY2AUm6hh1xP+i:iLfViTj8jJWUorSd4S6hh1d+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034459, "uuid": "157c6860-3eb2-4c61-9ab0-98b8d960554b", "value": 88176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034459, "uuid": "21ede115-e708-4ada-a0c1-08c830f5f6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034459, "uuid": "a4f710b0-8f51-4bfc-9fba-df4dc9c93d66", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9297a92a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995285, "uuid": "02141e25-1fe6-4e28-823a-f7f7af5d196e", "comment": "Malware payload (XWorm)", "value": "944c42357cbbcd48a578c0220428e94e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995285, "uuid": "0144bdf7-2772-49bd-a116-91176f29a9c0", "comment": "Malware payload (XWorm)", "value": "8cabd12567dd7357d470925fde805c7bdc83275bc7151d67402dbae709bd2910", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995285, "uuid": "7e6898ac-279e-4df0-a862-e618376cc69e", "comment": "Malware payload (XWorm)", "value": "f9f90033842141da575854b0a020f8f7c6b2a4cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995285, "uuid": "22160dad-697d-4d54-a475-da896ca97e77", "comment": "Malware payload (XWorm)", "value": "7c6789b70935711c1cd0293b7e3ea93efdab7ae294580757669d399cda0c1c2a10a0b99908fa2107b62b796ce284f6d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995285, "uuid": "6a782c9a-a8bc-4a14-9169-543eeb088268", "value": "T1E96329DE194BBB092774FD4A63A44E0A2EC75047C047D6EE5E2AFCD374882DA0DA57C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995285, "uuid": "69273efd-d645-422c-9464-27078591d667", "value": "768:I8w/h62/jWs6oS+xISN0vb2q2z2b2+29T2wT2R2m2r2A2M2z252b2/2z21T2W2wu:I9l/AoSSMi1usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995285, "uuid": "65176b42-1eb7-4aad-93d0-6888821c1547", "value": 71544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995285, "uuid": "1e232cc5-ef08-4a50-ae9c-7fa5b3de8f52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995285, "uuid": "64981ab8-d736-4cbd-910b-209f08cf5e64", "value": "invoice-1645080830.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941f1610-e45d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766975101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766975101, "uuid": "5f2419c7-7d2a-4063-be58-bac8f17857e8", "comment": "Malware payload (AsyncRAT)", "value": "8ceb8bcbb80ad67a2791af249f302447", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766975101, "uuid": "9ac8f92c-f5c5-44b5-878a-cf6efce614ab", "comment": "Malware payload (AsyncRAT)", "value": "8cef79d3a456aaf1246ab1300c01e4d37e584627c79dc2685edf3beb78157e68", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766975101, "uuid": "c80928c1-3c0a-489a-9bed-c6a12224e66c", "comment": "Malware payload (AsyncRAT)", "value": "8c23b2a331149fc3ace272cd6ed07ac95e79fd6d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766975101, "uuid": "5dfe676a-61c5-4e88-b9fa-4d92b62baa4b", "comment": "Malware payload (AsyncRAT)", "value": "a9c8d3d13094abe9a0a8a0d72fdd6eeabbb51b2229c83a442418fd178aec0efcac32a045d1fe9d7f2b9158b2849233fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766975101, "uuid": "db7bfe4e-92d5-45f0-94fa-7617330c17fe", "value": "T146C22B0473F48266D1EC07BE48329200D375E68B5D53DB9F2FC495AD2A33BC98621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766975101, "uuid": "75c5d10b-8d68-4d33-a52d-f33f61f2fecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766975101, "uuid": "080f0d4c-1baf-43c3-954a-122307536ae3", "value": "384:84eMn+LbqY3zgetmQkLAMymrJhxUHqqbuUsJQxnCJf+BWfXWu/Du+:84nncb/3EtQk8MyCJhxaFbHBFBmu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766975101, "uuid": "b8ed32ec-6953-4d74-95e1-4c65a15bcff8", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766975101, "uuid": "20058293-dd13-437d-8ca8-f8697fbe28da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766975101, "uuid": "58b801ea-0b6a-454b-88e9-598352945593", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8146e93e-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982371, "uuid": "b1d6bc8e-f966-4e72-b5b2-caf0100fa7d5", "comment": "Malware payload (SalatStealer)", "value": "135b104cba9a13d0bc1155f58ee6f5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982371, "uuid": "36b54ac3-fbad-4818-84f8-0e997f4f16fd", "comment": "Malware payload (SalatStealer)", "value": "8cf1e4dc50c2e12c299a63124e956996c2058c670d7f40567b9fd538b5f331cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982371, "uuid": "4d232a12-240e-4d24-aaea-6aa920da5425", "comment": "Malware payload (SalatStealer)", "value": "f85d4bc75294cc7baacd4cf4ca77a43653853dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982371, "uuid": "8d9fd77a-0eca-4dbd-aadf-01f2e8b7a8fd", "comment": "Malware payload (SalatStealer)", "value": "82998ff610ae0328bc1bd335efca5717c3ff3586bec3168ec2f561c589512cfdac54040a68716ea67ec0ee2aa065dca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982371, "uuid": "0cda8d4d-6178-44ec-9985-cd1ce2fd321f", "value": "T193C66C11FACB45F5E9035831409BA23F23319E048B28DBDBEB447E6AFC776911DB6249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982371, "uuid": "c6b1eabe-96d2-46a3-b1a8-3fa71e045f0e", "value": "49152:BT26jDvSWnawXwmXDdJsKzkNEMyEgJr+HHMTN4sNNA+eo10FqNM2BU/1w7f1rXrL:tHjDXMmzhuDrys4RbRZZwn1l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982371, "uuid": "0d9f7fd4-a48b-4e46-ad03-b249ed348761", "value": 12093952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982371, "uuid": "6bb756d4-21fc-4040-9f2a-503710751523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982371, "uuid": "9e803990-0c9a-455e-b441-3963c3c6b741", "value": "8cf1e4dc50c2e12c299a63124e956996c2058c670d7f40567b9fd538b5f331cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22ac574-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026235, "uuid": "15090a0d-5be5-4d67-98c2-cdebe71a0663", "comment": "Malware payload (Mirai)", "value": "87f4eb329d9c3ce81235dd2bde2758bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026235, "uuid": "83f62421-c6f7-436e-9040-c2bcb9cf4344", "comment": "Malware payload (Mirai)", "value": "8d713360011441f3889a49e0a12eea6a22c750de2322642cb7ec19f173c6fc6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026235, "uuid": "1ae4ec05-2341-4ede-b781-96dabd97efaa", "comment": "Malware payload (Mirai)", "value": "725bbdaaedbe8330c9953a5a1847bc5303aa97bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026235, "uuid": "cd76534f-52bb-47d5-9baf-226d529eef0a", "comment": "Malware payload (Mirai)", "value": "b002b7982820db5ed3e4eaef2e2bd02dd5e30707c2c2220377507a58c2bcfdc8ebcd01c9797cfb3f2219a1b409718e12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026235, "uuid": "b91504f1-1068-4c87-94c8-6abc2ea81fe6", "value": "T12B534D96A801DF7CFC0AE67AC5120F06F524775696830F3BA6AAFC931DB2094CD25D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026235, "uuid": "1efb00fc-1477-49ef-aede-5a28065f8a32", "value": "1536:u1NamEOVqvndtiDPvOELCUJVGRiEIC8uPqGxFflsXrlDPG:u1NapE0f8xLCU+ihaqolU5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026235, "uuid": "a90525aa-ad6e-4756-bb82-daf34ef92949", "value": 64140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026235, "uuid": "39fd2f71-7045-45b2-96fa-396a57560105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026235, "uuid": "be0bb73d-1e2e-42b3-99cc-146074a32bfd", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c017a9-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029402, "uuid": "53e114f2-a083-4e23-8e9c-6623517721f3", "comment": "Malware payload (Mirai)", "value": "2f49b88a5ec36db902384624e1a1c73e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029402, "uuid": "4a82c8e9-d436-4791-9a6c-7743a1d62847", "comment": "Malware payload (Mirai)", "value": "8d85d9a0746de751566ee8903c69c61cf3972af9c3f8a9771c808da8a3410ba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029402, "uuid": "d6ee34cd-6f62-45db-bff1-2a64dacc013b", "comment": "Malware payload (Mirai)", "value": "95b5c3e67183bd266497fc11f7cb3a6cf8d832f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029402, "uuid": "3d7e1694-7a51-4a2c-aa0a-aa940e73ade1", "comment": "Malware payload (Mirai)", "value": "d831359c62463b3b73436807e1974bb171f29c77c163d7a1b2f7597f34198ec600fa4baf3736fb6d1b9b9ad56f926a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029402, "uuid": "b9110fba-ba2c-480a-943d-6b3246b7d8d5", "value": "T185141956F8818B15C5D156BAFE0E128E33132BBCE2DE72139D245F207BCA96F0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029402, "uuid": "10a56bcd-efbb-40c7-85b6-7287bad5bd5c", "value": "3072:ImL2cJPniNDSVkn2810omO9QVES0XhsgUraWrVuoybho2KKZ20:ImhPiNuVk2810oNywXhh6aUkxho2b20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029402, "uuid": "5e502af7-8995-4aef-98e9-db8ee1600bcc", "value": 191132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029402, "uuid": "0a915d05-8fd0-4195-9f56-a9ea3b3fae49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029402, "uuid": "25eef38e-4f15-4e45-8e0e-8719ac72fbcf", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ecac6f-e492-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766997706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997706, "uuid": "d44c8051-0b7b-442d-8d97-4f794f289def", "comment": "Malware payload (XWorm)", "value": "1b31dcc5e3e26dd06e7f64320d2cca97", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997706, "uuid": "88da7f93-9b9d-4a94-8a64-a22e853d7a2e", "comment": "Malware payload (XWorm)", "value": "8d8ebfbfc599548e14d9d3acc6e0b7e87a631af49568fcbde87f5eddbead95ac", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997706, "uuid": "c322c847-eb75-4f63-b4b5-e3d9dda13d1b", "comment": "Malware payload (XWorm)", "value": "e26b7d5bf5d6b0305408f100e45fc10aab7b4864", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997706, "uuid": "af294d2e-0b5c-4c69-ba39-82994df7d6f9", "comment": "Malware payload (XWorm)", "value": "349d8630f517f38324e3f4d99fa5fe97fdc11c25ec13de9b1b9d3daa2b35f8b80a0b38d33208d77d1cf8aa0fbd009d5a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997706, "uuid": "f22ecd5e-eb0a-435b-9d8a-825d9f6c4a33", "value": "T1F0F00513116DA3DC15D846F2012469A8432D67CB3A245D8D77F5CB8C8B8312855EF7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997706, "uuid": "f6828c88-416d-45bf-a53e-9b358fd8de3e", "value": "12:s80Qpc5InLgyaIS1PKC26wx0T8V45kJ00qo3unaXBXOVZ50H:xLw1PKC26mf4Yn3LkVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997706, "uuid": "b0ea92c3-0b45-4a69-bcd6-8e01382132f6", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997706, "uuid": "f5f3f19c-a324-457d-9a16-896386169042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997706, "uuid": "22f96c28-147f-4e86-ac34-423a48a4d22f", "value": "yidxpq.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5a7950-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995224, "uuid": "5f6759cb-5752-4b9e-a107-9c0be9d3b88b", "comment": "Malware payload (XWorm)", "value": "c70ac514df3bd37ff9899c26c3dcedd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995224, "uuid": "8a9f45aa-052b-41cd-b7b1-74a29222633d", "comment": "Malware payload (XWorm)", "value": "8da92fed7f92fb1ffcac455e0a5f3d543a763de17462138c121b60e0f689ae91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995224, "uuid": "2a3c593a-afdc-405c-b575-286afbf39f36", "comment": "Malware payload (XWorm)", "value": "38a08802df687b5240e69f1b28487f1c9394a7b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995224, "uuid": "ea9854c8-1944-4d9b-9d53-8e671af29e4c", "comment": "Malware payload (XWorm)", "value": "d6648a18fad3e4a189f130636bb12c197908ef1e3d133a1ce499f7538922a021a63e32f93fd15b61f06fc5ada04e5777", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995224, "uuid": "4fba2038-67ff-4165-bea9-d76bc7e80766", "value": "T1C4630AE59B617FF71E7DA2163B2A218C72EA8B2E0D16C05072652877E07F31B6F60435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995224, "uuid": "5571bb49-7b70-4443-8c4a-f797b04c4cb7", "value": "1536:I9l/AoSSMvDU0u+a8EOi9rI9EA9AWoZrTtkf5kgCZy7svqMObuBaj/JK0/0INusq:I9l/5MvDU0u+a8EOi9rI9EA9AWoZrTtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995224, "uuid": "e5d1253e-650d-4a41-afcb-0755118b097f", "value": 69599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995224, "uuid": "81918eb8-9423-46a2-a121-a4fef09665f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995224, "uuid": "dd1d3340-aac5-4845-b7c4-1a0fb3492452", "value": "invoice-1645080830.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a847a31a-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969552, "uuid": "c816616f-5ce2-40d3-885b-b1aa16cee323", "comment": "Malware payload (Mirai)", "value": "352a6845d12306f87fe05f3f76a6288d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969552, "uuid": "7f1f34cf-e7a3-421b-b03c-2ebf89edf1f3", "comment": "Malware payload (Mirai)", "value": "8f0e22a03ef3c53f58389c83f8b8bbdea1c4b143c4b0be865ebc77df757a7cde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969552, "uuid": "1da101a1-4b95-44ff-a8e3-6efbbff3a22d", "comment": "Malware payload (Mirai)", "value": "e1246a3117142f600d7654f12ba83d38522fec01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969552, "uuid": "fdc79172-d3f3-413d-82e9-cf6e527f6eca", "comment": "Malware payload (Mirai)", "value": "9b02f3284349eb0750feebfa60061458d1062dba0aed8916052a474370d5c30e778beef4e16e48093b22d7b4fce69705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969552, "uuid": "1ea749c2-1f2b-4c60-8251-405cf5f3079c", "value": "T189A3821ABF604EF3ECAFDC77499A2B44248D151A21897B78BD70D814F64E20F19E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969552, "uuid": "ccc25805-f785-4cc7-9d0f-3df0e32c4645", "value": "1536:mb7/BCaYLJcXPJyf7j+FaBRiA1HzxZ9t7X6yu8:kLAaYeXAnPzxEyu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969552, "uuid": "0b92d16d-cde7-475b-a4c3-a011f7cf65d2", "value": 100468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969552, "uuid": "8e8b61ca-8d2f-44c3-901a-ff2442e24edd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969552, "uuid": "67c42e4a-c1ab-48a7-8f3a-019ab44c0679", "value": "Fantazy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadb433c-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027243, "uuid": "ab09875b-fec1-4dfd-92db-356cbdd76c94", "comment": "Malware payload (Mirai)", "value": "41d60c26a4ea9d0eb33f6e6b738d8e70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027243, "uuid": "505f843b-d5e1-40ce-958e-d3ee7ba25451", "comment": "Malware payload (Mirai)", "value": "8f19d4514aa1a5ae1bb028bfe517e507fad8ba6cfe05283191eb927ce61156c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027243, "uuid": "3230f7e8-3517-4d0c-82ec-c798bd0c73bc", "comment": "Malware payload (Mirai)", "value": "323599ca2c9d70fc3a2a99f46f7b7de80f627a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027243, "uuid": "7937ad10-3460-465a-b7d9-41b64aa3519e", "comment": "Malware payload (Mirai)", "value": "f35b18e704eccc63f9fe6df915d0f0f09ebc3900fd476b6ac3354cbc62c2cab16d0eff422c77d0a129f6b79d0dfb8c5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027243, "uuid": "eeec5434-18ce-4a1f-9fd3-ca10f27c838a", "value": "T19463F74AFD819F15D5D925BAFF0E528D331357A8E3EE72039E106B2567CA82B0F3A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027243, "uuid": "d229c1f5-840a-4400-b97b-be06dfcede68", "value": "1536:VtnZmyiqSwOs4VuhyHwev68GpiUQ1XbnPuxsotxjqi2llQ2ihE0U3S2tu+7R:xmyXSjr9Hwev6fpJwXD2GonNZEVC2tu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027243, "uuid": "71c09ed2-2464-463c-9afd-46a2e2e7498c", "value": 67272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027243, "uuid": "5b133711-baad-4e45-8353-4da1f149d1d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027243, "uuid": "03bdf960-1989-49f9-ae26-b47dd924f51c", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f5402c-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766989382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989382, "uuid": "b812b3b9-875b-4e4c-9c36-7f66813910dc", "comment": "Malware payload (AsyncRAT)", "value": "397617a46280aa8f7342ba556116944c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989382, "uuid": "477c1092-a081-4c34-b7e5-3aac295e22be", "comment": "Malware payload (AsyncRAT)", "value": "8f44fa89ca0dca60702921df8d08358a07900217645fd78f5377740d6501bb3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989382, "uuid": "3abb8602-b4b4-4b0a-bdc5-5d68d9004a59", "comment": "Malware payload (AsyncRAT)", "value": "39f690c23ed86fd721afba9bb27f0c8d08c7dcf3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989382, "uuid": "ac08ba97-682a-4c0b-88e2-0d336146c3d2", "comment": "Malware payload (AsyncRAT)", "value": "2b6ccd231811ee82e844cc3b272e7eba200da7e6c1fa86e8a480cceb7660234ebe18aa8fcc9cd2fb7d877b821d33162d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989382, "uuid": "5b5c8c5a-613e-4452-ba09-5293486ab473", "value": "T19F232A143BE99216E2FE8F7D99F11545C6BAF6132602D74E1CC002CE4A23BC69A527F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989382, "uuid": "7e3810bb-c1f8-4c6b-8f92-4a23e475feec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989382, "uuid": "cbf73326-5d71-40b5-892d-d4d28183d65b", "value": "768:XseYDfemgcveOx+2fonz6A5RyIvrRYAeb1ngUptWxrAK8RccCrWBNJDR:Cgc1+2fczNRbFYxbuU3arvYcB2JDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989382, "uuid": "3d856ab9-08b9-433a-881c-1f522f221eff", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989382, "uuid": "77cfe320-c538-4add-abc0-538b4f09069f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989382, "uuid": "862209e9-6153-4b65-8766-fe87fa8e6fc3", "value": "gClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89b8e32-e508-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767048633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048633, "uuid": "e30ca68e-5674-48a2-aeed-18c381f9d6ac", "comment": "Malware payload", "value": "68b7c1ebc3166e6283737b077b41cd66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048633, "uuid": "519996d0-e404-48ba-80c9-9a9450951c33", "comment": "Malware payload", "value": "8f7aa2a5dea1d9ec87eb242cd3a56c7e7a26301d3f903756cf8b3286954dbd38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048633, "uuid": "976391d9-fc30-4995-953b-742e8693d75f", "comment": "Malware payload", "value": "9bc2cdca41b598f25766fd659d460ec56e65470a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048633, "uuid": "d16319d6-71e2-4962-b1af-61dad0a2eabe", "comment": "Malware payload", "value": "dd1013fdd8e9143cea0029ab80c4dd5372b25cd95e7e412749fabcd5c0190e96ce3346c2d22138789079d931f2fe9d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048633, "uuid": "02d0cb82-47c6-4bf1-ba46-77829cef7960", "value": "T15A96F24C547F9CACD7EA23FC411F35E9706A4243DE76EAC14B7C29A1FE286D20663A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048633, "uuid": "31982574-01af-4945-9eaa-839034f3fd7c", "value": "e03228a73b0424186c57ba081d5a43b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048633, "uuid": "8c413377-dd7c-4d51-9853-eb7a42f48172", "value": "196608:tVX8OIBEnkzsnDIQh1jil8lmiVuvoYW5ANQ3FeKLQgN8ToaZ7wWNDeij0aext32k:/MOIbs8QDdhuivFeKaToafxeij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767048633, "uuid": "51bc045c-8f28-4efa-a83f-4436b4d8c24a", "value": 9084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767048633, "uuid": "fb07eefe-a5a3-480f-a22e-45194bfb6a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048633, "uuid": "b7f7475c-040c-459e-bcdc-cef0eaaa42b4", "value": "hitboxLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0086695b-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051304, "uuid": "6e8d8277-b01f-4163-a0f9-4a6d0b13a827", "comment": "Malware payload (Mirai)", "value": "ec102e47d3dd6f065e86ce4f9efbf0c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051304, "uuid": "7874116a-9f46-472f-a438-14cd72519351", "comment": "Malware payload (Mirai)", "value": "9010814ad6fbb822c3701edcae74d1a405a94bb2a64cf5c3204f0e06b7515337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051304, "uuid": "9ad16f6f-dd84-4b16-8281-ccf1b4c23108", "comment": "Malware payload (Mirai)", "value": "6323ac49338721244cb334b9994dd5496f50f2e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051304, "uuid": "7232c7fd-35d8-4766-9c12-575b9c38c2e7", "comment": "Malware payload (Mirai)", "value": "bb96001920d1f4bb6d094c3416b69dee842860639bf7b4c575fd49e3c40a4301d9ace23b827d1c3f81a9f265266a2515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051304, "uuid": "6dc4912c-52d0-491a-bb1f-dacb9d464f79", "value": "T13ED3D646BD418F13C6C321F7FB9E429C7B166B6DD6FA3102E925BFA037864D60A36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051304, "uuid": "8da854ae-ec55-4588-803c-d33f1ef07c36", "value": "1536:bti2PX4Yzoy7NVGkoNVQR42/WFk0V84V2A2Kbc5WqMAg81zOy5gHmtXbtlKbwywg:5/PIby3o0R4XFFC4LrAgqMA3lRquwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051304, "uuid": "3050abee-5f11-4441-8690-72eba660c4a0", "value": 139392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051304, "uuid": "e37bac14-8be1-4698-9871-469a3d1f046a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051304, "uuid": "ac3c2f39-7da5-47d0-a4ab-e9ad165d9cd0", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd14df1-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766993557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993557, "uuid": "d8bb3623-b5cf-44f2-9fc4-6ff4c012bfa5", "comment": "Malware payload (AISURU)", "value": "7dd6d7b2114075a1d41f853002dff4c5", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993557, "uuid": "95b6a1ae-aa8b-4a76-87fc-0de98dfd5807", "comment": "Malware payload (AISURU)", "value": "901cd2eba7e2f2bc741901dfc845c32579a5c9740769b45f091275cb7c8b8876", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993557, "uuid": "e84df090-e7dc-4e62-8fc1-10fb74f69070", "comment": "Malware payload (AISURU)", "value": "e04621f58c7711ccf27497cf4fe49c4cfdbb9790", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993557, "uuid": "151562de-5378-4a2a-933a-ecea85cb1144", "comment": "Malware payload (AISURU)", "value": "50c9d2a416d9226c9614336cc5d4b61bc7966296f4f2f4d5e760766ea2f353588f2d23ddb86892e45d08bdbd8c7a3d1c", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993557, "uuid": "a192cc76-a0c5-4150-b4a8-5cd23af50631", "value": "T196A36B86FB43E1B0D81A0434216BA3B98935BD722421DD5FFBE43F32ECA5B42961536D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993557, "uuid": "0685187a-f282-4d46-83d5-39fe1520d551", "value": "1536:DTsVhqwTYFO5bj5KbwsV0vqFHyUYkMS9UcdyvmUE31M6OocArSt9lxqZrxrF:Dwhzwh0vwHyUYkMS9UckcKW0DKrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993557, "uuid": "d7afadb7-81dd-4748-a500-b8c230d6f5de", "value": 104904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993557, "uuid": "76d62b7e-2a74-4135-bae6-f5470ebd3a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993557, "uuid": "eb1b2650-de50-41bf-bbb8-68f018155876", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea097fd-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014230, "uuid": "88cf6509-fb4d-4602-9ea7-7c5e1a64583b", "comment": "Malware payload (Mirai)", "value": "d597eeb8eb7caa4fcb1c080258c96a34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014230, "uuid": "03d93a47-9a52-4a94-923b-7608d8a9f99e", "comment": "Malware payload (Mirai)", "value": "90404a7b7d88744e446881c270da9a57a63dce4a652611bebe562787168fae0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014230, "uuid": "7d9bd235-7d7f-4405-ac35-024558ad1d75", "comment": "Malware payload (Mirai)", "value": "64d633fad1f27be330f89e0fbaadd8c02b7fbfe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014230, "uuid": "f3d95d63-1e79-412d-931b-cb0e1eff92ea", "comment": "Malware payload (Mirai)", "value": "1578997c41a85d4af47ac970159a65234238f5850a7304ce2b9101cd76093a966fbe477aa5cee07388ffd448d9bd0c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014230, "uuid": "00aaf51a-ef76-4bc6-ad00-283ad3bbff8c", "value": "T19DD3CF32E0086DA0DD2117B434B6597C0340DEB40AD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014230, "uuid": "babe94a1-8968-4422-a1fa-74941df51da7", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZW6:xOFgpOEoVv3MXL5NhGOW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014230, "uuid": "4507de16-2adf-40d1-ad4d-6a94a64cf94a", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014230, "uuid": "1513d88d-a7e7-4d8c-851b-b54097424293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014230, "uuid": "5e116a51-1944-4a4c-af68-6588182a65db", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14af6891-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766993356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993356, "uuid": "e7aa5c62-2512-4fc4-99d7-7c8621443d4d", "comment": "Malware payload (HijackLoader)", "value": "55e27fd8344e2e61683a2043c7ac8ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993356, "uuid": "90522668-22f3-436b-96e5-972ce0d0bba3", "comment": "Malware payload (HijackLoader)", "value": "90533a55e494f46a062240cfe5c0f9c7d3fd6f0c3ced68101357b06111fef0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993356, "uuid": "46ae6729-9b4e-40b6-b501-da849c857951", "comment": "Malware payload (HijackLoader)", "value": "c670a4cdfe748b822584d5e2ee48b5bbf8ce286d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993356, "uuid": "3cef8319-305c-4aab-ae3c-3429e289a49a", "comment": "Malware payload (HijackLoader)", "value": "c89df76e787dc96c395f0aa897d5a74b477fdfc5dae3a41f62dc27d11920f060ed5bd496feb0a0563d9face92fb8b196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993356, "uuid": "178c3ebf-553b-457f-bf20-29bed4fb9d80", "value": "T1D3D44A03D67281F5E9B6C0B942A2663BBD707518532467C7E7849BB24722FE0FA3D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993356, "uuid": "4560ef8c-d1f5-4a10-899e-aeb54f50de66", "value": "81184a9f7e2b304efdf1fcfabdac9864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993356, "uuid": "1a5a6971-482a-4ca8-acbb-29b6c568385e", "value": "12288:Ejccjai4vo6cRb+4QScSI7Bb7ncDt6y8ypntXtj4NYDs:EDio6cRb+RLSI7Bvvy8i4NYDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993356, "uuid": "ddb0343d-f49c-45d4-849b-54a534d306cc", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993356, "uuid": "d9005c22-0883-4ac0-93a6-624040035316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993356, "uuid": "1cd4df19-53f3-420b-ba74-063b49b18cbf", "value": "90533a55e494f46a062240cfe5c0f9c7d3fd6f0c3ced68101357b06111fef0cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3913e95-e454-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766971262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971262, "uuid": "f7986643-c7dc-4489-bbe8-02a1bcef1037", "comment": "Malware payload", "value": "4acf082026ba885eada246d0659532c4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971262, "uuid": "204cc76f-b286-44e1-8454-59fe8347a852", "comment": "Malware payload", "value": "923840181620f328f5b7f0364b36e0cea8853eac60b5f137044b662bc26bcd05", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971262, "uuid": "04d7bc7e-81c8-4a6e-b13e-fb80e540e0bb", "comment": "Malware payload", "value": "864558ba9ae44b3f51e691b0b4624c85467d7509", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971262, "uuid": "19b482a5-5080-4a29-8b12-dbf670724c1e", "comment": "Malware payload", "value": "e5780b40558c6074be1c0dbb8f2adbfd891881fa22ca28c652252e5fefb6550e02a12859cf6b9a7b4bab30c0aeb28839", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971262, "uuid": "6f00a03d-841f-4de8-afc9-096a7c5b18ab", "value": "T13B563334A2439DEFE8CF56F02FA3D03D5A633D7887A41E5946BEC9311840A9A0D5B376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971262, "uuid": "cc740d48-910d-48ae-a147-358abf67a7dc", "value": "3106aff70b4ddaf775f5f213aa12b399", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971262, "uuid": "6a62484e-5e03-4937-96cc-7625f15d46f1", "value": "98304:8h9EkSboiJTX+KujT+nyLy1Bex3aT7MngjM/7gCvAyTZCHHpvAT40ZRcLhM9:8nEUoTX+KujmyeX2KXMngjM/sryTSJkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971262, "uuid": "4a291403-9f63-47d0-a353-666228da5713", "value": 6228480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971262, "uuid": "d99e5c2a-f3b4-4d1d-bd4c-e3cf4032e04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971262, "uuid": "a8b465a0-6c0c-40bd-b630-0dfd256d85ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81a4d46-e4cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767024151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024151, "uuid": "01db6aed-278c-47d8-88cf-6b0b77307075", "comment": "Malware payload (Braodo)", "value": "460dd5f1b72beeb1e7976852f67377a0", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024151, "uuid": "09fd96d8-71ce-48b4-bdb9-3d94d0fc4cdd", "comment": "Malware payload (Braodo)", "value": "92b55c43e1675029cbfea4bec1a0bfb5603894237547c2081b55c2b6acf8922f", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024151, "uuid": "cb62cc53-9e42-45ae-badc-386bf52f43f4", "comment": "Malware payload (Braodo)", "value": "f4037af4115714caf16a35656afc1e5e46d7d0b8", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024151, "uuid": "e0dd451a-2d4d-40d3-83f1-a8f3eb99121e", "comment": "Malware payload (Braodo)", "value": "a7c11a5b925c89f45354f36624484934c1d32a4bc4a7f62cc75e8de265e9c74e546ddd0a552545539c99d25fe7630258", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024151, "uuid": "99d10963-4c5a-47b1-8a58-0ca01818e360", "value": "T1DCD433262CF32BE4FC811666E3B0D75D2ADEA56C8D410E6D1E0AC2164FF85443936F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024151, "uuid": "2a1a371b-6204-412d-8afa-3eb47f2c6e18", "value": "12288:7kfOtVaGs5/DEuyzcX/lqRyF5Qmvi9/vPUl4t0AniMqh9gD5JL00ykOO:7kmtoIuyzcP8QF5Npl4yUlqh9gD3Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767024151, "uuid": "6d6d82a7-011f-45cf-8a5b-70a1835dc2dd", "value": 643841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767024151, "uuid": "26ce2183-d7da-4bb9-9137-c25a18ee23a3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024151, "uuid": "79be3af3-1dbd-4d5c-9d2d-ed7750adbcfa", "value": "Villa_Furniture_Quotation_Georgia_Tbilisi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378f9d67-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969362, "uuid": "5c0c6d4c-8ee5-4507-81f7-791c7b827f1b", "comment": "Malware payload (Mirai)", "value": "b26f677433303c82c66d99a94e94975f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969362, "uuid": "b0a89d73-bacf-49c3-9ebe-f78587dac964", "comment": "Malware payload (Mirai)", "value": "92b951fce365a8f9a70ed683fcd2b9f5e38fc4c29ea60a94d88eb5d408f31494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969362, "uuid": "8077d392-26b2-4d75-98ee-24b5add5fa58", "comment": "Malware payload (Mirai)", "value": "26ae739748f51a7ac4946dea84532d7db0432255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969362, "uuid": "e472c0c1-e27b-460a-a022-a59ea75ef5c3", "comment": "Malware payload (Mirai)", "value": "e8325630ff8eabdd7e79ac04099bd57436d8d9e20aae42feb831797ac36c76ed08638ed13fcf186815a7575eaf3011a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969362, "uuid": "58a77d86-ff4d-4197-8344-7000d4df5412", "value": "T1D7E3D80ABB601EFBE86FDD3706E90B0625CC651722A87B753634D928F61A54F49E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969362, "uuid": "608b98d6-5f16-4f6b-bd45-df6870ff6fee", "value": "3072:kG1bc5mf9I+iw8WU0cJG/oJ8YHm2BwnzkzK9:kGNcmIMULs/oJ8YHEkzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969362, "uuid": "2bbb1be9-b23e-4824-8789-e4f7e6a6c116", "value": 151740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969362, "uuid": "9b77f28f-4639-4442-bc91-581564ba6ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969362, "uuid": "e6b18e4f-ba74-4515-852e-bad40c1712b0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca16fbc-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971599, "uuid": "c3fed18a-5ab4-43c4-bef6-33b9f5f44944", "comment": "Malware payload (Mirai)", "value": "40debca30c9b0aeca9006db77cf495c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971599, "uuid": "9fd10bc4-4f31-4cf8-9738-ba92f52597e9", "comment": "Malware payload (Mirai)", "value": "92bd27aa18f154ca7a015cdff311f4e4365061a27429224b6158169bead91304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971599, "uuid": "feef2140-144e-43ff-9e29-fcf2f288c83b", "comment": "Malware payload (Mirai)", "value": "ca6e69b64a390a98ccb2bbc99335b95007883940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971599, "uuid": "08a78804-a85a-4c17-9259-65a11e10035a", "comment": "Malware payload (Mirai)", "value": "b30e5239333b33e7c2886736ae54df72c1ccfafdda8a2f7fcb6872fcd00d5bdd5d2eb68ede5fd80937f11bbe7d3099bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971599, "uuid": "7b406677-3097-41f4-a215-f8703ee0a260", "value": "T165B31A95B881AA12C7C2567BFF4F428D371697D8E3EE3203CD185F64378B95A0E3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971599, "uuid": "a6b291fe-039f-4a7d-903c-69e5bd1a71e2", "value": "3072:1ZYV2Pn6D4Xy11/T3UbmlNWOQqaHNrf6nDnz4:LYEP6UXyn/T3UalNWOQqaHNz6H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971599, "uuid": "3016703d-5853-4d8d-8e22-915388a10baf", "value": 111832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971599, "uuid": "a7c38b0d-eda0-4242-a342-f88140fecf41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971599, "uuid": "a661b7a2-f00a-4d36-950b-28fa6ce14e9a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a2f49e-e4b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013735, "uuid": "f55b7fa2-a28d-4b36-91cb-cfb2944e6a03", "comment": "Malware payload (Mirai)", "value": "f2cb2a512607616c3d208a9d3f963494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013735, "uuid": "b2bfe892-d68c-43c4-a8bf-1e6293baad79", "comment": "Malware payload (Mirai)", "value": "9355364323014dd744ce97a60d7e578d44c1b5ef4b1773da012a6ac0394b85d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013735, "uuid": "300d9e94-13d2-4eb4-b96d-3d8a09eb910a", "comment": "Malware payload (Mirai)", "value": "b0f7f2755bad62dc2cad3206ddec7e27ae81e1ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013735, "uuid": "9731edab-5a02-4390-bdb3-ee44c36b0328", "comment": "Malware payload (Mirai)", "value": "46d9f67a35de90bd0c8dfc732872dd6e816ec2aae57a8e9e76a9373cfb49d0e16e2c867623a992ba1a3018249e0d9919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013735, "uuid": "e0752293-e8ad-4d44-b110-8ad5c806aa9b", "value": "T1AB53F845BC918E15C5D412BEF92E118D332767B8E3DFB222DD105F24778A96B0E7B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013735, "uuid": "0d980147-de60-49ec-a1cb-53866ddce114", "value": "1536:LRn40TMmcKCfCsXJnOqwhobZ7MmijJLZ4wnT:DIm8COJOqaJLZ4wnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013735, "uuid": "187d31c9-fd73-472c-8265-64d9eb1567f0", "value": 62648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013735, "uuid": "e58320c8-af18-4da5-9e54-b25b5e6453c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013735, "uuid": "fb08d684-9761-407c-af4c-83fd9cb9106a", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1805c713-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995079, "uuid": "acd7a440-237c-407d-9df2-935cbb2640a9", "comment": "Malware payload (XWorm)", "value": "e81be4e9bc2cab346c2ef62aecfc62c7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995079, "uuid": "d67460da-12b1-48fa-8250-c3f0eeef52a3", "comment": "Malware payload (XWorm)", "value": "9372733224f523df81e19ee2147c830593703920c8c0d40995f9f965e9179957", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995079, "uuid": "110dee90-3200-4f2f-8206-132179576c56", "comment": "Malware payload (XWorm)", "value": "15c1758818b24f81090c4b848cfb95dd6b6d40b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995079, "uuid": "c872fd24-e270-4da3-a6bc-dfed0286572a", "comment": "Malware payload (XWorm)", "value": "9b959d0f93dca7ce1278f30d69f14221c4ac120603481f8b6a88a9490aeec7372d83782761a7907a1ea0e12cc20ea7ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995079, "uuid": "b0cc98d9-78e1-4483-895e-35442c4dcc59", "value": "T1FF7309117B86648D53EED1B2C9DDE30F86A02ED4CB55CA5C7A878C5328088D87BDB96C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995079, "uuid": "f2c530a3-1c76-4b82-b3a2-d2ecf2a51e0a", "value": "768:I8w/h62/jWs6oS+xISN0vLBHvm4dkfScBYrwz2y8kTAlGB:I9l/AoSSMpVusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995079, "uuid": "ddad762a-7153-4961-8b97-6fbfbdd15c70", "value": 74389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995079, "uuid": "e2436cd9-039e-464f-bd2c-4c42a96ae841", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995079, "uuid": "ac15eab5-a4e3-40fa-a649-b105da3c373a", "value": "invoice-1645080830.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1a5d4a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995433, "uuid": "6ed7b0a1-95ee-4d30-a0c6-2e3b533b8628", "comment": "Malware payload (XWorm)", "value": "48f9f70bae63ce1d8c4f514de3fbbd50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995433, "uuid": "a6382a23-0dff-4b70-a9a3-2605dce40c87", "comment": "Malware payload (XWorm)", "value": "93729fd708ed945b3b3b1e0cbfcd30692ab7197c19ac9073e674d749d17f7d09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995433, "uuid": "85080b45-fe15-48fa-a491-062d912cc231", "comment": "Malware payload (XWorm)", "value": "e657cb29085a20d2be6cef2797b5ba606efa144f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995433, "uuid": "6b065286-c6ac-4d25-be08-42ddcb3c5dd5", "comment": "Malware payload (XWorm)", "value": "6ed88616efd0b6161d8511537cda8df7be540221f268ed0991ef58c5033d2fb32338b8908385a29a227cb899f0c495ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995433, "uuid": "9f338991-e93e-4bab-bab3-dfb9bf1c7a1a", "value": "T13A73F8C50AB90C58B9D72379FA6D36CD5E8233C89CEDB2C9E5862C3102645C41ADFAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995433, "uuid": "34cac542-acb0-46f6-83f5-c99afd3285f8", "value": "1536:I9l/AoSSMwoA2EoA2koA2ioA2CoA2ooA2QoA2UoA2zoA2foA2goA2FoA2noA2Pog:I9l/5MjA2vA2PA2RA2xA2bA2DA2/A2sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995433, "uuid": "01eca8d1-8383-4012-927b-44e1c869a26f", "value": 74438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995433, "uuid": "83d4b7de-abb0-4667-88b5-e524ba9d647d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995433, "uuid": "a77a40df-ab83-42db-8f72-552201ed41dc", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c618f45b-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969172, "uuid": "5e2393e1-fbf9-40b8-8264-cad2a92a1d81", "comment": "Malware payload (Mirai)", "value": "21cf170d401246496ae284f022891f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969172, "uuid": "57c85112-5c46-45fc-aaf7-931c683d1ac3", "comment": "Malware payload (Mirai)", "value": "9382467730e0255a9fc4ccb4a7782f9dfe2ab3c6527be0560b199bd81028553f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969172, "uuid": "93738999-53db-48a5-8271-ff20c1cd3824", "comment": "Malware payload (Mirai)", "value": "04e4ecc14ed6a321eebcf7ec97e79b925103f4ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969172, "uuid": "b190f007-8985-4a3b-a2ec-73ed084ceee1", "comment": "Malware payload (Mirai)", "value": "e0f42977907a2f09b8ccaac22b640103b2802710369c253ad9b1aa9957daebb597f90e9ae983c235257e7b7de92545e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969172, "uuid": "a3555587-0f1d-4b9a-b91e-48fa77dceb0a", "value": "T1D2635B89FA93E0F2E9531171117FA7678A32E63B5025CA87D7686F36DC23401DA173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969172, "uuid": "e92d8806-152e-47bb-b557-9dce29c7cb76", "value": "1536:pzw6LQgili4zf+OihPPhmomzK+NMSxaD8Fh16USFlP3gxg:i4SuhPJ+K2aox6we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969172, "uuid": "f8af9429-6c81-4d1e-a3d2-79d97a2163ba", "value": 70820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969172, "uuid": "4faf0f21-1f68-4aea-b681-1140ee768613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969172, "uuid": "4a4c8e2e-1f98-4090-86ee-d730ba8b0928", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce26bb8-e4ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035514, "uuid": "1c2057e2-9622-49ee-9600-bf4282ec7a84", "comment": "Malware payload (Mirai)", "value": "50b1857fe977d2b1d9ebd5b10dff8601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035514, "uuid": "3f822ca7-1ac8-48ea-9bd2-0cf4823d418d", "comment": "Malware payload (Mirai)", "value": "9391833dbf6ff515bbec0de3e328bc4ee5170552fa76c461944cf1e7f09bcfd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035514, "uuid": "f4d07cac-00ad-46a0-bc54-38971bf273bf", "comment": "Malware payload (Mirai)", "value": "796357ec2b97e64204519ac720d9e6be1b9f28d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035514, "uuid": "e885708f-4d10-4472-9be0-25c221b2270f", "comment": "Malware payload (Mirai)", "value": "aa4ad81754f016b8e374b1648788fb261bfde3f3e1b9868e5b69518c283bce3cdff8cc0d3d82ae8091359401ffa58e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035514, "uuid": "bc8c84a6-73d3-4fbc-af1d-8bd1e318bca9", "value": "T18104AEA7B70F18D1CD2106F81BCB5B9D6A2321039D67C6D3AC9E36392E365DE14163E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035514, "uuid": "6173c2df-a704-4772-8f43-5b8ff9b50c61", "value": "3072:6I2qgHYFUliWWibtiVCG4UJcNr25QpbFxmdDPng3CH2aFYcOub01u8q:t2EFWfC4UJ75QhDyD2CWaF78q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035514, "uuid": "49567793-4374-4a69-adbc-8be5aefef2ac", "value": 181940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035514, "uuid": "bd316d89-64ba-43b6-b22c-14c85274ab9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035514, "uuid": "9979322f-e7b7-4246-bc45-9850de29cadd", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f14adc-e512-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052729, "uuid": "3fff6a40-20cd-4568-9c4d-4639e73c7e9c", "comment": "Malware payload (Mirai)", "value": "eb6a449dcbcd309d798ef4955c905337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052729, "uuid": "829bf374-e5d9-44a9-8b20-839df2285f09", "comment": "Malware payload (Mirai)", "value": "93dafba7dd1f6b041efebd0cd56cf302f042b837c401fcacd79ee8da29002ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052729, "uuid": "2ff535a1-4647-40ec-8731-4e704fff056a", "comment": "Malware payload (Mirai)", "value": "149fa08ac33d526f462d33544c4f1afd6a6d610d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052729, "uuid": "30b6cbcc-66c3-4d2e-a3d2-2deadf5ba285", "comment": "Malware payload (Mirai)", "value": "b81e80dcb5be7ade8fcc51bcf0e205712b4d2cbb6d10936740d5c3f31fdd33635951de4651b20635165f3596650c8a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052729, "uuid": "655b1af0-d716-43fd-b220-6ef72506145a", "value": "T1B0144BC7F801DDBDF80FE77608134909B530B76220935A377267BD6BAD390A90967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052729, "uuid": "3a9a5007-eaea-4244-ba32-7caeaf2b537b", "value": "3072:R4r+0S4OwvOExA1NngHW2ficZk9yIXWZZZFiaLYI7AhlQ4VRjbi+L1UuWuh/FjW+:8SbwubC0yImZZZEaz+lQEL+3WW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052729, "uuid": "726c83a5-9758-4bd9-8158-0d7275d7b2bb", "value": 206080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052729, "uuid": "a66e8cdd-39cc-4974-a747-ab584fd68c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052729, "uuid": "777d3ee4-0925-4d13-a86e-a982eebf34ed", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db54516-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995089, "uuid": "dd63adf2-5e90-472b-91e9-88597d66cfe5", "comment": "Malware payload (XWorm)", "value": "8a7c8d2c90e820232f9424632773d40a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995089, "uuid": "141f5ce1-03eb-4bac-acba-aff62672365e", "comment": "Malware payload (XWorm)", "value": "93dd39567821b3aa0c4a0f8dfb48d478c3ca757785f9906e5c515ca7692eee9a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995089, "uuid": "1ce1b4ce-8b2e-443a-9c72-e86f3438f759", "comment": "Malware payload (XWorm)", "value": "cf2a56762de570c14532af4de092866f304c7500", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995089, "uuid": "f2a5c921-85df-4e7d-b07f-30f702bd10ac", "comment": "Malware payload (XWorm)", "value": "7e5ef81c1a1c3c8fc72162b4d009cca561be8c8cf582978316fa9a424a141adbe264e5bfe7faa331a387022ded78be5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995089, "uuid": "a7eb550f-2d3c-49d3-b871-d1e4f1c3b224", "value": "T12D631A03AF744ACF2531D36529CEA2637324D0DEADB114A02C6DD84CB66A77E91A1DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995089, "uuid": "477fe1b5-c0fa-40eb-ae29-71a02b11e3b0", "value": "768:I8w/h62/jWs6oS+xISN0vIHXIOgqsdkfScBYrwz2y8kTAlGB:I9l/AoSSMK2usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995089, "uuid": "60e5dfc6-af26-4d1c-80d4-27f3e8710ad6", "value": 68773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995089, "uuid": "48007048-2c36-4bc0-9e83-842d98c29d69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995089, "uuid": "1e19eb55-1581-430a-b749-2ee99123ee6a", "value": "invoice-1645080830.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe90c25c-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013505, "uuid": "70b595fa-32a4-4511-8be2-673eb8d4e1de", "comment": "Malware payload (Mirai)", "value": "8a6bdc9edfe0d3ec3f9b068e2b5e2b78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013505, "uuid": "a2b7c0a1-a968-4384-9703-ad61e04993a5", "comment": "Malware payload (Mirai)", "value": "93f02bed335bf012e87b1276a9d6c333fc593b53c16531aa6d1cd3227eeb5290", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013505, "uuid": "84a2a546-525f-48b2-a73d-5e8e1cbfadd5", "comment": "Malware payload (Mirai)", "value": "2a0b996c2cb0df7fbed17c0b64f332a0b1fb4bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013505, "uuid": "d30175e1-bd53-4d61-9e40-9ede6dc5c538", "comment": "Malware payload (Mirai)", "value": "13d900d745a6fbf524d587dbdc0a382b031b7dcc6670cb6989b3e096d01b6edd6a1923398deed6ad418795f0aed934ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013505, "uuid": "30df3869-efaa-4c3d-8f52-910d44c59488", "value": "T168330840B8D19A23C5E423BEFA6E418D332563A8E2DF7217DD216F15778A92F0DB7601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013505, "uuid": "b74ff342-30fb-49f1-9a21-65e132f8f968", "value": "768:zjc+jze2o8mVkoov5JhqtOFa6q7cSGaDPYN0XNloTQQUJWT:c+ja2zXhqgF3qzGaDc0YgsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013505, "uuid": "9555165a-8858-4fa8-a160-ea1b17da88a9", "value": 50712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013505, "uuid": "fe329e07-237c-4b8b-b3ed-0438b567f77f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013505, "uuid": "a240d2a3-e612-4d8f-9bee-b8d4e1589075", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8f07fc-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995382, "uuid": "2d67b2bd-f901-48ee-bd61-09fe16ec9318", "comment": "Malware payload (XWorm)", "value": "8587ff5daf45e62d039dffabe99daed9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995382, "uuid": "5e8571ac-fabb-4132-a530-45df39f9dad0", "comment": "Malware payload (XWorm)", "value": "93f856aef4271169051059798bc0165c419baf89b56f3a6c615e665b7cdfb5b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995382, "uuid": "5958abbb-14cf-4157-acd5-0b8bc73edded", "comment": "Malware payload (XWorm)", "value": "ef2c249a2973da5d83c899d2f8b8b783d15ca1a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995382, "uuid": "1dd06bb4-defa-43bd-88ac-5011d1c9c532", "comment": "Malware payload (XWorm)", "value": "8852f7632ced4a0f191667831bcba74638f45b724537030c6f0540ed60fed8d470b55695347f4aadba68094a4d10eaac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995382, "uuid": "2f5491b8-0631-4e69-95df-635a4e35e76c", "value": "T104732A0F5E5066DC103DFAA3AC9702CCD794633A02B6D5B48E9FB9B3955CB502BA1C4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995382, "uuid": "444e855e-1572-46a5-a76a-4ce2739be575", "value": "768:I8w/h62/jWs6oS+xISN0vnxKosEdkfScBYrwz2y8kTAlGB:I9l/AoSSMnPusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995382, "uuid": "c75f602e-db05-4aa6-9101-49d993106ee6", "value": 73436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995382, "uuid": "44b2754e-f61b-48eb-8e91-76e0e8f2ee9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995382, "uuid": "13b5b2df-52b8-40d2-b1fb-2d2ad8ca79d3", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c263c1-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967802, "uuid": "51b6b51f-f643-499d-9a86-42f0e2ca5fe4", "comment": "Malware payload (Mirai)", "value": "208803f2f48ec01bebf72ad298e4f1ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967802, "uuid": "4363a8cf-0c1d-4e91-bf47-c195e167a12c", "comment": "Malware payload (Mirai)", "value": "9405453f1a901ace7f5e0a997a4072e71d70290c693fcdd703f1dbb2291f64ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967802, "uuid": "c78c1afc-bc39-4fe6-9f43-5be882519999", "comment": "Malware payload (Mirai)", "value": "52f9bd68973756fae3016b35579d3bbb197197e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967802, "uuid": "1e834b88-cfb1-4780-8554-dd28012d4b19", "comment": "Malware payload (Mirai)", "value": "fa6efb8e988e7681bcf86a5224da2ace49f9509ae30f05b311eaf974fc259aa93bd3ffb23d6eb8e79439ae69801c5818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967802, "uuid": "fdbecbe8-8b7e-4398-8d22-b4a2172ea42f", "value": "T13983092236B42D17C8CC533E50FB8321F57237286265C35EBF571E6A6E2A391392B761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967802, "uuid": "3f9a5e49-4311-4722-bf72-3ca3e7cfa4b2", "value": "1536:BXGG/dANUQQFongZTZ3Cg7fEDJouitoJOjuET39rmYOh0+I13IVt:AG/dDFUgDEJ/JOjfVmvYIVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967802, "uuid": "ade1d36f-1cc4-4308-9e0c-cca6df6ec3ee", "value": 84228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967802, "uuid": "54facb0c-e102-44ec-ab73-19761435adda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967802, "uuid": "0caa8d91-d75f-4ed8-887a-56e7aefd02d3", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bcf45f-e4c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767018409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767018409, "uuid": "64d62ac7-6757-416b-9ccf-8de54196806e", "comment": "Malware payload", "value": "ff077195586671c8b3b47f40067d4164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767018409, "uuid": "37b4b39d-710d-41ce-b815-3339d623fa87", "comment": "Malware payload", "value": "9462b5dc54a505357b49e62bb7dc1cf5d2e222da078d44520d2163f11e6ed0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767018409, "uuid": "36a6ccfe-4166-4a52-944a-a833b22b53c4", "comment": "Malware payload", "value": "23c54d9e06217dcbd8128accc5d662bfb7cfc7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767018409, "uuid": "c124e396-5cc8-4298-a751-2dc74636fa08", "comment": "Malware payload", "value": "52e023d1058c9a0bb9d0edb81312719e3dbdd4018fcfd31c9790bd783751ff2bfbb9fa641e3a9df7d688d394f3384b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767018409, "uuid": "4cde6198-09d5-4131-9a4f-ab9e6fb7a583", "value": "T1E0352209625ACA21D8A16FF36C32E5F117346CDCA811D243AFD5BECFB879B224954363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767018409, "uuid": "95fef6dc-3d10-481c-bc5e-1e092a29e228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767018409, "uuid": "405e112a-865c-420e-aab3-da0190591bdd", "value": "24576:JEx6N7u8zIHrs6NYvvniYL/Cqzt+rVC5fEoGkQ9I7YawQ72OVT:JExisrs6NYvfiY7CqQxC5fErDawBOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767018409, "uuid": "cfe5da08-63df-4f38-88c7-120c33969185", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767018409, "uuid": "836bb8a7-931e-4c44-853a-febe838a3197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767018409, "uuid": "2da44220-9b1f-4689-bdbd-7b1a96093eed", "value": "SecuriteInfo.com.Trojan.Packed2.50433.30288.6082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b020092f-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014232, "uuid": "8b8edc2e-fd8a-49f2-a52d-e92fba26ccd5", "comment": "Malware payload (Mirai)", "value": "5ae54fda8f525635cfc24d5fbeea44e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014232, "uuid": "cc6cf7a2-d8c6-4650-b437-ed29c1d0abc3", "comment": "Malware payload (Mirai)", "value": "94e1f0839c46b753ce4aaf0b41bb6d9044f6920f7bc54afaa75b2ae01331e1c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014232, "uuid": "1268a4bc-7dd8-4655-8d2e-68338a0d21a1", "comment": "Malware payload (Mirai)", "value": "19c67cdee63ba9b60f548a029b1d671b60e9b53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014232, "uuid": "31d05e2a-80eb-4336-8d6e-abd7ee2a6682", "comment": "Malware payload (Mirai)", "value": "d04290fcf8fd6566e7ec975096b117173d877010f9bf686450ff781f618172d537fca39620079937486236bcd94e8a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014232, "uuid": "f16b23ec-8d13-46a6-b815-b2982d660e7d", "value": "T1EA93F996B8918A22C6D452BEFE1E51CD331357B8E3EF73139D205B147B8A82B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014232, "uuid": "92637802-6d66-4223-852a-4c2d07c5d339", "value": "1536:6uxn3n5WS3gHorLNtWFqQtsfveD6jdPkdyF5jQ3HMMiAXIyFZvx447TBYhT2bVRO:6oF3PNtWUQtMveDO90XIyFZvx44/BiT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014232, "uuid": "95bfd20f-2f3d-47c1-95d2-2d56553f1ff7", "value": 91320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014232, "uuid": "f2e98bd2-50af-4d38-a3da-a5905f25a9b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014232, "uuid": "cf6bd35c-7c03-4416-86af-f003b10c9b65", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f71414-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995477, "uuid": "abfd089a-e93c-4ea7-9cfd-1a5a60e8b12f", "comment": "Malware payload (XWorm)", "value": "f6cd5284373502f6c40d4473df12db51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995477, "uuid": "31cda994-f143-4345-a43b-8d566fd9263c", "comment": "Malware payload (XWorm)", "value": "94e26618eae00f82724ae64521a52b68d525cf7daaf64ba6daed05003292246c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995477, "uuid": "e291d4a2-2dd8-4524-8e60-f96353295fab", "comment": "Malware payload (XWorm)", "value": "e190f68550af52ed8ec1872f5a146c35831a3b8c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995477, "uuid": "34350549-f811-472c-a5e5-2fefdf45675a", "comment": "Malware payload (XWorm)", "value": "730cec6be99f70c2bebb4ec6c60ac147cf910189131f7e697a21bc624eb02c79383c443d5d58a31aa9839837baf3cc49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995477, "uuid": "2f1f86bb-9f60-42f4-b41d-d7a7fc551c0f", "value": "T1D66319311E6E994FFDDB5970F51B219F61EB36678D8F778A98EC3862C70208D6840493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995477, "uuid": "d15f485e-1f0d-408a-b092-5f3300d00b3a", "value": "768:I8w/h62/jWs6oS+xISN0vnu4BqEqPXSEVKzLA8qFBhxMFYPffqo65H6WInnNjqFz:I9l/AoSSMin3usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995477, "uuid": "cd6989ce-bbf5-4691-ad4d-3edec462762f", "value": 71569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995477, "uuid": "8cf0c0fa-3720-4bd8-b680-abe6e934317d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995477, "uuid": "2c460585-e10a-4c8b-924a-bcdeb233ef8d", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fece50bd-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051301, "uuid": "de54092c-4a9d-49af-8cf1-012914a6e24f", "comment": "Malware payload (Mirai)", "value": "281dd39ef82cefce70b048038e34b79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051301, "uuid": "9cd1b193-07ff-4c91-a6bd-83eeb5b75e5f", "comment": "Malware payload (Mirai)", "value": "94e861d7552ea02ae1895aef41b4a1db1afe2d92716117738147a81a5f01e459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051301, "uuid": "80422705-4c82-4271-b3bd-13bfc74c99b7", "comment": "Malware payload (Mirai)", "value": "cbeede18441677ea789d0920a99166aa984946ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051301, "uuid": "6bc36cca-2fb4-43ee-9af4-eb48410b1b7f", "comment": "Malware payload (Mirai)", "value": "f122cde600c63c3790da35da9da5d267b29e0af517ff507538d1f01fa11b9d8cef5331dcd66d56304a156e57020aa591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051301, "uuid": "f5db65b4-7729-4220-9bc7-fcf639e23abe", "value": "T10293E616BA429F11D4D725FAFB9E819933136FB8E3F97101D920AF6023CA5DB0F66112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051301, "uuid": "1660b829-4d2b-4e5c-820f-724b26247bff", "value": "1536:UsnjgIkTOrT9UZWp+39MGmaaJp1aQQRmuoHLXjPlFyUiWlB8Bth2Z33YMdC:g/TwT9NKtpaJp1aQQRmuoHGolB8Bth2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051301, "uuid": "c5b60e4a-74b2-4015-93e6-036f449d9771", "value": 96056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051301, "uuid": "9e9d2ca8-7f12-44a1-a477-84fb26c526f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051301, "uuid": "a5ab68fa-c6e7-4787-8748-0e3a03c4e6ed", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4042e527-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995147, "uuid": "34fa2c27-844e-4556-8ee3-b888cdaf8d3a", "comment": "Malware payload (XWorm)", "value": "7169f09ee66c76adbcab5a95e1a6c613", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995147, "uuid": "47658e67-6149-46c0-9082-fdc3f8b19f8d", "comment": "Malware payload (XWorm)", "value": "95053f7fc3c8625aba3957be8cdb5e31454f94a6654602bc9499bc732465559c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995147, "uuid": "94bf11c0-71ce-4b21-b077-04c18feb5e67", "comment": "Malware payload (XWorm)", "value": "058dbc777fe65744b34c2d93a456da08267ac8a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995147, "uuid": "a2d999c7-1fef-48a5-90ff-c6b549379fcd", "comment": "Malware payload (XWorm)", "value": "ea0e4cdd72cc8dc3ae5a78998ce57a4f36276af1c0050a490b75fd08269abf7c699365fca999de31e50d1a8862a66dc9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995147, "uuid": "83fd9cc3-7fa3-4eea-aaba-75bf00b69b26", "value": "T1BE632A302AE1A1FA7FF425F265742FC2B7C9241BB8F077DCB51BDAB0640DE261249589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995147, "uuid": "65889711-7d7d-4abb-a4ef-ac4ba77c2e45", "value": "1536:I9l/AoSSM7Gh+/iKfK5sG+VTM6s7xr3U0zS0QYevNuOSh8EJiKf3VY/AnvdhxL3X:I9l/5M7Gh+/iKfK5sG+VTM6s7xr3U0zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995147, "uuid": "72cf3c0f-e488-45ad-af52-6d058f91985b", "value": 72507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995147, "uuid": "88aaed1c-e913-4aef-bdc1-0bd726db12a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995147, "uuid": "1e16294b-ea50-4b49-9451-c0bd3adbc553", "value": "invoice-1645080830.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51f1ee2-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Amatera)", "timestamp": 1766968338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968338, "uuid": "7ed396ec-94be-4ae9-b94c-3b9e78dace22", "comment": "Malware payload (Amatera)", "value": "66768efacf8bfb1bcb168b577c93b1ce", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968338, "uuid": "e8b0e614-1af2-4cde-9cae-2693bcfb42a2", "comment": "Malware payload (Amatera)", "value": "955ebe71979ecc26013632d86142e52f527441569a8e328383a3f8378382c95c", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968338, "uuid": "a0d63149-fc0e-4d27-adba-8dd101e2ee05", "comment": "Malware payload (Amatera)", "value": "75e0571b97ae24efda81d624e67fa4b85070a7f8", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968338, "uuid": "a9a0ddaf-d7d4-4915-ba33-d002639b8ea9", "comment": "Malware payload (Amatera)", "value": "9902d04d63b40047d9f1aff4af07a4402baee82773e31c90f71e51f8f99687e528c635bb00eb859927a127892acafc4e", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968338, "uuid": "f019edec-9a7b-4db4-80e1-c266ef1bb1f9", "value": "T187B612C66FE4956AE4F9433113F24283CA35FCA5963CC39F3489B56A59623D38A39F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968338, "uuid": "a18dbe69-b01e-41d4-adf5-b7e021a4a78f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968338, "uuid": "5d15f7f5-3a19-49ca-ac1f-776c954edf0c", "value": "24576:BAipXj6N8GGrkN5bZTTcHjvz4tK5ghz57m4MCzJECDwHUh8P25yMNlCHIOaet:GiJ6KbGZToHjL4t7zLMCFEgwqcMQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968338, "uuid": "9f61c4fe-bad1-48f2-9a0a-1abbba996f9f", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968338, "uuid": "e036b969-79cf-47e1-81e8-dad314fbfd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968338, "uuid": "fae8b901-5513-429b-afb8-a28b6dc284e3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1a6df2-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995064, "uuid": "6cf55ea4-59fc-42df-abf1-0459e2ff8a53", "comment": "Malware payload (XWorm)", "value": "eb380025c83efa4be7c7e784750bbc34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995064, "uuid": "b9ec41c8-d0c2-4ba4-a52f-92d3c203bcaa", "comment": "Malware payload (XWorm)", "value": "95d136965410802561a6ec442c420279e64e3eb28ce4510eab3c28aa89f586cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995064, "uuid": "7b4efd28-f83a-469b-aabc-2c24e45d325b", "comment": "Malware payload (XWorm)", "value": "67cf4f2879807a9de91901fa099122ba995a0322", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995064, "uuid": "c140af9a-622c-4d35-ba8a-4279ff2dd571", "comment": "Malware payload (XWorm)", "value": "d3dbc47bd32ec0b1fae113a908ea6426203cf3c0bddec5770753b7e2235316a093ef09f5c89ab780851a33762551612d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995064, "uuid": "7731937d-4ef7-46b0-ada1-6c08805da4f6", "value": "T16E633A432C1E39093CC1ABA1BC0543E7CDA35128F6B09B7E47AD964942C5EC3657BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995064, "uuid": "757848da-b491-4e4e-a100-507136a18746", "value": "768:I8w/h62/jWs6oS+xISN0vV3PfnacPkfr8v8upR2SvuwEBIX4I8eqhYdMdcPgbui8:I9l/AoSSMlEusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995064, "uuid": "702468a8-a4aa-4708-8ee7-c9417e3fbd46", "value": 72482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995064, "uuid": "4095a6f4-cb80-478d-94a4-c0f4cd8efd5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995064, "uuid": "95737aeb-10d1-4ac7-b5f3-7dbbf37a93af", "value": "invoice-1645080830.pdf (101).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b509fd34-e4b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767012523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012523, "uuid": "5ca6be15-7d50-4d00-9ab3-bc89e7915425", "comment": "Malware payload (Mirai)", "value": "60c0015215bfc2ea9d4227aa505b5c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012523, "uuid": "227c6577-3213-496e-bd9d-82ba8f0aed37", "comment": "Malware payload (Mirai)", "value": "96633c8e0e988fecbb768c093528e78b0a3765a0f867cd99ea09d716ac6bfbc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012523, "uuid": "2ca13235-1ac8-454f-8674-b34ad800ca9f", "comment": "Malware payload (Mirai)", "value": "e11fc1eb68dc312531dd635120b7607ee04f08bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012523, "uuid": "0875eed9-22dc-46a7-9a05-35cfe581db5d", "comment": "Malware payload (Mirai)", "value": "40edd4ec512d2b1a1f4a117883bb7f114402132f37fd976b8b74cc4d11e9ff34d3c40c993dcad5a82557144d397ab0cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012523, "uuid": "f17c4c6d-91e6-45b6-b687-5af678bdaa5f", "value": "T17A147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012523, "uuid": "ff85eea9-877e-4706-8d14-66a42948e650", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCR3UKG:IcY5JpMByVs9jSWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767012523, "uuid": "4864dfff-4a9b-43c2-959f-35845bdbc6ad", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767012523, "uuid": "1e2eb974-757b-4ca6-8037-e382b689c093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012523, "uuid": "b8c1c1e1-66bf-417e-b8da-810d31ca2777", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d512a0a-e49a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767001209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767001209, "uuid": "ace6991d-08d9-40ef-8bdd-8e004c8fea59", "comment": "Malware payload (Vidar)", "value": "33af33ae47042097543ed5a7b48a9b73", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767001209, "uuid": "864ea924-4251-4e99-8cde-53130b58515c", "comment": "Malware payload (Vidar)", "value": "9737fd429db450e82b1c3725afb1c4dd9719448f8baf1176f57ed8e0750021f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767001209, "uuid": "cb137009-1e2d-4066-841f-7ba22a4f4a2e", "comment": "Malware payload (Vidar)", "value": "7af6f1e30ce150c858a2a1212f102bab9742c02f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767001209, "uuid": "55be90b6-1b82-49b2-a4bf-bb0ae3c6302b", "comment": "Malware payload (Vidar)", "value": "3245a648c05cff0972d45502383ae554ff65141e2344fb2a39c9fee155c08ef4481ffd398fdf9ba23dddf662bd2742b5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767001209, "uuid": "fffc9b15-e51f-4c91-8b7b-9da0a0c4cbc6", "value": "T19D665B92FE445655DA9FE234D8B122552230B068133126D36FFA4BB58D2BBC41B3F72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767001209, "uuid": "2912ad75-1cb8-4e5b-981f-8846ce290b14", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767001209, "uuid": "a35b2be0-3425-4879-b875-52112e74f66f", "value": "49152:xy2lN/0rb/TpvO90dL3BmAFd4A64nsfJNe6BDc58tw4b2Gg6+lFmpqrxgaNLm/Am:xy2vf9S4m9Lm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767001209, "uuid": "bcaed45d-fbe5-4ec1-ac2f-6a6d0dad17f5", "value": 6536832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767001209, "uuid": "5d97173d-845f-4c37-bde1-a4c1d430f06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767001209, "uuid": "a2a34d25-f3ab-4e16-9572-eac92543d649", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1050ca4-e456-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972197, "uuid": "c90a023c-aa1c-4cb5-a9e8-96fdab05a983", "comment": "Malware payload (Mirai)", "value": "9f8595d19dd40c96345aa96f0b436f1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972197, "uuid": "4f2c8556-21fd-4b86-bcd8-a15867c60300", "comment": "Malware payload (Mirai)", "value": "973b32f929dc4babb876f3e4c79561d7863a2de2d635f4810ab37c11da677433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972197, "uuid": "8c360cbc-119b-4b99-97ac-abb03a740e1c", "comment": "Malware payload (Mirai)", "value": "3553ca0d1a38c8608c7852bdd8c931cb07000664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972197, "uuid": "0f8772fd-6385-4181-aa72-bd1c73788a71", "comment": "Malware payload (Mirai)", "value": "aff143e2ea32535590500dfadf4432ae8b9ef77e9a3fe016105c9e0b04be9ef17076e2ba279b51f88ea2056fa5c77233", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972197, "uuid": "b2652896-7054-4a1f-9186-5ca8eea89ec8", "value": "T133435CC9D683D4F8EC160A711037F7339A72E5791179DA83D7A8E937AC61A01EA0739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972197, "uuid": "a7b366ba-6a5c-4c10-8de4-7ca039858324", "value": "1536:B21s9exvRbrVUJoXRSD0+XF4xksYlarvUH6M3GUzP52lmUSvu:B2186vRbrK5/WGsYs8HJ3jj0Qhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972197, "uuid": "332892d7-b958-4d4c-812d-c5b32773cf67", "value": 59548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972197, "uuid": "16f300e8-1940-4eb9-b874-89a183ea7283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972197, "uuid": "544e5d2b-fd27-4e3a-887f-3e87df307ba4", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3839e2f-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971396, "uuid": "9a5a844c-6a3e-4065-af95-9dcf9e10f5b9", "comment": "Malware payload (Mirai)", "value": "a5ffa6036bf41f3359177375b2badd29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971396, "uuid": "443d00f9-8f4b-4fd7-859b-80384d74d2ee", "comment": "Malware payload (Mirai)", "value": "9786a54a0cceac2bac35cbaffa17d8911a98de5bb64bbc9ba37f2110c1be42ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971396, "uuid": "dbb067f3-ed6b-43ad-9546-1eb20e29dcd1", "comment": "Malware payload (Mirai)", "value": "d15650802f22997f6592efb4dbef66fd836d6005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971396, "uuid": "2d918895-304a-4edf-99db-a9e8809a5e31", "comment": "Malware payload (Mirai)", "value": "8278d438305bacab9cd52d4f56b18b6b4a9da3afdd6c6f49f7128fe2e4a7870ab54c88d2febee2d2027b0130f7aac537", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971396, "uuid": "5d2b2cfb-9c15-43f6-896f-53b1e0a88f2f", "value": "T19963199AFD819B11D5C115BAFE0E214E7313073CE3EE72169E24AF34678696B0E3B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971396, "uuid": "5d1fd369-7712-4b65-ac10-55ad6736cea6", "value": "1536:jpn0hNxwDVjwkagKInGrEFgM7ixYfLq7SjB4/VV5JYfjZ3:+hYZjwkapqWYfLq7m4/r/kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971396, "uuid": "f8fab561-cb75-4577-b3b5-5030578f0be8", "value": 73044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971396, "uuid": "f9349881-fae8-4305-ac19-f45f0766ca54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971396, "uuid": "c2da34f2-0efa-437a-9b76-a80a29f1673b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d570501-e4be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016751, "uuid": "d31540ee-8a1c-4b18-ab42-6f22313f27e0", "comment": "Malware payload (Mirai)", "value": "73dce571caacc20aa02569baab5bdc42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016751, "uuid": "e51fb74f-fd56-49d8-822f-42c7545125d6", "comment": "Malware payload (Mirai)", "value": "97dacc0ad0ce77b312630763419a14672cae4675f2f62190583b205c80b2f0e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016751, "uuid": "7f902b49-100f-47ca-b1c8-fd9ad021d500", "comment": "Malware payload (Mirai)", "value": "1acc1ecabb769b9e057f2d6b193f96811941c70c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016751, "uuid": "4e5032ee-49db-43db-a6a1-58494b9f1737", "comment": "Malware payload (Mirai)", "value": "a426f2f21679a563589a9eac9fda396a8068a996e339d205271193707f34f91388470826e3622ba4f0054d63f89ef174", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016751, "uuid": "81473c3c-70b8-4c02-abdf-20ec5e09ded3", "value": "T186B30749FC819B15D5D622BEFA1E118D33135BACE3EE7212DD105B25378A92B0F77602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016751, "uuid": "de77359c-40be-4508-8956-a6ed146395f4", "value": "3072:NOSQFUjHRvZ48wX505AalgR7S3okmYmUAGtOzpgeuQH:NOSQSjHRvZ48wp2AalgR7S3mYeGIzp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016751, "uuid": "2ddb6656-acd1-47f8-a6cf-93e285f71441", "value": 111972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016751, "uuid": "f0c4f2b8-a619-4dc2-ae41-87536b2e9dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016751, "uuid": "c9b597e5-54c2-4717-9b2e-7d94c860a654", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ab7529-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767029786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029786, "uuid": "c8862b32-c2f1-413a-8858-7beb7bd242a4", "comment": "Malware payload (ConnectWise)", "value": "99508d1d13c0fe8aae8ef497f506e444", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029786, "uuid": "3cf2e65f-ef41-468d-9ae4-e475dd75c083", "comment": "Malware payload (ConnectWise)", "value": "98820a8f3173b0a7e3426d008abde6cf3c9d220b40055aa1e7a65b8f264b5c9f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029786, "uuid": "39ca99c8-5918-4154-9c84-ae922dff04ca", "comment": "Malware payload (ConnectWise)", "value": "def9c2c442a37b4b9191407bc7c91be697abf6ac", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029786, "uuid": "b4cb9e3f-0775-4f2b-a12f-b88383b112e3", "comment": "Malware payload (ConnectWise)", "value": "2b217779934cd5cc1b26c9ab44a896d4b4f5121ed60406da8fd8d4c5b6a58ea0a9ea4d296d921648356452a0d118db80", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029786, "uuid": "02374fc9-a887-47b1-a3e1-6f49798e56c5", "value": "T182A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029786, "uuid": "c932f3fd-5654-4b18-8319-b0a99e9fdd3c", "value": "196608:AKaLNkbg1i4QhKaLNkbgRKaLNkbgXKaLNkbg:GWg1iHFWg1WgvWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029786, "uuid": "68dc2e14-41fb-41d9-ab8f-5bc08b9bee1e", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029786, "uuid": "6aca0670-17be-4c41-87c5-6162028a48f3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029786, "uuid": "435bdf2a-44ce-4240-8603-d2dfd1c7bde4", "value": "xmaspartyxx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ecb984-e510-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052036, "uuid": "3ee96476-f50a-4d39-afa1-10998f5802ba", "comment": "Malware payload (Mirai)", "value": "fbb13b75186ddc828d28a4cf7fdda0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052036, "uuid": "9f8dbb3c-e47c-4d28-b632-8ace628fe654", "comment": "Malware payload (Mirai)", "value": "98904d00cc491d95295380acb9ed38c0f438cb8cec720cb7161667128c4dc312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052036, "uuid": "ebcca06c-cd27-4f1b-b9a0-571e892b7fe5", "comment": "Malware payload (Mirai)", "value": "bb70b870d45401e93d2d98788c3cda852c1b8fe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052036, "uuid": "6f6c0db5-e4bc-4894-9703-749dd8662daf", "comment": "Malware payload (Mirai)", "value": "3f78363a9f292ecefb112bb04504ed1496d703481cdccbbef2f3e8f60945f7eed81f92423ab32befee8a89653c8734b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052036, "uuid": "ca77cb43-c3b2-4870-972a-23a07c5e2dca", "value": "T165C31856B8829B20C6C216BBFE4F528E331357ACE3DE72139D185F2427CB55B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052036, "uuid": "a5ab9842-5591-4a9d-86c7-934774bac00b", "value": "3072:p49vMtTCXAvSJj5uL8hhfrVpLpHTXIk1argnGx4e6bYzKQjnT1:ovMt+XAvSB5uL8/fjLpHbIYaTX6bdQH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052036, "uuid": "42a2e2f6-3065-45bb-a000-ca625a57489d", "value": 128136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052036, "uuid": "3ccc39bb-f15f-4476-bac1-19d42ac75ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052036, "uuid": "f0fd5913-5239-40d7-8cf2-5725fb3d32de", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e981dc1-e4f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767042040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042040, "uuid": "3342fbeb-43c1-4ecc-b599-483b1caa089a", "comment": "Malware payload", "value": "330f1523e3671a70684f4f4044ade97f", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042040, "uuid": "85274120-2d24-468c-9c44-99423339da86", "comment": "Malware payload", "value": "9a5409c52b1a4e878ca28c9b1e6292f3bdca1b01f1d98c93ee1c2eab12860799", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042040, "uuid": "d661f5f8-08b3-4457-8dc1-9b957d05975d", "comment": "Malware payload", "value": "18cc8bcf7b970fd7f3438bf5c56fadb0e0d0808f", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042040, "uuid": "d4aa8bd4-642b-4bb7-9beb-cd03e390e66d", "comment": "Malware payload", "value": "1438ad4a6bdbfe3b36d7badca2852d27b220dec99f413e310c6467b8025d66eba24fec6e82735f9b3475fba12c3d86d1", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042040, "uuid": "9aa245f9-219d-400b-8613-0cbc9a234933", "value": "T14A2812A61370F687EA5C1D3E53DDF2A063A4250EC58FD3975E84CCC8926EEE0750AE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042040, "uuid": "4e2e435d-a12e-4aa2-8656-dbeedb74cef2", "value": "786432:3777777777777777777777777777777777777777777777777777777777777773:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767042040, "uuid": "6024c4d3-79e9-43f8-9d57-4d5ca04fc2ef", "value": 97610040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767042040, "uuid": "1940e75c-aa88-4e80-9919-807292fcef27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042040, "uuid": "c5fd4fb3-dcec-4eea-96f4-d6e3458d91fa", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460403c9-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986567, "uuid": "72548a93-2439-4caf-9c3a-53f149fb62ca", "comment": "Malware payload (Mirai)", "value": "1ec316a2853c29bd4a4557ac718eb788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986567, "uuid": "36b5e6d7-9943-4154-ba8d-0c5f050cf129", "comment": "Malware payload (Mirai)", "value": "9a54228b92526b289ff84c173c7308e0a661a3c5501a41bed5da74b056000bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986567, "uuid": "63d363fe-43c3-4e54-85e7-e4d92a07ffcb", "comment": "Malware payload (Mirai)", "value": "301c4c395d45b6454656a4626a125864910757c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986567, "uuid": "bb074d5c-120e-49a3-a10a-3862de6cebb1", "comment": "Malware payload (Mirai)", "value": "18b0963fa7a5a9633b60d484b513a90d0da037ec01917405ffd090005837bc5188e1dfd6a30e8ad7fef1dfeb79d0837f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986567, "uuid": "69ab75db-6e34-48f8-8ee8-3bab8a3679be", "value": "T179E2F1116A1A8579EB308471E0F5818677A51BBC7AFFB0A654B2060DDCC2A4193F1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986567, "uuid": "e3d5e944-41d4-4543-ac69-f52471e730af", "value": "768:wEKkUgXAnURCr6HmDFStmYtDYM9q3UELd6:IkEn7uHEemGYVLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986567, "uuid": "cb7e9f2f-514c-492e-bcd3-88786a111499", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986567, "uuid": "5493ec3a-4ab0-46a7-9c26-b64b16cb152f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986567, "uuid": "c0641897-0a8e-40d5-b655-cc6afacb63e7", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe2fbca-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972410, "uuid": "09f4dba1-7693-44e3-83b3-c24be479ac91", "comment": "Malware payload (Mirai)", "value": "c968cbaaf01e6bfabd0ae0a51ddb9acd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972410, "uuid": "6219408f-9c00-45dc-8493-143dabb18059", "comment": "Malware payload (Mirai)", "value": "9b0e7071f9c7c912699c6ef49307a0c248b2217a89198027a56b99dce50a6878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972410, "uuid": "55d3adf7-68a7-44b0-94a8-999e670161f8", "comment": "Malware payload (Mirai)", "value": "75949d27cd33ab7139d8e4e272cd88af3a002740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972410, "uuid": "9637d6a7-97b8-4398-aa2f-77fd044abab1", "comment": "Malware payload (Mirai)", "value": "0820fe7fcfcb0692072f89951159a68dbece55490dd952ab9b7d2a27d7cf4a0954ddfe90427cb7582a87a82a822ddb2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972410, "uuid": "a120ad60-1947-4695-b825-e7561a7fbbb3", "value": "T1AC935C02731C4947D1A74EB0293F27E093AFA99121E4B789751FAB498271E37648AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972410, "uuid": "bc14b293-396b-4b81-9f6b-539baa869385", "value": "1536:dAMOfEOShc9hgOlRm7g0F6MMMIQmfUnsJrrvYk7yh7uZ7R44:YhzugcyZfxJwk78uZa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972410, "uuid": "339f32fd-5df1-4b42-8fc2-4a3b481877e9", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972410, "uuid": "d4841619-e102-4cc3-ae66-8c0e1e7bfc41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972410, "uuid": "f487e90e-0551-43e5-a337-2a7e9eac4dfe", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cd4753-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766966890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966890, "uuid": "7afb1911-7c1f-4c46-be7c-936507023a17", "comment": "Malware payload", "value": "3697c2642f39e24dc38201302ac438ae", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966890, "uuid": "07366697-2dcb-4b1d-b82b-67336b4c7a4e", "comment": "Malware payload", "value": "9bb26203d336736f8189e65e78f780e1bd0cf8eb7a5214dcf1382cf6a5656a6e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966890, "uuid": "30711cf4-0e0b-4b50-bd98-56758547b933", "comment": "Malware payload", "value": "0422a9182cfe760877dcfd25d0c56c40c1f6ce10", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966890, "uuid": "8a7aeafd-b181-46b9-a282-01713b7d4a20", "comment": "Malware payload", "value": "de3049ee49e0efc0e7e105dbddfdb37cab1ab40b9622826d1e53d245553976084632506d3ff2acfe792d45826cd8019a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966890, "uuid": "fe89bc2f-e7ef-4da9-b246-580566d4377c", "value": "T1C3D19692ADF33518640B906DCBBEB258715990578706CD9CFECC65A8CF0D1A85622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966890, "uuid": "71f57661-315d-4c6c-940c-b3e4323c1508", "value": "96:nOZhI1UhwyIE/CnTK8+t9yile94ewZelHNfGGAvOYHLQc0PWHARG2WAJZ8Ul+DbS:OZ9IE/CTK/3yicYoHsfOBro2Tc/OMSmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966890, "uuid": "4fccd0af-bb4e-4b34-8fd5-053fa85d3753", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966890, "uuid": "857d690b-b080-4dd4-940d-7bc60ca0f3fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966890, "uuid": "20d8b218-d681-490a-8112-fe59008ccc27", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03b608b-e48a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766994556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994556, "uuid": "b1195395-1fcf-4aa0-ae4c-33826299cb46", "comment": "Malware payload (Mirai)", "value": "2d3f96765ab259a35450b209274cbcde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994556, "uuid": "127fbec2-01a0-41d4-b2cd-169b3323a66e", "comment": "Malware payload (Mirai)", "value": "9c0e7a5c5f3bafb9739a9bc4351a6e00204a251396066af13d656cc394d6c2a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994556, "uuid": "69e9ffad-fcc0-4124-bb03-17749fd2103a", "comment": "Malware payload (Mirai)", "value": "5fcc67fddd841f61b5e3eaa9856b2a41e74da086", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994556, "uuid": "58c88906-f846-41b9-94f7-a0fe95585b1b", "comment": "Malware payload (Mirai)", "value": "6587f4f3e492ce9fd2650f38016be58ee6949d090c588e5177b9ea97fcb540c307341d7e31f2550382fa749231633015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994556, "uuid": "67fb8fa3-8113-4363-94e9-d36c7bdc2f16", "value": "T1F2434CC5FA83C9F5EC1601702133FB375E76F2BB125CE953EBA55632B84A202D412A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994556, "uuid": "d37f5fd4-1627-49e8-b6b0-2c4b76d5bf2e", "value": "1536:Kdy235+O5GwkjNJAbO4BwcnX0j944v7F0ACuUfV7HGGMaI:12oOYFjN+bO4Bw6X0jK4x0AlOV7mTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994556, "uuid": "eb7227f3-6537-48ef-9146-9ce50c09cd3b", "value": 59696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994556, "uuid": "92e62eca-1104-4293-8866-0e33f6e8cd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994556, "uuid": "503de314-9269-4536-8ef4-0701028406bc", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce818014-e458-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766973052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973052, "uuid": "5839f241-9582-4c39-86e1-fe14e7545c31", "comment": "Malware payload (Mirai)", "value": "275f22ff618065bbedbb4a82970b1f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973052, "uuid": "9c883eca-bac0-4d9b-a201-253a3843989a", "comment": "Malware payload (Mirai)", "value": "9c8d7d1c637f12158ef54e949e245617c9185b1ceed62a83535f92db622d98c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973052, "uuid": "d9a3f791-9d3f-4a44-9ea8-feddea613c2e", "comment": "Malware payload (Mirai)", "value": "2b91cf047fc38a06c694c6a741969cf538d8cb69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973052, "uuid": "1f7bcdcb-f9cc-4cf6-bf95-2ece90b172e6", "comment": "Malware payload (Mirai)", "value": "741259690efc96d9301b1d6a514f9dcffe510b72115139640f5ecff51ece55fc2cf8520907c650207103cbac3ae0a939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973052, "uuid": "f767d028-d5aa-46f1-ae5e-5b31ecd958e6", "value": "T195737C17B18090FDC8A9E2755BAEB322D977703D5234B22E23C4EE127E5DE212E6D750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973052, "uuid": "6fcab6f4-64fa-45f7-bc9d-5da1414fb32b", "value": "1536:08r8mo6tIjaFsn3eswK8xV2Sgi9/n3ukeRu:amo6tlanqvxVNr9/3uNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766973052, "uuid": "8b3ba90a-c80f-4664-8f95-bb2fc988f361", "value": 77992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766973052, "uuid": "89b698df-3f12-47da-aad7-5375294d315a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973052, "uuid": "ceeb3e9c-d481-4604-b403-b2246ba996f4", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c7c09d-e4af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767010375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010375, "uuid": "8f5ba1ac-a5b1-4aa1-83c4-d7099556b9dc", "comment": "Malware payload", "value": "04479ebc7dc75a81679689b3aea7759b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010375, "uuid": "53bb6b71-4bc7-4da5-a8c7-86add035ae1c", "comment": "Malware payload", "value": "9c9047e05330423431661e477ed299b64cb292eecfe109d92203011288957ae4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010375, "uuid": "1ab33727-6878-44c1-895f-462bc2011055", "comment": "Malware payload", "value": "5a3ab3c7a72d04e652f3ac313af27ba1c52be5c6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010375, "uuid": "993657ba-803d-4075-8f9a-25db5c613327", "comment": "Malware payload", "value": "a29d4cbec3faec6d9a95d75be961993e8f71932d6604c8097b847a82ef4570309493b5c505325ae7fb118ac520644fcd", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010375, "uuid": "e8dc0a1f-b6b3-4255-87fc-c37e1f56657e", "value": "T1EFE1B686ACF32419740B406DCFBEA2587059905B874ACD9CFDCC75A8DF4C2A89622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010375, "uuid": "be340423-28b7-42c6-80ee-6e5665a54f15", "value": "192:OZjIE/CTK/eW9Qbx0llHYoHsfOBro2Tc/O3Smy:Oj/auYoHsfO2/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010375, "uuid": "4838fab9-bca2-41f0-a5b9-62f538a762be", "value": 7373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010375, "uuid": "9088eaed-282f-46f6-bef4-b1b5a2fb9e07", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010375, "uuid": "6bf230f7-a6c7-4066-a976-c521e84f3998", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d6c019-e482-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766991158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991158, "uuid": "46badffc-c8ca-4a9c-980d-5a6496e01a4f", "comment": "Malware payload (Mirai)", "value": "e703e5e5b8d0c328dd137058a740245f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991158, "uuid": "cec6e301-d469-4c02-aec9-06b386bab51e", "comment": "Malware payload (Mirai)", "value": "9cbe1023f4fb427c16e00ee50a6fcc9d43216a2153d4b4e406f06394e32c4a46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991158, "uuid": "ed3238e8-247f-4e66-8970-c41b25f482ef", "comment": "Malware payload (Mirai)", "value": "d4478e7c7e233ff9c89339642115eb28593bd86d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766991158, "uuid": "f8860b94-b38e-455c-9f90-132d3ed4db91", "comment": "Malware payload (Mirai)", "value": "fab2446b18aa4a5719f6097a346de7f709fd4667bc407bb9b427e99b7dc14486fe45ded7ca4cf27d922ef59055a6eb75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991158, "uuid": "f7812a3e-0f74-4d25-92c0-d3cfbe32b580", "value": "T1AE51C2E4E971DEB5395CCD1CB4B8465816821CBD6CED3E08958E6FAB090F68D380E732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991158, "uuid": "129e8f68-5e14-42d4-8d42-fc510e218c73", "value": "24:5puyeyRL/EH2hdOEXTE9ErMb8LALaLILLJi6Bw:xBRbFrMWs/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766991158, "uuid": "ab463d18-46bb-4821-abc2-432e871eb7f3", "value": 2905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766991158, "uuid": "1bca3df9-1999-4a59-a305-56d61ed6d57b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766991158, "uuid": "4b2aaf21-0cbf-48f5-be9f-26784a7ada9f", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbb95cc-e4ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015195, "uuid": "6e0fd59c-8409-4892-9cff-7f257b5bf1d1", "comment": "Malware payload (Mirai)", "value": "52a7fa33b9c7835a418b6c6cb1c0c5e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015195, "uuid": "f95e0158-20b4-4593-9e79-cf2e07953e9e", "comment": "Malware payload (Mirai)", "value": "9cd031f51a24560436b6cf66dbaf4c8bf9386f03d15423ac53100c3e3f5f99a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015195, "uuid": "99515500-a419-46c9-97a8-921d8dc6dbf8", "comment": "Malware payload (Mirai)", "value": "c32534b43bc3d9519aabbf0c81ae168c636ac706", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015195, "uuid": "9179a605-7c4b-47f0-b0a9-e02cca2881e1", "comment": "Malware payload (Mirai)", "value": "97b1d0a84f6d8700dbccf9fe7a8dc714b9e00c29757b19485c7ebace2cbbc9c6da701b3fca5b7d1fbec6aff11efe2919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015195, "uuid": "011cd5e2-2b90-406e-b987-a44ae8f1fbb9", "value": "T1686302CFAEB02F16D0D8E1F1703815D5C93ADDCA9243869D87E1EB960B38527548CB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015195, "uuid": "ff16e23d-1ced-469a-9f1f-9389dd7617d3", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMGaCyCNz:kaxZLmYKX+t08jmeJhYTaxCNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015195, "uuid": "5de9ddbd-0894-4ca9-b73c-0281acd52e50", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015195, "uuid": "059c1cda-fe4e-4c3d-a4aa-58c59643654e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015195, "uuid": "cf1e9d91-81cc-4530-b3f6-0d770dffb603", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea37135-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767017022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "a964d3f9-8ef9-4aba-8493-32801eedc6df", "comment": "Malware payload", "value": "7bcefc98eb6346c0ef74f606fbb1b077", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fvnc", "colour": "#D8229D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "1882f639-4d94-4ae8-8fc2-8ce032bf08fd", "comment": "Malware payload", "value": "9d34cc48602f927f2d23510f2f7cbd1d041945d342d3dcf0773a1b996ca589e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fvnc", "colour": "#D8229D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "e39d08c3-2a48-495b-8596-0f3a541a5264", "comment": "Malware payload", "value": "168413f87aff3b0d46cfde65e9b59090c28315dd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fvnc", "colour": "#D8229D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017022, "uuid": "b7132f3e-a02f-43e2-9579-5b9ed359d3eb", "comment": "Malware payload", "value": "8501a9618297ec6223e3f8310f1814f8f2e14f4179ab7239923ddfacd0ba92d0973286a2ce4d2da85cc563e9c5f7885f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fvnc", "colour": "#D8229D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "8da5356f-24e5-4289-98e9-d4e67b77652e", "value": "T1560723B7EB54A06EC0B6463781B55D2252573D154983EB823D4C722C0BBBADC8F5EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "2f64d1fd-e8f1-4a89-85a1-157d692b2fd9", "value": "393216:++Gjj8f/SXEoRnXOJT95z9MC4ZAECyJxAVEJdzUCIIhqVAixQJc5K:++Am/GxhXYXz+C4ZpnJxpOAiOJmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017022, "uuid": "626bc255-5534-4895-9178-475bdfd6f6dc", "value": 16825579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017022, "uuid": "e9427fa9-0bc8-4d2d-ba0f-fd1dcdad0cc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017022, "uuid": "55608dff-e48c-4578-bc63-362e1317f063", "value": "target.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e657462-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972407, "uuid": "d1f9b34c-b00f-4c5c-996b-4f78fbe680bc", "comment": "Malware payload (Mirai)", "value": "e7e441ef3c395485856f086f40480eef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972407, "uuid": "9e74ec22-dc8e-420c-87a4-b7a06db80e3f", "comment": "Malware payload (Mirai)", "value": "9d98d8821a9ed249e8566fe37f4616b38503de10e03300c749552284f5bf5a6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972407, "uuid": "063cc8cf-967f-41ec-adbc-f920ed4ff174", "comment": "Malware payload (Mirai)", "value": "c7381a577d64488431ea8fc04e1db02e0d945447", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972407, "uuid": "6aa34236-3bb7-4a40-b66a-05bbd606f995", "comment": "Malware payload (Mirai)", "value": "4bb5ccc6ade69532b8593d2745fb306702b424c10ffb60257c9706c4c5b4b119ed0aabd3c5b162b4103ad7f6f218f877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972407, "uuid": "1a399a4f-c063-436a-bb5e-1be73ff88a7f", "value": "T1E3930746BE508E46D6CC46BAFF4E52DC37372394D1DE326B79118B2632EA02A0D2F416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972407, "uuid": "59b6d298-8605-453c-86b4-54dcbe1d96d7", "value": "1536:xSbs9SCOV/33f9GkGyzQoAVWe014ZOhPvD8nF8VR15:xS49rOV3VGkQnV7JgHD8nF65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972407, "uuid": "b4e5934c-df66-4145-97cd-a2c0868cd831", "value": 91312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972407, "uuid": "d7e9775b-1e57-4bac-acad-cce2f42422f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972407, "uuid": "5cf04a97-7854-46fd-8c5f-c05bf8cd38db", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c036487b-e4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031010, "uuid": "bb4365e9-23a1-4d17-b445-b111f1c6702c", "comment": "Malware payload (Mirai)", "value": "1145c5a12d89eedf7d5b209a024dc241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031010, "uuid": "1492bc99-c83a-4c1c-9214-8a23a1865709", "comment": "Malware payload (Mirai)", "value": "9e14dc682acb8a1bb0f132edb1dbec12120f146f74e62fa33ae1f9c361db69da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031010, "uuid": "3e5bf439-9029-4dbd-912a-ab197a988c57", "comment": "Malware payload (Mirai)", "value": "906df63e83d69cd36ad24a9b7643cf56354ff58a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031010, "uuid": "2d3e4383-03c4-48d9-8b4f-9917f32e7638", "comment": "Malware payload (Mirai)", "value": "61b6a7b954f3ae793c8fff2e9ce41d319f3272f1a685472f094d3cc19a8aa3af1245cd22a3e4ca41925f7fa5a2a3378b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031010, "uuid": "d080c850-0f41-4d0b-94f0-9097f8da3fc1", "value": "T1C4D3079AB8819E61C5D256BFFE1F51DD33231BF8E3DE7103ED082B20768691A0A7A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031010, "uuid": "0098b625-ea40-4717-a4e7-4fdb572a88ac", "value": "3072:M5lWtJaIa8DogrfF5R5WG8Bk3Evhe4IbarFXirFnGnd1wn533:M5lWtoIa8Dogrtb5WLuKAHwFyrFS1On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031010, "uuid": "1bb72ebf-c06f-4207-8800-66c58b7bd378", "value": 140020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031010, "uuid": "d060437f-d7a0-4ac9-b4fb-a8aefdc776af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031010, "uuid": "f3a31dfd-817b-43d3-8b6b-ffb03fe751f5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ae1ef9-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982412, "uuid": "94d257c6-6dab-4c44-a998-21cb16d56497", "comment": "Malware payload (SalatStealer)", "value": "7758f5e6cd27bb75a35cc153be3a392e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982412, "uuid": "89ed33cc-9257-472e-91b2-df126b828e4f", "comment": "Malware payload (SalatStealer)", "value": "9e5c83143a160ebb56ba20f6740ab07490412d0b1fb1a9448d544457d567fe52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982412, "uuid": "35608bdd-d512-4bcf-8624-da537f96fcab", "comment": "Malware payload (SalatStealer)", "value": "482c35a74d03d4d81dacd1339485106e78ff033b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982412, "uuid": "29f8cde5-5fda-4eee-8f50-c3f06d29fc91", "comment": "Malware payload (SalatStealer)", "value": "5ebcd01b6f6557399ba1df7d4582a33eae6bd77d02dd162e7f8854ce3ebfc3b5bb0e8468719acb62aed61e3319530979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982412, "uuid": "b32ce088-1311-4052-a6d1-c69814138db2", "value": "T12EC66C41FACB56F5E9034832416BA23F23345D048B28DB9BEB547A3AFC776D21C76609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982412, "uuid": "ed68c71f-06c6-470c-a235-324034388357", "value": "49152:cf7amqIZyPgmOO3SlyWOvdorfU5+iiBiatTzjA1xRA3BINslBLKYZKe0w8+L4bX9:memvQElDzukjvOw34bXhJm0CDaGTewV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982412, "uuid": "679a64b9-8776-4c36-9579-9c013251ab2a", "value": 12091904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982412, "uuid": "1e653439-d778-4238-8c15-a5d97a680895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982412, "uuid": "ec275d00-b727-40b5-ad27-4c5fdcf2d442", "value": "9e5c83143a160ebb56ba20f6740ab07490412d0b1fb1a9448d544457d567fe52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f28104-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966915, "uuid": "aec22730-ac5e-4114-ae35-5d0afe40db87", "comment": "Malware payload (Mirai)", "value": "bde7c939851d5caf1629c0108280b110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966915, "uuid": "92843d57-6e3b-4e36-8e2f-1690f9898997", "comment": "Malware payload (Mirai)", "value": "9e82cff5030303ad84bdc9deb2b3079736898bb16e383038b332dfb53096bf36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966915, "uuid": "cf14f7fd-c44d-4bd7-a87f-572d8afaf33e", "comment": "Malware payload (Mirai)", "value": "e7e2080edddad071c7f3c112addbcf4b45924e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966915, "uuid": "79b68fe7-6b3c-49a6-9352-691b90e5abe2", "comment": "Malware payload (Mirai)", "value": "a4f1958a386f336ae36877da24292a5799de582344f7b01cba346c1fd5e261f373fcd428f05e1a9661b1b21d9eed82a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966915, "uuid": "512c9f34-0b83-4631-ac1d-61eaf7f46667", "value": "T122141942FD418F13C6C722F6FBAE028D37166B6AD2EA7103DD256F6037869DA0D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966915, "uuid": "68a6483d-4705-4816-a6d8-0bc8b1b84a87", "value": "3072:arb2k/WAX1wQOybXf0kOLPH47te257gpdxJ6hh1FJvG:arb2k/WAXZbsNLH4pe67OdYJvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966915, "uuid": "44dabcc2-cbe0-47ce-9dcc-d9b5b6990a81", "value": 196468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966915, "uuid": "975d5e68-a834-4afb-91f9-b61c16d27753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966915, "uuid": "fda0377d-dba8-4a32-95e0-51d6ba6d8ae0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989d70d-e487-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1766993149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993149, "uuid": "53c4958e-d37a-4ce6-9ff8-0e16896f4b94", "comment": "Malware payload (RemcosRAT)", "value": "4eb912e34b20a4072738693336de646e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993149, "uuid": "9784e6f0-7975-40f3-adb6-549d1386ddce", "comment": "Malware payload (RemcosRAT)", "value": "9ee772825bc36fbb26acb6d76e891319a497af10f5ae8e07d8919903350eef2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993149, "uuid": "8ac99d8d-fd78-4c96-83b5-4eea9d592c33", "comment": "Malware payload (RemcosRAT)", "value": "e1f640cb82a4ce260fc9eb657a3cefe391332113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993149, "uuid": "f3904a9e-4ddb-4724-85e0-1b8bb96783eb", "comment": "Malware payload (RemcosRAT)", "value": "b78208951496b9de9727520fc96d7172d9f92517fbcce9a387ca3db1683ebb1ebe11c30a200eb35d7812a3e36b584d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993149, "uuid": "0be371f3-7fe7-46a6-b830-560130d7f3b4", "value": "T1D095F1027292447FC0262D749D6BD7E4582EBE202E2458453BFD99AC8F397613F22ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993149, "uuid": "8f75bf28-1c12-4ad7-a570-04008d205fe4", "value": "1330395e91ea1a294dc2415896cacfe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993149, "uuid": "fadd10ff-2708-4d9d-80cf-dac86a488f08", "value": "24576:t0OQLrVWuCCxyJzG+g3ROEJO+5VcGO2ggNXg8fadwfePkKhDUvX1VZBBiSi:t0Osy0w5GOP8vOUvlbBgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993149, "uuid": "18ea7b37-b0f7-4bd4-8ebb-1aa9e6db11fd", "value": 1948160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993149, "uuid": "b02dc776-adb2-4c47-82c0-9c4a48897094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993149, "uuid": "7690d037-68df-467a-96a6-9ac537da24ee", "value": "SIMTERI CNC-PO TFO011472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd15fe00-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051298, "uuid": "3ce6c843-8a9c-4165-a838-d4d785492a14", "comment": "Malware payload (Mirai)", "value": "05feb71dd04a8c9f24f90582f91e602d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051298, "uuid": "487c0c66-f908-4bb4-ad65-5ded77c4c882", "comment": "Malware payload (Mirai)", "value": "9f8bdb84dc492109558dce79037bd2811d3c6a2833ab870a08e6bdb0a7e3da3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051298, "uuid": "f0572b8b-916a-4a4d-b726-8678970e675a", "comment": "Malware payload (Mirai)", "value": "e0ee8b2752189973d66a761df446715a8cb10cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051298, "uuid": "af773d3d-87d0-4662-abdf-90aaa779e209", "comment": "Malware payload (Mirai)", "value": "4d58c745e9b50fe0f55d1557a34ec9c0ae820680f8a51b68d16002938dad5e8d97c85e233f562e7101a081e73841112d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051298, "uuid": "add7a5f5-7fa5-4de3-ae52-b70f81ba47a5", "value": "T11BC3F663ED66AF1AC517E1F0B1F28E781F42BD2A49571E99A472FAE04143CCCB5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051298, "uuid": "e4970496-7a71-420c-87db-59096c23fca2", "value": "1536:NhMfGdGDwVj+Y9LcrMCbweKL6fE7y6kAsyfSqLe2WspAZx6Gy3:EfGhJcwCqLZUAsA3S2WGAZ0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051298, "uuid": "202d4666-cc05-4ac4-89b4-c3308a46e40d", "value": 123128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051298, "uuid": "2296a3ed-1e39-43e4-98d9-7b7efeefc7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051298, "uuid": "f99fcb54-1f8e-4ea3-a79f-1255a6d99f75", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19bcb16-e4e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767032730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032730, "uuid": "e8840cbd-30e8-489b-be5e-2d5ae7fbfc4f", "comment": "Malware payload (Mirai)", "value": "747e58743f1728b8e9c3d95c5463b761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032730, "uuid": "bd39f99b-df58-4ac5-a428-c2cb045db9c0", "comment": "Malware payload (Mirai)", "value": "9f9dfe5240e1c6986a4a8c87aed607cbccc5e72a435f4c5713c3c320c97b0d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032730, "uuid": "7dee2e93-ce4b-47aa-b7df-79fc3b0b9dc1", "comment": "Malware payload (Mirai)", "value": "90bf82cb9362c2ffa4beacbfecdcc6dff7dacb68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767032730, "uuid": "a513766f-dc1b-4c76-81f3-9e9fed3551f2", "comment": "Malware payload (Mirai)", "value": "0fc415eefbeb7ef010c3b93b0257311194ff91fd567bbcc1f89c0733b62e4a7b04ad4b65438c9c2825cf26bf9b190765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032730, "uuid": "03cf3ed8-2a85-48e1-909d-29fb82a99e4b", "value": "T1D7E3075AF8819F21D5D616BEFA4F519D332317F8E3EE7213ED181B24328691B0E7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032730, "uuid": "ab3f47da-e3cf-450a-814c-1d80d72f2c28", "value": "3072:kP/6ZtFZrj2AEz8wFI+9vkEPTQ3flUdHCrd0Aa5aVOHnrPVBZES0BCwn53e:kX6ZtFZrCAEz8+I+9MEPc3fwHYKAa5a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767032730, "uuid": "26639234-32e2-4000-859b-ec0c85e6581a", "value": 143288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767032730, "uuid": "bbe5c693-d340-4016-9800-001190851c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767032730, "uuid": "879134b1-16cd-4148-9cd3-73c93ef5cfd0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8594679-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767030191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030191, "uuid": "0babd3fd-18ea-4ee4-bded-ae2af226771d", "comment": "Malware payload (Mirai)", "value": "dc5503410c5620dd00f89f0ba2aecc5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030191, "uuid": "793cab4e-5f0c-419d-876a-475a7c0952b2", "comment": "Malware payload (Mirai)", "value": "9fc67596be6e7c24da00bc04b4c19c7194db1298409c28b65373edbe47799bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030191, "uuid": "fb940750-071e-4eb0-ad7a-34263e5a339d", "comment": "Malware payload (Mirai)", "value": "5d9925c0d5691fdbbb58643e41f2f648cf75374a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767030191, "uuid": "b4d787b0-79b7-4ac8-80f7-529f8a5f933f", "comment": "Malware payload (Mirai)", "value": "9f4ca67b1b52a65341989e061a2374788f5798629e6a7e937f21ca0afe838830540808f3cfffac9776c5f3a82646c41c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030191, "uuid": "e53a766b-7ef3-441d-9162-2eae2e45574d", "value": "T1E2C30759BCD29A66C6C356BFFA0F428D333623E8D3DB7103DD185B21368751A0A7B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030191, "uuid": "6ac8e93f-4934-4d2f-8c10-055f2cf91bf7", "value": "3072:HSccdGDdBEHJR5K2IEEn3tjDctvKJLSr1yevC6QxFGErBpLyBV1sn53T:yZdGDdBEHJR5K2Cn3ZnJLS0evTFKpLS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767030191, "uuid": "4525f018-972d-4117-b636-8213ac0ab984", "value": 128180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767030191, "uuid": "17e65690-30b6-4dc4-8793-7556b1ca52f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767030191, "uuid": "5e11fdd0-c9d7-4f43-8466-722fee9201ab", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a859148b-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995321, "uuid": "90d4f037-d31f-4b7f-a21c-5159097b2d75", "comment": "Malware payload (XWorm)", "value": "e7c027f274ac2d3f96202712c19cc245", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995321, "uuid": "ba29a5ff-c530-4fe3-9da4-5d217e80031f", "comment": "Malware payload (XWorm)", "value": "9fd143b96c46d56cf1a8e1675ab16b9b78609be758deaeab4279bc47706891b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995321, "uuid": "c1df0eee-1d9f-4395-9f49-def4683cf808", "comment": "Malware payload (XWorm)", "value": "aafa1ce0d3134ca2222621371d26b2270f9b06db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995321, "uuid": "377a77bb-fa21-4964-aa50-689713ed75cb", "comment": "Malware payload (XWorm)", "value": "7ad0746ba83a5eefddee836d20f1bbd0103177af34a61a9376295784f2502d7dbdd7d172331cff3613fb5e29886ab244", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995321, "uuid": "38dc9640-4405-4779-a295-a8f26a0dd420", "value": "T15F63F9718CDF5203379B86746A6D692AF7E81EFC08049EDE61E1B0F3D15D9323629386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995321, "uuid": "5ce1b907-6656-4a59-b59c-afec025333e9", "value": "768:I8w/h62/jWs6oS+xISN0v5c4A3q500xdCzAwukq0naNCNNBE9lHS16Xv8xR9eXNr:I9l/AoSSMZfwusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995321, "uuid": "77a9db59-e80d-45d9-ac01-2cf88ccb0599", "value": 70561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995321, "uuid": "2c527b34-3495-4149-9825-a9bab4777edc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995321, "uuid": "c41088ce-0d34-4f1a-afef-dfc2ce5548cf", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca31023-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986578, "uuid": "cf2f0b17-045f-4139-bf5b-5a4488f1908f", "comment": "Malware payload (Mirai)", "value": "bdf587d695c75258077cfbe1648c45c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986578, "uuid": "ad01ccfb-e546-4f88-aa91-6331fbbc4541", "comment": "Malware payload (Mirai)", "value": "a00916cbc136f17ed403d503fb6f809711966a2607dd9a8dbbfa2afec1d8daa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986578, "uuid": "f9ac98e5-9269-4c8b-a435-690d3455ead1", "comment": "Malware payload (Mirai)", "value": "f8f1feb8fbe9e425db0c0bc0b68b4d8e9a3ab7f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986578, "uuid": "84db78cc-f1a6-42be-9112-0d4d55d38900", "comment": "Malware payload (Mirai)", "value": "f8421daace5fa28fd861055d9a4d72ff1d9db8e4acd486eef76d7dac0651d747aa5a35397eb721449c3f75f38507a144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986578, "uuid": "9141d4a1-69d8-48f0-ac65-f8c40d3720c7", "value": "T15AD2E07C7B0149D7CAAFA1B84DD50B262D608FA2F0426C077564D9D7BB098AD2CB5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986578, "uuid": "55643667-d6eb-4ac6-a480-f25a7621876c", "value": "768:z4ylAtv6pqLJM0RXaxGyUbXtheU/S/i9+JgGlzDpbuR1JiX:cMBqTRXa+Zhr/KZVJuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986578, "uuid": "451183fc-9ee2-4d62-a12b-5762c9c36291", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986578, "uuid": "57ff8e70-18aa-4bc4-9bc9-a2e3d3f2fdd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986578, "uuid": "0ca52145-5e09-4756-8731-b8fa5e84daf8", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dcd34d-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966887, "uuid": "33944255-bb3c-4e3f-b1ad-6662513c8354", "comment": "Malware payload (Mirai)", "value": "eb05c846395d82eb234111b5aa20aef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966887, "uuid": "abbe6285-855f-4f4c-8e60-a9ef3da20518", "comment": "Malware payload (Mirai)", "value": "a01fb8d9b4ca60dcd0317299fda22eecb6f9844217baa3c7ea6bead6194f05d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966887, "uuid": "ce9fd8f0-7237-4715-945a-132c6dd19056", "comment": "Malware payload (Mirai)", "value": "b35d8be7cf7535064d85c4122f8ca3c762301d7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966887, "uuid": "591fb5db-5e27-4e20-903a-18dbddec1c45", "comment": "Malware payload (Mirai)", "value": "a60ef483812338557d3e4ae9c82a477ed3220430e2b3454ff1369dfae9807b35274ae9852f227f850bb1f69c494f6448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966887, "uuid": "da15b4b8-5488-4357-a580-73c835fd517e", "value": "T131835D42B31C0A47D1675DB4293F57E093AFE99011E4BB85740F9B9A8272F33548AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966887, "uuid": "42b0dbe2-ab4b-4c46-a4f4-ef889ece2cda", "value": "1536:JpTlQ6VK1s0fzOz6wV8M4kFz/ZLItI+MliuZ7R3s:tbkzOzXFlL4XuZds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966887, "uuid": "86b0096f-3d6c-45b5-ae80-a7bdadb08f0c", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966887, "uuid": "7d336ee1-3611-4d5a-91dd-a1d830a2fc3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966887, "uuid": "4133c5ef-752f-4aff-90f1-c62552d0e0d0", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f45cc3-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767026463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026463, "uuid": "a1e6fbe1-aab0-4834-9124-057793f92594", "comment": "Malware payload", "value": "7a2c29edf49ae73cf0afbca39e15d44c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026463, "uuid": "1706ce34-a05c-4ad4-bd40-a87213f52370", "comment": "Malware payload", "value": "a021bc2f9ab402a28206003582e59c15e34d40662e2895ea25f5ab3059e8569e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026463, "uuid": "9abe88c0-f1eb-4225-a022-575d43481971", "comment": "Malware payload", "value": "8ab034cd9faf5369e5f5c526509485fbb0dcb664", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026463, "uuid": "3dbb1ebd-ed9e-49ed-b9ee-68bd3510b992", "comment": "Malware payload", "value": "e87b68970866542b26a08c2e61e910a9cb0d0ad1fc407b1ce646b4786bdedc0fbfb61dbe24fc1b1ca54e2b884ffb18da", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026463, "uuid": "8cdeb6de-b08d-433a-8d59-d3755ba870b2", "value": "T106E1D796ACF324187417905DCFBEA25870699057470ACD9CFECC65A8DF0D2A49622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026463, "uuid": "0981b32f-a413-472b-bc0b-bbfe437cbafd", "value": "192:OZlIE/CTK/eVW0llHYoHsfOBro2Tc/OjSmy:OV/AYoHsfO2/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026463, "uuid": "0c0914ea-00eb-4d94-9b4c-15601b56b13d", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026463, "uuid": "d10d1ea9-66ab-4844-8935-d709755dd9ca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026463, "uuid": "e0884d5c-7c30-4ae4-b313-92432e6f2e7f", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1642c245-e4fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767042321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042321, "uuid": "421f9f01-b8d8-4ea8-9018-3a8c74c1495b", "comment": "Malware payload", "value": "0e2e4b0e8e0912c829e37b0ca8de644f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042321, "uuid": "537a9288-759f-4345-a4b6-19fbe7786476", "comment": "Malware payload", "value": "a0286479847a9b004f167b912d00232fda2dea6127227901aa7ad7571345a1c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042321, "uuid": "76d7b81e-4c41-40c3-aa74-ee8e44cc1be1", "comment": "Malware payload", "value": "4e8e56688137adb4621759280282e3716df7238a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767042321, "uuid": "a3bb38cd-5bda-4b9c-b4c1-8fe077180970", "comment": "Malware payload", "value": "ce68c2091894e7a2c0cc72f59da7b6226ade9d5e71ebd16720932874c47f21bedcf982e11e0f8e90d0661b50e081b531", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042321, "uuid": "ab5c49a7-20d6-4143-b06b-3b109b10b82a", "value": "T118C6235791C592E8C4D38B44768B12DE75D0B24E81FE891D3ACB3C03B631D6B468EAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042321, "uuid": "90359cb8-01ef-4d85-80d0-c9e68f63885b", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042321, "uuid": "10c57d83-532e-430d-929f-da9ae9a25e59", "value": "196608:3WSwwQr/g7+I8iI/mTvGp66PO+WQMefupv5uX19QqgXiGCIuO8uxwa:mjwQr/y+I8iI/mTf6GIMe9kz9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767042321, "uuid": "bd605e4c-7629-4475-b69b-8f5f4bb57eec", "value": 12276224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767042321, "uuid": "65bb0813-1730-4578-9df3-63ce86be9885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767042321, "uuid": "153a02b9-794b-49c2-8810-727f1daec5b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768f9ca9-e4eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767036040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036040, "uuid": "4e6e9a63-d9cc-4c6e-b6a8-82d321b3b5b7", "comment": "Malware payload (Mirai)", "value": "f3a8598f6b6bf244b26e9567036bac19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036040, "uuid": "49430d68-08ab-4fff-a690-e56838e07cea", "comment": "Malware payload (Mirai)", "value": "a03f0946e0bec52b4960803a7f9d278881a4add6fb7a56e554971737f392210b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036040, "uuid": "5d38fc89-3d70-43ed-9cf5-2d60c4168463", "comment": "Malware payload (Mirai)", "value": "909fda626f854c2813276873d8577f54e54d3b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767036040, "uuid": "86b0a92e-8a8b-42a9-a153-8a0eb326fc38", "comment": "Malware payload (Mirai)", "value": "a10d26894654d79611041480bea61e782ceeaff1d9d576d6e44c477ac83fd2341373e63e896203a5f159d0024786ddbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036040, "uuid": "f6535096-2913-4c56-952c-89d6f7355cb6", "value": "T10713F989BC91CA56CAC55577FF0F42DC372603A8E2EE73039E14AF557A5F82B0A2B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036040, "uuid": "f631dcd8-9178-4fc2-bcd9-656c9c927e0a", "value": "768:o2Oyj4HqRoDJWb7XlVXmNwwF2iMMCHUr5tu+7Rj:lO+YDMPV9wnph9tu+7Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767036040, "uuid": "46998061-8079-4f10-8ff4-65d11adedf83", "value": 42500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767036040, "uuid": "59b65ead-a8d5-4843-b70b-c10e0cc4c7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767036040, "uuid": "85a0c5c5-906f-48b5-9941-5a8514052710", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e37182c-e468-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766979708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979708, "uuid": "1597d4c4-2e0f-4661-aba6-773f77c64368", "comment": "Malware payload (SalatStealer)", "value": "563327019470ea5aed4966090b592031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979708, "uuid": "a1a00d8e-25ed-4c76-b216-8aa68d5d5ff4", "comment": "Malware payload (SalatStealer)", "value": "a092a48ed5dfd788f790d6f58a830c2d0f45bc91409236570505920203982c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979708, "uuid": "4c0d2fba-1ad9-442d-97dc-a20aef6ec949", "comment": "Malware payload (SalatStealer)", "value": "15d92aa4256ecdc96ad7527da3c451d8d9c3ecdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979708, "uuid": "0dc3580e-2847-4840-b99d-34e07b3de88c", "comment": "Malware payload (SalatStealer)", "value": "67198fc6cc3f154f67d21c7ad23c37153cf321f7ace11d6c3ab9fe802739616ac3cd9265eb6f56ecdbf374130e48d1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979708, "uuid": "6b45a0fc-40f3-415c-8603-bc49d342706d", "value": "T1E9E533ABCB1EB8D6C6818EF9DA049769BE4DEB0441D829CD7DE2399F80521CF32641D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979708, "uuid": "15662bd4-b1f3-46a0-b4d3-e5042ef30526", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979708, "uuid": "196ee85c-7c7b-4da7-b852-60678a462903", "value": "49152:A09iqybf3VbC0WKf/0lE6+WoS21r3OMq74IvsrxcbJx5sbmoAU1CW1EfFoglECb0:AJvFbnWKfij+rSa9q74JN2JYLDEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979708, "uuid": "d30e5344-26f8-4a5c-b87b-be13932123af", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979708, "uuid": "bc98aa86-c3f2-430c-ac17-7133e9b916ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979708, "uuid": "7f1ac3b6-f116-41a1-8c91-3077aed018fe", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a33306-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986813, "uuid": "5001f47e-336d-4025-a6a8-ac5c45371438", "comment": "Malware payload (Mirai)", "value": "d90272218c4bfb2cc541a9c1df7a27aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986813, "uuid": "3f6a8830-4a75-46e1-98ea-be3690855ca1", "comment": "Malware payload (Mirai)", "value": "a09d0d13267f86cf54c1c15f3a23fb75ed9f4b2c023ef2b1ac4ca2890e2de06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986813, "uuid": "ded5ebb2-c4fb-4f50-9c06-e2baa4f9826b", "comment": "Malware payload (Mirai)", "value": "611585dca7ace53e15fc9f0a36b286e66081a5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986813, "uuid": "6830a535-d190-4cd8-973e-117e2137925b", "comment": "Malware payload (Mirai)", "value": "be18725b19a9e1b89445b75d8530ace7ba465325f179a82399944761639e6f76ce0d33abfac07f641fb49614b82f3c4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986813, "uuid": "68b29035-4915-49b4-bed8-ba47bebe50f3", "value": "T16D333C0273280E47E1561EF0393F27E193AED9A121E4F189790FDB468576E37069AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986813, "uuid": "bf2c8558-ab48-43b3-b55a-759eebd92eb9", "value": "1536:m+ynTTROfP5arc4L4Kz4JseRDFS1SbY9L:ZyTTAJYGKUJhFeSbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986813, "uuid": "fe81353d-1222-4f51-bb5f-0c2930766c53", "value": 54340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986813, "uuid": "d6b78257-8ec3-4cf5-998a-2297bea2f183", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986813, "uuid": "518519db-ef07-48ac-a548-cb0929089e2d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dddb50-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968954, "uuid": "49114737-8c44-4d92-ade5-74d81f5e7695", "comment": "Malware payload (Mirai)", "value": "8ce6a9e49005e4d8122b859edf89edde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968954, "uuid": "e7690d7e-f6aa-4928-bd8b-f7b06462d525", "comment": "Malware payload (Mirai)", "value": "a0a8f7f11c5a0262184c475ff0722adb098c8b1229a8529d21bc7075e43b7f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968954, "uuid": "72ecc968-7b25-488f-bf73-c907f0349ca8", "comment": "Malware payload (Mirai)", "value": "bb74c949fec8251283a2befe1e6574b62f5aea75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968954, "uuid": "420b6888-e9c1-4d89-bba6-a0e5ce13f425", "comment": "Malware payload (Mirai)", "value": "62985981e096e2997ee35d730462d637add1471005ec8f7ec485bbd8c6c96c0922c475e1b090267cb26e431791883d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968954, "uuid": "914fa8dc-75ee-4bac-a03a-b55a745c5df0", "value": "T10B935C02731C4947D1A74EB0293F27E093AEA99121F4BB85751FAB4A82B1F375486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968954, "uuid": "b22e3aef-d6b5-4b11-9cfa-bbefaad218a0", "value": "1536:Ox8fJzJ265lLYhyKHtASe6TTXY4WfmnsJD7XBhBluZ7RzD4:FFVmNgC+f7JZFuZ1D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968954, "uuid": "722be331-b0ab-4d8b-9678-822dc91772fc", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968954, "uuid": "2e1d4754-5c5f-4659-8472-28b16eb58eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968954, "uuid": "ea85f55f-b610-4334-9e68-7b4c01a72e5e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e50c79e-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995519, "uuid": "4d440371-2fe2-4180-89d3-eb1bbfb8fc03", "comment": "Malware payload (XWorm)", "value": "2e961e2110cc6287a288ab3503e94bb9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995519, "uuid": "58ace5f6-0b60-44e7-aac4-84e52c27572a", "comment": "Malware payload (XWorm)", "value": "a0e2554123156c8a1b8941caacf61d04b631fe9f7e7084c020189a3440c5052e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995519, "uuid": "3233f326-b220-4c55-a913-0abf78e5e2cf", "comment": "Malware payload (XWorm)", "value": "d448a1f2957d963e124fcb1480088f75d5198d2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995519, "uuid": "1f10db38-bf68-4b67-a3bb-9da0d281e2d2", "comment": "Malware payload (XWorm)", "value": "bb8ab775fb7d43182e7c4a7fb2148abc8c0f6adc554e2559eca9793c362afca55cf492ef434d273f32681769a15a3a32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995519, "uuid": "d9a49f5a-500b-4f84-854d-621c8fc9f531", "value": "T1BA630A1B285A29BC990C6159DF102BEF3810DD68D47FEB90DA68B25EFCA058C7FD0D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995519, "uuid": "74bcf298-d1ae-4136-a800-8902128cc93c", "value": "1536:I9l/AoSSMCJDefns+4Xa8sQzTZmP5kG+LSPYXy7flgIlxbQJtGzSeHQD5k4JWbWi:I9l/5MCJDePs+4Xa8sQzTZmP5kG+LSP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995519, "uuid": "4121faad-967b-453c-a66b-076b56dad4cc", "value": 72595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995519, "uuid": "1dc91371-4229-41cc-ab74-34d8a89dbcb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995519, "uuid": "6f72e5eb-e3d5-47dc-b724-ed038ab4382f", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13589976-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051336, "uuid": "088b6c91-6d38-491a-b082-f0736955fc03", "comment": "Malware payload (Mirai)", "value": "827ac85acf8b972f94345b3f3cbc9987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051336, "uuid": "f7317f4a-216a-466e-bb55-247963be93a8", "comment": "Malware payload (Mirai)", "value": "a132d8d2815a09af9f8ea58cb394baba7c153d8a00486581da58b561afae50e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051336, "uuid": "c69e7be0-a005-42cc-8be0-49f5b1f23871", "comment": "Malware payload (Mirai)", "value": "05a6e14b223690ed20203edcbb618d7535860be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051336, "uuid": "63d6bf37-9833-4825-9092-e2d90eb481c5", "comment": "Malware payload (Mirai)", "value": "0044fa1ec32a3172fe4e3bbbac34b26699de461000ac91522951b6ff8c542784534f3e606287e0ba1390fc4b490aeae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051336, "uuid": "24e61792-0d65-47a0-860c-d24d55bac37f", "value": "T1E9045B02731C0D47D2672EF0363F27D183EFC9A225E4FA85655F9A8A8271D36158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051336, "uuid": "fd8ea055-60d1-4fc6-b280-75f7d62068bf", "value": "3072:IOY7KnivZxwse/5CW+yQuGlQeZ6hh1Do/:IOuaUZx2hCW+yQllgo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051336, "uuid": "31d6ba51-69bf-48da-acf5-834a3caa13b8", "value": 188316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051336, "uuid": "ae010d46-171c-4676-9dd5-042cffc3698a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051336, "uuid": "6bea281f-6414-4350-9bb6-6e83b3dd3a99", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b1e01a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995335, "uuid": "e6a49099-4771-4693-b439-c85f4df30edb", "comment": "Malware payload (XWorm)", "value": "86f9aadf31bafd360eaf099bc0bbaf12", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995335, "uuid": "7d720639-0904-4521-88aa-bc51baa80762", "comment": "Malware payload (XWorm)", "value": "a1623bdcf996932658a240c679cb44acb939603ba48f621ce8250d7fb25e2a2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995335, "uuid": "ecf3fa60-cf11-4d61-91e0-d891838a289e", "comment": "Malware payload (XWorm)", "value": "c19651773c006ab2db8e06246638d9185b96124f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995335, "uuid": "4e9a0d09-c313-473c-9cac-03e62de3b536", "comment": "Malware payload (XWorm)", "value": "209574d25d78db1a5b1d898de24157e042b14abb165f9ed4b337fc1d8b89f421b10205e86cb9601b0afc24450c857889", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995335, "uuid": "42bb36da-4d23-4b29-b61c-20ba24406412", "value": "T11E734BC40DB7ECA82F73C155B95C276130AAF479CDB886D6BE62F06BDB14012839B91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995335, "uuid": "a2c46ce6-6661-4c3d-9342-41460d7af761", "value": "768:I8w/h62/jWs6oS+xISN0vC7q7578t7Zt777X7h7/7F71767T7D797N7s7Q7c7Z7C:I9l/AoSSM9QusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995335, "uuid": "b65131e7-2e6f-40f1-a766-851ad44368cf", "value": 75341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995335, "uuid": "0153a3f6-55a1-4acf-8074-b0b07964889d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995335, "uuid": "2ab35cf8-3399-45c5-be94-36be0334ba0f", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8614d9-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995463, "uuid": "ed352397-48cd-494b-ab3f-d36c890c5f58", "comment": "Malware payload (XWorm)", "value": "3f74e6dacc073ec9cbb9df72cb1442dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995463, "uuid": "71fd5f94-d1b0-4557-b5d8-530b183bcf08", "comment": "Malware payload (XWorm)", "value": "a227559911c60206163ca237ee634e722be7424f8e3d13cf228ad106e4a32e71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995463, "uuid": "4f1ae7c0-4094-4f6c-a728-603c30189621", "comment": "Malware payload (XWorm)", "value": "ac7bbbc99c12d3f300788c1ade6518abf1ca1a28", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995463, "uuid": "af3824da-97a9-4d0b-b01f-672f9b3339eb", "comment": "Malware payload (XWorm)", "value": "b387c78441b86b5d6f984a844c22a53c35bf17a308282842d55e778cfe679aaf794498ad208dcfb90024515310c3c07d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995463, "uuid": "587c92cd-dc76-44d2-a743-3d475e265415", "value": "T16E731994FEBB600729F8E1F9B26F60822BD114DF860F3D434E899625E651D234FB1E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995463, "uuid": "b08f349b-38cc-4110-bdc1-e95dc520e4c1", "value": "768:I8w/h62/jWs6oS+xISN0vUyvyFyOy/yzyAyqy4yoy8yyy68ydySy+yOy6yKyOyTR:I9l/AoSSMc7usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995463, "uuid": "8d9d7756-8a33-43da-b039-c7319af2c932", "value": 75349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995463, "uuid": "1f322f35-c9ae-4f89-8aec-cb2fc3fd18cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995463, "uuid": "523a05d7-7da8-4b5e-b715-06291365b4de", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026d0af0-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995473, "uuid": "6b5831e9-a152-4704-8e31-8edaa1e2b15a", "comment": "Malware payload (XWorm)", "value": "36e531fbc94a23225835dc9142cc3e08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995473, "uuid": "6ea9a451-f940-49af-8e1d-0d9fbdeeaf87", "comment": "Malware payload (XWorm)", "value": "a25c6dbddadf1a23e79dc89c3c838bd3f63efa5e3b763a1908ecb29362ab4eff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995473, "uuid": "2ff15c7f-5885-4b0d-bfad-8635168b025f", "comment": "Malware payload (XWorm)", "value": "32796ba5b56a82f9044e7df6ada8378001facafd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995473, "uuid": "87a71990-f49d-4e17-b7dd-24cc10195810", "comment": "Malware payload (XWorm)", "value": "a4a51f0b64ce4e17b52e73463597f0376203b59af0bd7712be3dcd672c20b1c95f08150178f582f694f102b960cfec30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995473, "uuid": "ac63efff-bf41-4533-b378-f2d8e57ee256", "value": "T165634D708DD2BDCF51DA22B2CB9F0896FC76E44CA1B194E5ABF57E648E8C0A340075B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995473, "uuid": "b634b93c-8c4e-4bac-8674-2bca2eb2b4fd", "value": "768:I8w/h62/jWs6oS+xISN0v4K1Fi5MgpS2zsPvolP58fN01Nxl2MzYx0SoEOQPWMGn:I9l/AoSSMR9usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995473, "uuid": "e4c07ce2-250d-473b-bafc-08a09cfd3529", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995473, "uuid": "42f2ba74-dba7-46c7-b2da-02cad0dd155a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995473, "uuid": "a2f3a2d6-d461-4a8a-a08f-31dd93b7ada9", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f560cb-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971809, "uuid": "963b1a5d-4ad8-4543-95ac-bff92f23864e", "comment": "Malware payload (Mirai)", "value": "6c66f2573ac6940a27eb87e4e3742b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971809, "uuid": "d7d28e20-8256-4125-9edd-c88190e11566", "comment": "Malware payload (Mirai)", "value": "a2c495ce4eeb77d382ef367dd8d533fd4575bd875052636bfea8de4770ab40bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971809, "uuid": "4599fd50-5cf3-4bec-8c14-c16fb7b67ed9", "comment": "Malware payload (Mirai)", "value": "428ec950adef43d353a244c1102ce2bd4a297a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971809, "uuid": "fbd3cf7f-2fa0-4c5d-8cc5-95a63e02fcf8", "comment": "Malware payload (Mirai)", "value": "19f93c3a7eb085068ea993abe8763deef964e7c96c54835a8d0cf678eb951af7c5e0f7dd6d6331dda81529dba4f19b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971809, "uuid": "8eebd769-7020-4e7a-bc63-7f23ea41a4ec", "value": "T1D4D3BFE7724B5411C46106F04BD38F8D3BA362128E1BC9FB2E1DA63F28B95CB59467D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971809, "uuid": "1b740fd3-00c2-4b84-98ec-305c9a98d09e", "value": "1536:qWKu19vS8f8jofUS9BF0aMgvyiQuWTmSaYbHm28IlzChKMUUkxGlP6gKnI/LW/:qk1k8PUMBaiQnqkn8IiKMUUigKnIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971809, "uuid": "6e71ace3-92dd-416b-a0aa-f2b11c5a6718", "value": 132492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971809, "uuid": "5767f19c-d7fa-4c61-9b3b-ec25ff7d5cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971809, "uuid": "a0fafb9e-e699-4f1e-a043-c42a040b31bf", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7f48bd-e4e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767034975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034975, "uuid": "4c0a468e-b32a-450d-970b-f6c497a6b1e7", "comment": "Malware payload", "value": "f6c39dff2c75510af302d84e298f90c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034975, "uuid": "47d19333-548d-4a8e-91c2-f23b587ee536", "comment": "Malware payload", "value": "a31985bea0c927b5f3a00fe311b2673c3d2517384275bb01951a4f7337edaa54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034975, "uuid": "818a3e0c-e197-470c-b612-b0da22443542", "comment": "Malware payload", "value": "5783245cd0937bfb7625ffa1298f9dd18df2cd5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034975, "uuid": "a1e3f568-4d00-4e91-827e-9d86b67a025c", "comment": "Malware payload", "value": "3d2e23a11a78d1c2289445ce7767f3aaf19226d94ea76049098bedd9056a59e06007ce814be9d52e61600ae5a459664b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034975, "uuid": "bea00a10-09aa-4399-888c-aac630648b49", "value": "T15A373321B155C032D85221F2A928BFBBA69D98344B7119D773EC5F299B301C33B36E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034975, "uuid": "7f5c8967-dd5e-47f1-b67b-2e58924d9b16", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034975, "uuid": "0eae5fb2-9175-47e7-9811-9623a970aeab", "value": "393216:fUCnUEBz6o1cXTQPw1OP15IP8EH5egBMYjZSteu26Gg8Lxiy8zgvXw1TT+WYN:hnUYSsPly887otT2zg1WvXw1TT+WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034975, "uuid": "f4db6068-d98f-4f63-8749-99d902a02eaf", "value": 24444392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034975, "uuid": "ae60b743-063d-469c-a10a-b967a6ffbed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034975, "uuid": "6948a5ef-fa9f-44b0-909c-26a29238177d", "value": "Certificate_Official_Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17cd59f-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026234, "uuid": "eeb3e0af-e916-4a33-9de0-882bb7c041d0", "comment": "Malware payload (Mirai)", "value": "5ffec220afaf65de84d33ce99d63763e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026234, "uuid": "ddc63411-ad47-4350-9d75-1fa82a84525b", "comment": "Malware payload (Mirai)", "value": "a3c090e70926ebd0e5319db0549fa8c1f96946111867c0d0c37906642cd298f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026234, "uuid": "191e3821-85f6-49ed-9a42-69bcdd2e4342", "comment": "Malware payload (Mirai)", "value": "3c2e9f7d0e14e5fdeaafe44f668da43082506677", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026234, "uuid": "e986f4b3-62bb-4dde-91da-71b175824e2b", "comment": "Malware payload (Mirai)", "value": "16bb1580c0a2e8eb318336bf936b33083d6cd628f1cff0b236256320b2795027a5759189968f800f7e092c880761af4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026234, "uuid": "e7c1cb9f-ee2f-4c60-b0f2-3fa5b4727650", "value": "T127043B01B71C0947E2622EF0363F17E1D3EFDA9221A4F644790FAA8991B1D375986DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026234, "uuid": "1eb9c225-fcc6-4490-af86-cf062aece00a", "value": "3072:1zzvoa6zaDd6RxtIpJHc4WIjSdp2KK+es:1P0RxtIpRc4WIjmgEes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026234, "uuid": "cd001fe3-5fde-484d-9fa7-029f60859324", "value": 173780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026234, "uuid": "f59d24a9-ad63-4db4-a96a-4df95291b18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026234, "uuid": "6efc3c96-cf68-4bec-b93b-02ba497f8a37", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df522a76-e4ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035786, "uuid": "ee7aabdf-db39-4d72-9e0a-6cecbb42238a", "comment": "Malware payload (Mirai)", "value": "f3c75b59f6553ec9a4cc1e7f733a142e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035786, "uuid": "c8341587-517d-4616-88cc-a95fe8eec425", "comment": "Malware payload (Mirai)", "value": "a3ed9b55c0cae326ba1e493ca5d7080974996632894070846a4dc8699ca27e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035786, "uuid": "751ed402-e33f-4efb-a839-5627c8c33116", "comment": "Malware payload (Mirai)", "value": "baa6e1f820ac50374c802bd9e75024b258708115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035786, "uuid": "f0fdb04b-a33e-4b25-810b-825c233d1826", "comment": "Malware payload (Mirai)", "value": "ee2ec6b0d525e90c3e64dac8a1966a2a1525d26332d3590f43526d11f22922d59f37660c45002432b17f0b42bb490fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035786, "uuid": "7ff41dd8-7591-4d70-9d94-2108e09a2ce7", "value": "T1E6630276F2307FABF3727CB16EA54ACB73941D327630DDB178E95A00835A10461A86ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035786, "uuid": "273aa3ef-a9b7-42d0-92f7-4f70ae4f36ec", "value": "1536:bBce6go4TQtp8+7u282ExonpdCqARPR3t1fdl9z4u+qgw095:bBce6go4yz+fonp2RPhrfdl9z4u+qgwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035786, "uuid": "05acb5f0-5e9d-40f3-846e-7da7bddf50a5", "value": 68324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035786, "uuid": "ba08bf82-245a-4d82-86e4-cb94f468be60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035786, "uuid": "ef22e377-316a-435d-b2a2-e2b0438020c8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a2c488-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967240, "uuid": "49519af4-bd63-49c0-b877-7ae95a5ec8be", "comment": "Malware payload (Mirai)", "value": "cf5e9e983713530e1ecc2a6c2a575ab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967240, "uuid": "3a7a4edc-147f-40ef-af31-7010c68186ab", "comment": "Malware payload (Mirai)", "value": "a47297a68aa15b46775c4286a2395013fee88f70e9313c3bb3d3eca26198f93a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967240, "uuid": "dce0959e-a877-414e-ba4c-a7c34aa7cacd", "comment": "Malware payload (Mirai)", "value": "a1fb29042bb42eee6023d9400bdb598bf571a4ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967240, "uuid": "f652be8a-3a3a-4e7b-8eef-0631fe58b1e0", "comment": "Malware payload (Mirai)", "value": "170dab365556f7c5fff6e9608a4f82f0d3d3dda3d125901cd83847f60fc848e37f19beb5d63574fad9a75d04367947ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967240, "uuid": "e487d48c-932d-475e-88e4-87c0e9e6760b", "value": "T12E93B50E7E72DFBDF66C833547B78B20975863D627E09685D2ACE6001E6034E641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967240, "uuid": "76a7f05f-a5da-4118-85f2-a976ef846fd6", "value": "1536:nCckbnDGxCmPH792xKijBL1Gvu6IiZqSv5foeT9jK80/uuZ7Rr8A:0bwCmPHkxKijBEvu6IinR+H/uuZ1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967240, "uuid": "39b0fe35-2e3d-431b-8272-a1a32e77197f", "value": 94204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967240, "uuid": "1fab8c9f-eb18-4faf-ab60-c600c84c561e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967240, "uuid": "4edb17de-5c6c-4698-8b6c-d0220174a249", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc63f14-e4b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767010635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010635, "uuid": "474e7e0e-d9fe-449d-a2f2-7171192cab35", "comment": "Malware payload (Mirai)", "value": "8567efaf9fe52bbccc7cdede05d17167", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010635, "uuid": "020f1a34-5cce-4e07-8043-fc6a00626b92", "comment": "Malware payload (Mirai)", "value": "a49341196360e5bfc4fe30a8ff93bafc8d3016d8ce0b5e9caee0f93a44634734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010635, "uuid": "b3fa1437-f05c-4a43-ae03-708a6946dbb7", "comment": "Malware payload (Mirai)", "value": "ea44e3e9eee04b740eafd1c6449b45bd861f4d4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767010635, "uuid": "0eac4427-2085-4f7e-b6ee-94db48aea983", "comment": "Malware payload (Mirai)", "value": "96d74488d2dd12261c321041b58ae606012cd21d8efa605ec431cf0c1c2e5baf7f3103930f521d5d4762add914a5862f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010635, "uuid": "2310fb78-c9b6-4b62-b2bb-6d6c667726af", "value": "T122F3D80AAF620FB7DC6BDD7302E90A1138CCB81726A53B757534E924F60A58B59D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010635, "uuid": "dc99c947-c6e1-4b74-be65-12b23dc44241", "value": "1536:FIE7QRqUlRX+bmVl9+9+MASbQpP3qSDCnD4mEUXMsZLJEyukZRLyBnGT4joZ/sBw:JuRX+iV3+mW0PtsUwRLsGEM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767010635, "uuid": "40b034b7-defc-44a9-b712-9096e0476920", "value": 171560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767010635, "uuid": "05faaf3b-9bc9-42c3-94eb-687fac4687cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767010635, "uuid": "c45e994d-524c-4c94-ae3c-db4dbd9f1e65", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964a58d5-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766967374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967374, "uuid": "d6aa1316-d35a-459c-a85c-a91e2829f87c", "comment": "Malware payload (AsyncRAT)", "value": "96d2f9f0a8bc26518a61089ebed960c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967374, "uuid": "bd1ec4a7-d7d1-445d-a8e6-e4d68b0475c5", "comment": "Malware payload (AsyncRAT)", "value": "a51f01ef21c0e69bfa82fe7351c057cdeeb76b2bae692552260db9551e2a9c73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967374, "uuid": "2c2c7a0c-6377-410b-8b16-f28f870151d4", "comment": "Malware payload (AsyncRAT)", "value": "7e4d4fac19d7a4d41201012818394120b0dd8ff5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967374, "uuid": "82dfb8a0-db59-44c1-aeb7-a7ec3aab9d17", "comment": "Malware payload (AsyncRAT)", "value": "522ef0771ba7d580934aca4e1c74bee67e3140ab8e3372a9bfb2475ff51f91fa7ce9ff8ef219845c4fe2488fe9f1d236", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967374, "uuid": "067ca5f9-0baa-4848-b67d-a55db00375ef", "value": "T13AC21B0473F58265D1ED4BBE48329200D375E64B5D13DB9F6EC494AD2A33BCD8A21BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967374, "uuid": "38a67f9e-94bf-4da4-806d-c37fa7ed05d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967374, "uuid": "64128806-d7e4-49ec-8fcc-a58b23620f3f", "value": "384:7A9EhVLq1LrzgepaQkXYMymrJhxQHqqbuUsJQxnCJf+BWfXW//tu+:7A92VLGLrE9QkoMyCJhxmFbHBFBRu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967374, "uuid": "e3779f35-8f45-462e-b4c9-613b1d88a4f9", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967374, "uuid": "3d511901-85f1-43ae-9d16-0f919ea90e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967374, "uuid": "0f4fa715-0623-4025-a80f-46c46431115b", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516e74fd-e4cb-11f0-a129-42010a9c0007", "comment": "Malware payload (GootLoader)", "timestamp": 1767022234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022234, "uuid": "4f380cd4-0437-479d-94a2-1893e0bc331b", "comment": "Malware payload (GootLoader)", "value": "cf8b5a821f3ea8b650978ce9772f96e6", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022234, "uuid": "3108abfd-faef-4c0e-b161-f03da52c7e01", "comment": "Malware payload (GootLoader)", "value": "a524c58a228c7b09d63aea55c3ba5705d1cf9622849a9605ffea2c307f831080", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022234, "uuid": "84872e44-d9a1-4ba5-904b-df10635f8329", "comment": "Malware payload (GootLoader)", "value": "dfb8e36ed3aa6370c37d75da0177acbba9a4e0e3", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767022234, "uuid": "f38d7b69-e05b-41e1-a516-e3d42e26b4d5", "comment": "Malware payload (GootLoader)", "value": "479fb9f845169b6fe13f16866d7c1261321f664478dca888d54000cb1b2810c50074f14031e6a0fb0e6e0eaa14ce2009", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022234, "uuid": "0a0be58c-3a0d-4059-8512-151338f97ea2", "value": "T1B0281221BEA278EFEB4944E05B145D8105989CE2F1DEFD1B0E3CDA995BC356D26036CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022234, "uuid": "04af8655-f17c-4af6-b9f5-5280e5d0a5eb", "value": "1572864:JTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT5:JTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767022234, "uuid": "9d2fef01-6471-4edd-b48d-412bf9896825", "value": 97145650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767022234, "uuid": "19ee7600-107e-42af-8457-b8d6a38f6962", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767022234, "uuid": "84628fbe-f5be-48f5-b2c4-2e2303e9d29e", "value": "Legal_Case_Management_Guide_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc0039f-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031888, "uuid": "dec33e6d-1388-4233-a6f6-66c4990e43bd", "comment": "Malware payload (Mirai)", "value": "124940865e3ed6ece7e6f5f8377c74f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031888, "uuid": "9c3fa5cb-99f1-4875-8871-86ad5bcb75ab", "comment": "Malware payload (Mirai)", "value": "a542f5a5e1ca2958f41b1c4a67c2b9521642f5f4df90a23e2c421c121d47e465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031888, "uuid": "64eb7bbd-260e-48d4-9eb0-acd0487ed5f5", "comment": "Malware payload (Mirai)", "value": "bc25db9daf5ef1dab762ef8970310d48d898d1a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031888, "uuid": "a3bf9640-3f87-4ea8-a110-b1ee596ca824", "comment": "Malware payload (Mirai)", "value": "0a3dc5eb965c0494767399d541e32e8d5e9c843aef496c081ffc1755418cd043bb8cb2b0da0e7656418e15aca48d7eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031888, "uuid": "530c3e4c-3ac3-4748-9b16-e9c51934624f", "value": "T1E8138C229D7AAE69E10E86B575749F360B33A611D3832FFB2252D125C043E8CB60D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031888, "uuid": "feee1b32-507a-4760-86aa-0825ba5b52f9", "value": "768:BxSyksFtrnvQpvYJFeNieEF+S4pQBjUGCL958eoxfLCXWu+7R:TSe5eQb3JUG458hNLCXWu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031888, "uuid": "931a2c4b-26dd-426e-a252-0ffb91a875ef", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031888, "uuid": "5c6083bb-93a3-4c57-8586-6b244bd859c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031888, "uuid": "b2aa04ac-c6a0-4a0a-a1b2-63287ce5b2a3", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e18767-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997700, "uuid": "e56c122f-c860-4ed0-b5b4-a0307a42803a", "comment": "Malware payload", "value": "9821cff31b0fcf64fc5d758276e7824b", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997700, "uuid": "75f09bbd-cfca-42b9-86e4-6edf03c4a394", "comment": "Malware payload", "value": "a5493eec5a9ab901307dbdc52576001f1d1b143c03580f9710b6c7aa5f04828d", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997700, "uuid": "83c602bc-02fd-4c2e-b770-11ad4eb8c11e", "comment": "Malware payload", "value": "e6e2e09e9b0e8537a6c6de27badc1fed01f92265", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997700, "uuid": "22eb0d5a-136b-4ada-8b7b-15937fd0bae8", "comment": "Malware payload", "value": "dbe5d3a265f0752fd3fff20549fb7bc505a3d55921b991051bf563c1cd626624ed25dcfd30b7d870513b6a7203e4ec44", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997700, "uuid": "339de979-27dd-4f11-bd69-30e1990e33f2", "value": "T171C02223020D0336E29980C2A4C4E2209009685802AE00F26437634CAC06760CA82018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997700, "uuid": "5bb732cc-2b20-4ec6-b3fc-48c2c9a64457", "value": "6:s80QO0c5IhLh8CLWYYfwrLTMfWrL8T1MFyMfWrL8H:s80Qpc5IJGhffwfZrLg1MGrLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997700, "uuid": "760de210-bdac-4cd4-ace0-cab58607f081", "value": 194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997700, "uuid": "f0537740-6d5a-4733-9908-82fd4a10d927", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997700, "uuid": "e7e08e92-40ed-4c52-b6a0-cd76048c9a42", "value": "2xvwzq.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7488caa7-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766966888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966888, "uuid": "d500604c-17fb-40e9-8c14-6939bee251db", "comment": "Malware payload", "value": "bdf1e4ef9b79ef5168b32c9b6d5586b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966888, "uuid": "9cbec4c7-8720-4aed-bdcc-88af01824752", "comment": "Malware payload", "value": "a5d5aba99d426a0dc898d8f62a6ef26b18db2fef66169e956715ef0a35fa57c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966888, "uuid": "ea12e69c-6d3c-4885-ae02-3fcc8194a942", "comment": "Malware payload", "value": "07446cfee0653a27faceb544a0d8a5992bae3d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966888, "uuid": "3ee28a53-6e76-4f81-8669-3863dd162f80", "comment": "Malware payload", "value": "35ecb06f1fb476b9c38af3301a7bf8269a9b43eb744fa6368978783bed0639278e3cde49f2ab429bcc8db3874134f0f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966888, "uuid": "75035751-a901-415a-a3b5-1c8cedf5f13c", "value": "T184632B037504591FECC18B740292CB74AB263766E7A31587F65CEA3B257F3E06F25A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966888, "uuid": "c54d2a83-7665-41ef-8df2-53c04bf8176c", "value": "768:Zv+bvyjwzh9IGKh/pHe9+xLYPgcfz0cYMqBv7mSY/ZYNZnU+XEfSFwJFzXfdUJ/4:cmsLjq/U+xLYPggYMqfZEfmkpo16h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966888, "uuid": "805f51af-7666-447e-b099-3da0346f4db7", "value": 67092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966888, "uuid": "4b109843-4017-4d3c-bb63-5df2633f44a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966888, "uuid": "51878730-0000-4b0c-abb2-e0219e85368a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4c0e26-e50e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767051297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051297, "uuid": "35c9e907-f8d5-47f2-9987-7612bbaf8f1b", "comment": "Malware payload (Mirai)", "value": "3b7eb7427102445fc98c7a6dcb00138d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051297, "uuid": "49daf440-a09b-430d-84e8-eab0de5a9f2b", "comment": "Malware payload (Mirai)", "value": "a5dd7c9436bfc0b085aab0d54886f0c0175ae1256ad75a364c063b6d038e462e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051297, "uuid": "407d5f9c-57b3-4999-9663-d814eca782cf", "comment": "Malware payload (Mirai)", "value": "947474d7de0ce70ab2fe95d7c0ceebb061da4d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051297, "uuid": "462fc92c-8d99-498b-a103-dcc45e425c09", "comment": "Malware payload (Mirai)", "value": "7159d95d84b31340eff58a3059d7d099a193abbb20602eff814261d9a1b5919536535ec92a6ae5b4a1428ae090fec51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051297, "uuid": "c1b4ff11-c784-47fa-872f-40460926f53a", "value": "T17DE3E906A942DF12D1C211F9FF9E455D37137F78D2EE72029D24BFA0378A4EA0A7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051297, "uuid": "6fb1f98c-3117-4740-b549-f08544dc685a", "value": "3072:NGr5TItVkDPyXpakbiaGBv3o9lQOiXJT2e/58m:N6eVkeXQkeauKlQ7JT2e/58m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051297, "uuid": "358f2af5-5e93-4b2a-bf27-29af933470af", "value": 149516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051297, "uuid": "cbd35a7a-1242-4531-8654-410e23767b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051297, "uuid": "e227fac7-0c81-412f-8b1a-5feaa28e3b38", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaee7d62-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995326, "uuid": "76a849b8-964f-44a7-9cc7-83c09f7d95c5", "comment": "Malware payload (XWorm)", "value": "f95720a4fc4c0afc8fe207de0036fbaf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995326, "uuid": "93c3a597-cfd0-44ef-964d-f2b5eafb93d3", "comment": "Malware payload (XWorm)", "value": "a5de13bc7467cab192475bda041e9a4fce1033d23a8369e40d388ebfbabe1971", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995326, "uuid": "70e89ce2-6a53-4cad-b663-5e94cb5ad4da", "comment": "Malware payload (XWorm)", "value": "4210c68188042aeb44cc0d78cafe1bbbb7c584d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995326, "uuid": "9f2ccc29-34f7-45a2-9d6c-7d9ab7fd8103", "comment": "Malware payload (XWorm)", "value": "d4a51527870f02380e7ad3a739991573d90de1a37f6e5602efb9695e4e6be85fb233878dbb8761afa0025d2c35b91fca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995326, "uuid": "89daebf8-83ed-4fad-b3fe-8eacd26eb95a", "value": "T150632A12661F92E5B347E048F30E6086C73AFBFC67DB52EDAF6232357A1674600565B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995326, "uuid": "1c59c040-923f-4c4e-bb9b-fc2d78be95f4", "value": "768:I8w/h62/jWs6oS+xISN0vnOWghMdkfScBYrwz2y8kTAlGB:I9l/AoSSMOOusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995326, "uuid": "ce92c7d3-754c-4428-ac11-5b0b250df2ec", "value": 69638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995326, "uuid": "57667b8c-99ea-4a4d-8cad-5e7dad70b2a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995326, "uuid": "58ae1b44-f75f-4f30-8e8b-12f849d34c3a", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c7eb7e-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995267, "uuid": "c8a11458-c72c-4f10-9c08-364130cec821", "comment": "Malware payload (XWorm)", "value": "90808e6d1d2506736bc47f36961a35f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995267, "uuid": "7ca65c60-2ffb-4be0-8875-611ba98ad15a", "comment": "Malware payload (XWorm)", "value": "a605d3d1543707da2498649f86a7c6508eab5b628444ad247c90bcfee4cd1b14", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995267, "uuid": "84713b87-e2f9-45a8-b4bc-fb1d835935d4", "comment": "Malware payload (XWorm)", "value": "148650e431431cfe9115b8489632c784d470c55e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995267, "uuid": "ee8d96ff-93e7-4bcf-8f82-8027d018ddcc", "comment": "Malware payload (XWorm)", "value": "d5418cb7cd80a83b7e99f194f97637c3d216fc9de5118df29ca77ef111f32df29ed60ac8a4b4dac896dbc4daa7eebebb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995267, "uuid": "6d370484-b9b3-48ec-b89e-926588952d5c", "value": "T11873090F5AA7926326FBC7B5BB07E0CE6A397E9C78A004A9C90C3429D106E977371314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995267, "uuid": "325ffeb1-ed4e-4cec-8dd8-b14c60914818", "value": "1536:I9l/AoSSM8SYSCStSYS4rSZSWSpSwSCSASxSiS0SCSiSYSVSESpSlSGS7ShSmSEX:I9l/5M8dH0f9ITo/dv4JXp3FuXAEHUch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995267, "uuid": "27b5e165-36c3-483e-8510-7d81dec631c5", "value": 74453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995267, "uuid": "fd7c5ac2-53a2-4085-bdd8-16f25d26fea5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995267, "uuid": "bfb49766-27c0-43f0-a290-43e4b71e619d", "value": "invoice-1645080830.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b0161a-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967985, "uuid": "11366ba0-9e68-4280-bf8e-a49e109a4896", "comment": "Malware payload (Mirai)", "value": "ec253c1d66c0b44939ec7e910db7dd1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967985, "uuid": "c317cf25-d45f-4692-b98c-beb3eadf41f9", "comment": "Malware payload (Mirai)", "value": "a6623e05fac3ab93c710ffcfa7dec352b606a06e6b071cb6a47a7cc4aeec5b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967985, "uuid": "74efe79d-cf46-4dba-9a23-1a681f1a9ad7", "comment": "Malware payload (Mirai)", "value": "6595f16fcfd4c4eac956f1f933b738a0e4493541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967985, "uuid": "81305592-d7e0-4634-90db-dd49b9fd4b39", "comment": "Malware payload (Mirai)", "value": "1fee65e1c47cfee8aaaa0416778f0d07ca7ecc4ecc40b9668157e3716ad76abd9a095c98ce5482d5d19d468723cfe8ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967985, "uuid": "1e574e63-91d9-4e6d-ae06-dd612201ba42", "value": "T197934D86F400DCBEFC0ED67B84970A06F635A3610F820B267757F967A9760D44C6AEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967985, "uuid": "129c70ae-e746-4f30-905b-18d90732dab4", "value": "1536:Pj6O1YG7raQeDsME0Juvy+HdnlockZ8iYCDHqKavQEMPLfa1wEyohqv2cPlG:P+O1rGQgsME0Juv/RlockYtKFECIyohT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967985, "uuid": "fb839d5c-d1e8-4d54-a266-fd590edd756d", "value": 96552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967985, "uuid": "f63ec45e-11c5-4019-9f00-a4527a54caa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967985, "uuid": "7ba13530-a372-4347-8ae2-01276727a5ac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9ba587-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028405, "uuid": "b895c24d-c1ef-4bcb-8482-7f68b19375a8", "comment": "Malware payload (Mirai)", "value": "757aa50bd64195d76f1705d34683f9d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028405, "uuid": "277cd811-e746-4b46-8d85-d2bc09ebf612", "comment": "Malware payload (Mirai)", "value": "a732fcb4dd95781f2f226d102a4df40e3c3e26ddf9417042eb573ce00a509fac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028405, "uuid": "99a4a8c7-ae8e-4b4a-a732-263bf94d5ba1", "comment": "Malware payload (Mirai)", "value": "f97e2b517933f257996cce83e55a9497c88fba4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028405, "uuid": "b2107c09-da9b-4942-8037-3cdba390c8b4", "comment": "Malware payload (Mirai)", "value": "1e88ff4c1f5c91f464422a7606b6a6125ea10736102ffbd5ed0c08fb867feafab053d2d560cb851afc1522e1c604475d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028405, "uuid": "4f188705-b079-4127-9307-582d13631602", "value": "T1C7F35B41FA87C5F6C817487060ABF73FCB32982A4077C69DEF999F31DA27901921629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028405, "uuid": "83ecc1b2-4ade-4e89-9be1-df99d4aa727c", "value": "3072:wh04I2N7ldkrYJqbueByQjx+9GLtfwsQnZUQ3i1KO/hIB1TmH+:wjI2N7/krYUbueByQo/sbNEOemH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028405, "uuid": "7365ba55-f242-4c62-8946-899d1a16066e", "value": 162760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028405, "uuid": "6faf4065-78a6-46b3-80ba-e6c2099d4402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028405, "uuid": "a1115be4-dab0-45ce-9603-64a75723e67d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728f4846-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966884, "uuid": "0b418c21-0c28-47b3-a1af-d2c5f1e17cbd", "comment": "Malware payload (Mirai)", "value": "4de8bc4ae60ae8ba775f201325f4b594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966884, "uuid": "890eed6e-5691-4de4-9731-cad99631fdfe", "comment": "Malware payload (Mirai)", "value": "a754ecec2073960a64c4a48bc9aeb237eea260b5c1d5c24aa41a441cf313b5a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966884, "uuid": "4656aa3b-5679-469a-a8ef-966b3ad2bed4", "comment": "Malware payload (Mirai)", "value": "6ff034df8d0622b595053db1edbf3b9c514489a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966884, "uuid": "d81d484c-7166-4333-bc9c-1328004d12f8", "comment": "Malware payload (Mirai)", "value": "08fc10c324c9c4b87b5291f50e748228be0462f058e83b1472cbbe0489a87699f86cc997ca134dcad98328ea07a840a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966884, "uuid": "0b29c49a-f055-4918-9466-cf9553a0881c", "value": "T1CF131886BC829526CAD42376FA6E118D332173E9D1DF722BCD109B1436C991F4E7BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966884, "uuid": "56195907-5207-4ffd-8507-cac2b0fc9e7c", "value": "768:2cU2mcYQM7eZZwOT+wdZ6EKuOsMAxsleQkclQ3Mub7MoTodkRNlRBNDEL:29BHGZd+ZsMAwzkvB3MohNlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966884, "uuid": "558de926-c8dc-4eb3-8485-95903d59261b", "value": 43871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966884, "uuid": "b4af0588-9e83-4e54-91e2-a7f03719c7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966884, "uuid": "4645d509-59b0-4ac8-be8e-aa6d8508e99e", "value": "odin.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0db9c7-e4e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767034705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034705, "uuid": "039046cf-1382-4571-90ca-794533bac743", "comment": "Malware payload (Mirai)", "value": "ab91e2eb2a355aa1fe6e2781ccfdf2ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034705, "uuid": "95314dd1-9e45-421d-99e3-c35460f01d9b", "comment": "Malware payload (Mirai)", "value": "a7af3563dd2779f6971959cc8cb378756fae95071a98e184c9ab70f0437edcc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034705, "uuid": "273e964e-68f7-4530-9895-7e9a612ff423", "comment": "Malware payload (Mirai)", "value": "f444e2a183d7b9841bdea8ed48b0f839fc837794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767034705, "uuid": "5138080c-906f-4459-b80b-380efbf384b4", "comment": "Malware payload (Mirai)", "value": "2ec7748d878ef6ebd706110a080007df4d1e2be0430e0e806534bf9742e2132a2435587fc94c8ade5da5ad47bc556b1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034705, "uuid": "2f4023f2-4596-4ec9-9fdf-58a4dc084c3b", "value": "T11E34C94E6E228F7DFBA8C77447B74E24975923D622E1D585E1ACC2011E2029F641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034705, "uuid": "c6869254-cc68-4e10-b0b0-a02795ce0eb1", "value": "6144:Wza45KFbrIbwk1fjziUQTji0ZEm2A0loDUZ:WSBIbSZmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767034705, "uuid": "012fc8e8-7681-414e-8967-d4a54bd41ed1", "value": 245212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767034705, "uuid": "0d05abbf-1b2a-4884-a31c-fa24f3c37dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767034705, "uuid": "90a1323b-c762-4217-86fb-65f4ebabb596", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d93f96-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995368, "uuid": "d8008346-1c9c-403e-a1dd-1cb581586fec", "comment": "Malware payload (XWorm)", "value": "b57cef7030b9796b57b50b6afdf10c97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995368, "uuid": "cdfa2c13-5ef7-4e32-b581-8899472dc8ad", "comment": "Malware payload (XWorm)", "value": "a7bc15edaffb61327b897aa4877dea08ba1a8b4ceab74d871a03d4cbef7152d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995368, "uuid": "eaa304dd-b38a-4d76-8138-7fa4311502eb", "comment": "Malware payload (XWorm)", "value": "e515131515e9cc36751401701a3452d925014432", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995368, "uuid": "930df895-afd0-4d11-9a05-4ed63774bba9", "comment": "Malware payload (XWorm)", "value": "b3d2b268367d878ecae6cf5d3a0e2175963b2913fc5ed654114c2aed92aaa6d821e5847a2088041bec7d503bc68a52ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995368, "uuid": "6e16687b-a95d-489e-9d01-344fafcd6ce8", "value": "T156732E87F27039CF0462D52B4C839FE7C06A2C61CA767B651A2B758D57B8D81E444F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995368, "uuid": "40390e34-a77c-463a-a3f9-274769bbadb3", "value": "768:I8w/h62/jWs6oS+xISN0vPIb0KP+U4UqTTTfj7jBA6mCMDJqcJ9iI775v61D01jM:I9l/AoSSM+aGusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995368, "uuid": "dfbc93b5-59cc-479f-a90e-9673d114bdd7", "value": 74429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995368, "uuid": "fd6bc7a6-4a0b-4f07-b535-9f05e55832ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995368, "uuid": "ac848143-2658-4975-95c6-3cf185b035f8", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ccc6e3-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031467, "uuid": "2f07b367-44a8-455d-b372-4d458d4750ff", "comment": "Malware payload", "value": "fe98b50b86532e071a95159d303f77bc", "object_relation": "md5", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031467, "uuid": "6509838a-e450-4a04-aa08-e2514c6c2fe8", "comment": "Malware payload", "value": "a829630c4d256ee47eee0e4e65e95fa41379598ced8e49e120e257872b29313a", "object_relation": "sha256", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031467, "uuid": "235198ea-e6bb-47d8-9894-b49f27b8e11c", "comment": "Malware payload", "value": "90e7cf90b8a217cbeff5cb72a769061fb627c3c3", "object_relation": "sha1", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031467, "uuid": "1047ffab-db36-437e-85e2-2b72b6e16001", "comment": "Malware payload", "value": "73790f58a4eec1933125bf93684c99eb3c42b8a25a49dba803e5c80434709b87d8f3680bbccfab205981621b45a19de8", "object_relation": "sha3-384", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031467, "uuid": "ad5c7e4b-cdc2-4ab8-913d-d77ce7957f41", "value": "T10FD63340436D0581FAA006364309C269B9D5464231578F7EBF54EDF7AE7E1C30FBAAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031467, "uuid": "0edb9df6-34c7-4d89-b910-211ed610f887", "value": "393216:1655EQNxB2JqnA1f5DgiGuDmV1u4EBcbQNb4:1655EQND2JoEFg4m3u4EBkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031467, "uuid": "cfaee025-7edb-47b7-bf88-9c1c033bbf31", "value": 13379133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031467, "uuid": "39177451-50a5-4ed3-b869-060e96306135", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031467, "uuid": "1f9427bb-5c4b-4608-a7d5-3ca770bdda3f", "value": "ash.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7c9e0c-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995253, "uuid": "87717b58-8e18-43b5-b6ac-e8684e08a18e", "comment": "Malware payload (XWorm)", "value": "8ec1774bf3c169d101c9b9e41de2caa2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995253, "uuid": "d1d73201-be3e-4b4d-b381-1eaaf31a8479", "comment": "Malware payload (XWorm)", "value": "a8c5dc9c7c37490f243ddd79609958d8af644705a2a1303e4b61e1ebc68dd91e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995253, "uuid": "efbae0ec-3a27-490a-bfb8-75020bdc7452", "comment": "Malware payload (XWorm)", "value": "60b3e302f0a3adb4c283f130ffbcee82682169a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995253, "uuid": "5c963be3-7348-4259-a24f-e52a992d39b9", "comment": "Malware payload (XWorm)", "value": "e23b33b10dc036f3d907b416ae0e9a1ec27ea89348789bb840deadac75b4503412ac9635e81077fe9e022388b20dc65f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995253, "uuid": "54bd0e20-0f8b-4991-8608-ff59bf205be5", "value": "T1106319682FF69DAA1CCE44D0601C114BC40A52633B31AA796913E4F5B776EE7D3CE12B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995253, "uuid": "db937198-bc89-4481-a37c-a49f1b9acf47", "value": "768:I8w/h62/jWs6oS+xISN0vhu4e4ENvdkfScBYrwz2y8kTAlGB:I9l/AoSSMU9usrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995253, "uuid": "f24a3072-fe6e-4c71-9bbe-7f2da6538230", "value": 70617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995253, "uuid": "5af264e7-2e23-4144-b49e-69a44cfdd09d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995253, "uuid": "4a56f103-5322-4658-ae30-8d1df35a8a23", "value": "invoice-1645080830.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b0e1da-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016470, "uuid": "e2ef69da-1fb6-4c22-b52f-6a501be491b1", "comment": "Malware payload (Mirai)", "value": "773794eaaf7f3095d8452940ff1a935a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016470, "uuid": "c676bd78-2993-4fdc-81b1-58bcb7ff2149", "comment": "Malware payload (Mirai)", "value": "a94fad4dbec1ccaffffd46c77483d7777881790a0bc84fc21689905ae602de8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016470, "uuid": "f75a6ab0-fe40-40e7-88cf-a2a70a505ff9", "comment": "Malware payload (Mirai)", "value": "e48238108a27a2326624e137fbcaf0ca379e0d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016470, "uuid": "7ce60f78-637f-42ec-90e1-ed4c5da361df", "comment": "Malware payload (Mirai)", "value": "a9f473e8c595d0083699dd1134d2a30ecbdd5b98e68068a61610442eac1fd5c1f78f29e0c457adcb7be9ec7887cc2dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016470, "uuid": "ceea6627-92b3-43bc-8cb8-8ba46be655a4", "value": "T133B3E085B210AE55C02672FCB1870990A3B17E7B4B9A150B4473F5B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016470, "uuid": "bbf86918-9cf5-406c-9f03-6ac2bb393446", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wuV:as5zqhr5Nzy7wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016470, "uuid": "67ed4ea3-3bab-4045-a944-40c5506207f3", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016470, "uuid": "a824cf89-8117-4080-ab86-b93dda0b6893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016470, "uuid": "bf19fb06-8937-442e-865e-ab1a6051ee7e", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1df2a3-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967060, "uuid": "9ce97f41-8742-4c8b-89ea-96b9a2c0e8b7", "comment": "Malware payload (Mirai)", "value": "3396dedca28295d4c19f1a5c59dfd37a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967060, "uuid": "6df7e81e-1b8e-4051-94c8-00baa4d521c6", "comment": "Malware payload (Mirai)", "value": "a9523051b3d0183c80beed853d0a05e68ed17d91728fb457b4660a86848d9250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967060, "uuid": "7dfa4be9-fd10-4307-953c-82913ffc6c67", "comment": "Malware payload (Mirai)", "value": "899f92376e94b7be4fd649e01b35a4c7afbd70ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967060, "uuid": "12716ddd-dd77-4e86-b939-8c6449ea17ad", "comment": "Malware payload (Mirai)", "value": "cf2d4ddb9ca23e31bf1cc38c72c528f6df1bf4f18b9810a2d04a8392d477f80046739af0dea35f5b94f55c2ebeb5f639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967060, "uuid": "a2707c35-d4bf-44b7-962e-3465a142ba38", "value": "T1AF737DC6E643E4F5ED0A09305173FB334A72E5751039EE83D7A9EA36B856A01E50B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967060, "uuid": "6fbb294a-e0ce-4650-86b5-1f466cc0354b", "value": "1536:uSHwc+vIp1QfPGLRFVaRPl50dLxa/J9tPKgdAbytAX93Uawxvuf5h7pwFvSx/Rc:uSR0Ip1Q3AFsR9G9xa/JTPO5X93PwRuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967060, "uuid": "f3915446-5b05-4e4d-bf51-575cfa8b18c4", "value": 80000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967060, "uuid": "26efeba2-fb90-4740-80e3-863fd49614bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967060, "uuid": "dd84260f-9e6c-4e9b-b260-fd3f81127802", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22af775-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028409, "uuid": "3e1d1508-1d3f-4095-a6e6-9a83360e8799", "comment": "Malware payload (Mirai)", "value": "38c3c21fb5b029df579516aa5210dc9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028409, "uuid": "3236b606-0b40-46d3-a943-c621d2f55a0d", "comment": "Malware payload (Mirai)", "value": "a9f157de1027f16c9f086d0c41cef32f29c1db91a3e7a49f950b91c41559e5fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028409, "uuid": "5af6278d-b44a-4cbd-be50-1f8a2774e3c6", "comment": "Malware payload (Mirai)", "value": "054f4e3065c8544b76d40cb22c3f226c13488a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028409, "uuid": "59bf7d67-dba9-4912-b2b6-638b59537a15", "comment": "Malware payload (Mirai)", "value": "fff08f9ac169d2e1d2b7222c00735f1c9bb529b8db638fb2472b1e361b34e59f410afb567df491562e59b7acccce8e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028409, "uuid": "b601c6ef-b267-4605-8f81-1e510515ecbe", "value": "T10C045B02731C0C47D2A72EF4263F27E083EFD96225E4FA45655F9A8A8171E371589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028409, "uuid": "125baa51-6335-42fd-a009-0f2ac414ff85", "value": "3072:qDZEHvlFiRxCyHGkzy6zvaKwq6hh1F8kon:qDyHriRxRHGkzyKCKe8kon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028409, "uuid": "7ff3ea8c-2707-4fbc-80fa-5126e97dcde6", "value": 187420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028409, "uuid": "70a76234-7dd0-4e49-9bb4-06df65eed11f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028409, "uuid": "18a83d16-0e88-40fd-b6de-803e9eede45e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e6141c-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969365, "uuid": "c86a9797-9ec4-428c-ad4e-7883d310c80e", "comment": "Malware payload (Mirai)", "value": "6f49e9e34851a730dcede5b6ab11c4eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969365, "uuid": "e7c4f26a-5cc4-4539-b8b7-5d510cf05f08", "comment": "Malware payload (Mirai)", "value": "aa4aa4c526d6d8cbc53fee3fa8e3a99291afc1a9b674ff28c7af2254cef4113a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969365, "uuid": "ef1d9741-8193-42ae-91d4-9688bd6d52b0", "comment": "Malware payload (Mirai)", "value": "3cf79506e01b7c665f76b0c6251dd3c13bb649e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969365, "uuid": "6ef68eb3-9c14-4e5d-9cb5-591977334798", "comment": "Malware payload (Mirai)", "value": "2b5f40ad91ce5b456eede6f2959887efcf587db256e15bfbc6882d867cfc954e3581c4e43d2fd0406f3e3e4680621abb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969365, "uuid": "1c59d917-ee43-4db7-af60-2328da97141a", "value": "T157934C82E504CE7EFD0AAE3785270941EEA4F784CF221E0BE659EC979D520E4753AD09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969365, "uuid": "9bfcf8c5-346c-4ac7-9782-328bc86dc74e", "value": "1536:2EBPBRxcOD+JMbAexDwa8uzDFcJ52MMEEaUm19MxTPNzX1:2ENHUex8as5tMEEatHMr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969365, "uuid": "f9128b13-7fdd-4ffa-ba6d-1ba2c614744c", "value": 89564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969365, "uuid": "f80ba101-1a55-41d9-bebb-5d69626e6674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969365, "uuid": "04cd6fc3-e54c-4bdf-919b-6dafa204a191", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a70fdd-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986573, "uuid": "872a497a-e838-43c3-aec5-8cae25a9c502", "comment": "Malware payload (Mirai)", "value": "fa59a67c05760f97dbc60f55e8268057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986573, "uuid": "25fab048-bc96-46c5-9e46-52165a741e9f", "comment": "Malware payload (Mirai)", "value": "aabcff0c15ed3a2aa044471b5cf34ab2103d8fca958c6142c7c81875dded1c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986573, "uuid": "dee47312-e56f-4115-82e7-b35573923143", "comment": "Malware payload (Mirai)", "value": "93293ddc38397633821bca90adc990ce3f6580e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986573, "uuid": "f4f7e2b2-c59e-4ce3-b0b8-fd9707e593b1", "comment": "Malware payload (Mirai)", "value": "637f5774cd410b315bcf1c3c99714e58eac1f20be2d54606122498bee41354178f27893dd42ed4d750e911c259394fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986573, "uuid": "e62dd973-ad43-4f64-ab15-dc5cdaf8c000", "value": "T16DB2E172A1863E62D770323A793CCA0057AB57FCA0BA72752524B6AC4BD2D4B647814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986573, "uuid": "3e2d534a-9627-4064-9ee7-a887b988f2f7", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdizkchymdGUop5hK0:yX1De9kONQG5xD+jHMDzuits3UozY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986573, "uuid": "1caf58f2-f326-4b51-86b3-43ec0d22a1a2", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986573, "uuid": "dd500156-b8cb-4985-b8b3-18dbf9cfb5da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986573, "uuid": "6cfd50d4-a88d-4443-9e4c-471ef6d2af0b", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3b3bd2-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766967575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967575, "uuid": "0bf3bbad-e28c-45f7-91cb-0c488a25dac7", "comment": "Malware payload", "value": "e5b2605a95d1aa4ce7cdc26bec092a9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com-leinchchanceleinch", "colour": "#112ED9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967575, "uuid": "9f2e880e-0009-4dcb-a4cf-740027f4beaa", "comment": "Malware payload", "value": "aac94c42b3f06c578e4a0ab71880e242f0b74e6f403d6938966b785e3cfd7b57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com-leinchchanceleinch", "colour": "#112ED9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967575, "uuid": "dbca50db-e4fc-4b13-becf-87e8b050b0a0", "comment": "Malware payload", "value": "1e219f6fef85704a64b764aada78c2d1c1630c00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com-leinchchanceleinch", "colour": "#112ED9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967575, "uuid": "deb44698-2dbe-4d75-b29e-87aba6edb1aa", "comment": "Malware payload", "value": "c1827f9068523270010527251417e5ec15a130cd60edc678e028b12cd56a05b7686d449937dcc584ee6e196960839dd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "github-com-leinchchanceleinch", "colour": "#112ED9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967575, "uuid": "cd1f22da-a375-4b12-819b-eee03bb989bd", "value": "T142D40285FBC725F3DA330A7744D7523E5978B2022612FDABEB4D27163472712BA482D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967575, "uuid": "9fe1faec-6d7b-4a10-ba59-85dfbb255cc8", "value": "38bac97cf682f684639e4f5ba8505806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967575, "uuid": "ee2def52-6f47-40e9-bcf8-fdffed86010a", "value": "12288:UM9O5geNjBclTNAad6hPV4PYdKFXpSa3Omg761YrUhCGadefjfFZ:SBclT1d68FXpSaemYrUhCGYeL9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967575, "uuid": "6c666e26-67e7-4951-ab6f-641c494f0a95", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967575, "uuid": "6cb4835d-76bd-47c8-a794-a15098219d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967575, "uuid": "a930a153-52d3-4781-865d-0329bd11f6c5", "value": "zlib1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607c3d79-e47d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766988758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988758, "uuid": "5ee383df-5271-4973-89f8-2be49bc5447d", "comment": "Malware payload (Mirai)", "value": "6032c5752cb36ddd75db3f7febbbe847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988758, "uuid": "ee7b59d0-6896-4ff7-9c05-1a3c61f48211", "comment": "Malware payload (Mirai)", "value": "abdb1b4a4d103d5d5a7704958be79d2c71fad3c870c858d2bee093156fbb557b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988758, "uuid": "5b6a8a97-9dc6-4b5a-94cc-d5d6cc010d5f", "comment": "Malware payload (Mirai)", "value": "13d3311bfa007f0c0fc5af906e26f14e9870780d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988758, "uuid": "51871917-62b8-463f-943f-13aed23900fd", "comment": "Malware payload (Mirai)", "value": "b7255aa5b2e6338392c78eb4416875d85c42241d7f87dc6972df8c823e665ba14a6686e22380f3483d19e539240d6fb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988758, "uuid": "1a559768-f6f7-42aa-9bed-4754e80d6957", "value": "T1A2A38D33CC3A6E64D21989B4F0B0DB7C9B13E55180875FAAD46AC3BA9043DC9F5493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988758, "uuid": "146b0ebb-6ae7-4e80-9fa2-87fe4e16d7ac", "value": "1536:YFT13JpL2yy8kJtl9Bs0vqJn1rjKK3c1g+PG3CRDFfDOhA0DnTRh:Yx15pXcdrdqh1rjN3+PG3Y5Su0DnTRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988758, "uuid": "97718d7d-260e-4581-be25-6b404832e970", "value": 101948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988758, "uuid": "9a8a69ad-611b-49de-956f-9c1d1e71ee58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988758, "uuid": "f2371d0f-c205-49b2-8e77-2067421327c9", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2b0d4d-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766996210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996210, "uuid": "3913d4c6-ad1d-41bd-804e-460743fe3c14", "comment": "Malware payload (Formbook)", "value": "7966727f97dc8d713b59f6fb68911ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996210, "uuid": "8497c69b-3a49-43e0-8ec7-34d40373b341", "comment": "Malware payload (Formbook)", "value": "ac390d3e36cf4922ce11ffff5bca9b2f11f6863d094fddca27f7c237ceb05b39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996210, "uuid": "8befd030-7b1e-4f91-9c01-db850ae58ce2", "comment": "Malware payload (Formbook)", "value": "55877d8d97bd14b7012d592de6f34cd0828865e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996210, "uuid": "4160e62d-b694-4102-9a7b-2a1947cb5acd", "comment": "Malware payload (Formbook)", "value": "cd9538a808d6ac4c483c272f396f81bf5bf4610a77df4631c6718d6e66b5b37f95f4724605943d501080620787dd8835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996210, "uuid": "8a51abee-a030-4ad5-b489-11b5d7526197", "value": "T10254236140A3A27DCB17567E92F7252E20D4FF6D770547CA4A1E24EEA2168A42F40E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996210, "uuid": "e1f20b42-a258-4981-b476-9654a3e5e350", "value": "6144:ofyRchQcET1RbMSEwcRd9DYAkAZMTFKZUGN6W4mC3+:4yRchGT1RbfEhRd9DYnAZ+KGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996210, "uuid": "aaf49818-1abd-4d56-8271-8eea49863ab4", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996210, "uuid": "f43b4c6e-fb69-45d0-80a2-4ca9777fef59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996210, "uuid": "d82fef73-deb3-47f8-9773-f95d755247be", "value": "ac390d3e36cf4922ce11ffff5bca9b2f11f6863d094fddca27f7c237ceb05b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d3e806-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013012, "uuid": "63805882-8f1e-4522-932f-41765f31ad22", "comment": "Malware payload (Mirai)", "value": "fa2dc48b5d0b0c03248d3721551ce21a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013012, "uuid": "7fcd5df3-4ea1-49dc-8776-8f49c8b03341", "comment": "Malware payload (Mirai)", "value": "ac5dad1a2f5dd0883f386ca2f3bd62d944cf69b011d7dee6c462dfa7bfd57cd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013012, "uuid": "c4aa23bd-2958-4fcd-830f-50d2cb153590", "comment": "Malware payload (Mirai)", "value": "11dca4b9655a5c2f4b595a290b2457b6478f7b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013012, "uuid": "e645032a-a57b-4078-85cb-ade39d11b0a3", "comment": "Malware payload (Mirai)", "value": "7c7647700e6a39abab9c7f05852b15797d7ae591e1955743e7d253bc41b6b1f9a17a3323dd80d505edb0cdfe530f4d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013012, "uuid": "b59fc156-edeb-47b2-b2c4-6a0f50b777d9", "value": "T100A3D50A6F118F6DF76C833687B78E21975873D62AF1C645E16CE9001E6034DA81FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013012, "uuid": "594fb745-2e64-4a97-9203-7adeee73b242", "value": "3072:GiF8DONf2Ro954kPNOG9XEgGdHkt5T2oKKeJ:GqEONf2RWPPbXEgIEtDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013012, "uuid": "07a4ea45-ddc5-4d2e-b211-1052c72e77ef", "value": 103460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013012, "uuid": "611ad8a6-8c17-47e3-82be-9edf4846c7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013012, "uuid": "33f26c08-3a98-4562-b2f0-3c3f0aa0cf32", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d590e4c-e490-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766996860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996860, "uuid": "4a70c3f6-4bad-4ec0-a2a2-3398f1d92090", "comment": "Malware payload (CoinMiner)", "value": "f44c3408d127d2a6f1d055a7fff21ed6", "object_relation": "md5", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996860, "uuid": "b585dd82-5f68-416f-adbc-92cafe5ec3fa", "comment": "Malware payload (CoinMiner)", "value": "ac868493f7f305788a1934fe39bef7808ee3746fc7d97754ec223f19bbe06273", "object_relation": "sha256", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996860, "uuid": "8a424b71-4f77-4b3b-a66c-2d7b36bc6ca8", "comment": "Malware payload (CoinMiner)", "value": "dafa92de374c2465289e2e958d79e4f0097ebcbd", "object_relation": "sha1", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996860, "uuid": "50487106-ebec-40d4-bab7-4f9b98dc63c0", "comment": "Malware payload (CoinMiner)", "value": "49bd2484184585de6d2071250a134cee57644dc71b66db279ded05aa5b989417aefa16710bb52f09755a23b3808f2db6", "object_relation": "sha3-384", "Tag": [ { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996860, "uuid": "965220bd-dec0-4501-94c9-271917ebd153", "value": "T1F706BF47B3C46E99C005C939A707EE31D0A27AE38A76D0CA5F96D6094FF6B517B39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996860, "uuid": "2e66467f-d045-49bf-a2aa-c5f3c983c729", "value": "b84eb1980875be2b17e8b4652ad81eb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996860, "uuid": "4d22067d-ca81-48c6-ad30-85941e641273", "value": "98304:Qwr7BKDWZIrQC6yU0L46uPaSdk9KjdggUUTB/8AwCDfCQkIbCO63lJOx2q0b88Na:lrlKJrQIs6bJKj2U10GkUpglJOQp1HK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996860, "uuid": "6897f8e5-366e-4b81-8dda-c38ebbbfdd7e", "value": 3957248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996860, "uuid": "a11bce44-cea1-4c41-bcb3-98cd5f44fc4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996860, "uuid": "75bc467b-52ce-4853-ab33-672fd7b63a9d", "value": "heif.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b0e012-e4bf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767017295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017295, "uuid": "a4715d7f-7661-458b-8ea6-11f4052cb827", "comment": "Malware payload (Mirai)", "value": "e20ee7f6f8b29f8806fba8ee010d86df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017295, "uuid": "fb899384-9577-4674-93cc-a4f6c79dbbbd", "comment": "Malware payload (Mirai)", "value": "ac9db664eeaa929c478f19ff041cd83af460c51820726a4c8d53470f0824711f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017295, "uuid": "f6c701d4-3392-4ea8-bc0e-515cef52a3f7", "comment": "Malware payload (Mirai)", "value": "e5ebcb87800024ca4742f1bec4657edc825d8d1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767017295, "uuid": "d7bfa0ac-d6a5-4550-8cae-08685943d7f1", "comment": "Malware payload (Mirai)", "value": "b9992d31ae673df3f1d115377c9f52ebb0dbf29c73633bf8b06285f19eb4bdbe0ad58bfe12164d35df68dbd50e7298b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017295, "uuid": "37f734bf-7816-4a93-97a4-d5b8cf7da937", "value": "T1E6B30749FC819B11D5D622BEFA1E118D33135BACE3EE72129D105F25378A92B0F77602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017295, "uuid": "316ca88a-bb2a-4d03-bf5c-781b4f1cd35c", "value": "3072:NOSQFUjHRvZ+cwtZ05AalgR7S3okmYmUAGtOzpgeuQH:NOSQSjHRvZ+cwz2AalgR7S3mYeGIzp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767017295, "uuid": "482105bd-d453-4df4-8b18-1546bc83f52a", "value": 111972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767017295, "uuid": "9102e5d1-1734-4b08-915d-6acc2bfa89fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767017295, "uuid": "aa066ad2-e82b-4d82-9af6-c6441c3aec04", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb13d942-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031887, "uuid": "999dae62-16d2-49a2-848f-467e5bab1f32", "comment": "Malware payload (Mirai)", "value": "e29c5375a771beec4053d87e9d75db81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031887, "uuid": "0d14b626-91f7-49d2-8987-19a6ffd0e578", "comment": "Malware payload (Mirai)", "value": "ad1c8268c954350d84935f41c28ca5fcfd13ba8984e18a5370962cb60cb98b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031887, "uuid": "a46e0e04-2f5f-45f1-ad10-8dfb052f6c34", "comment": "Malware payload (Mirai)", "value": "796499af259e46039c39ee1b087ad41355a889cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031887, "uuid": "393b9d4c-31f6-4983-9c36-4580c234bf13", "comment": "Malware payload (Mirai)", "value": "701eb31b9bf2bd5baa0156f7da4d452a869bad9c7be7396826fc8f8264f625ff79e561660278ee3daae1cd47220c56c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031887, "uuid": "943ebc8b-592e-42e9-b25e-d011a6ce1c06", "value": "T1C6C36DC5EA43D4F1F85201B1117BA7328B77D03B2526EB46D3A92C36DC56F508A1B3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031887, "uuid": "ff5e58fa-c49f-4e59-a3ae-e858a719b03a", "value": "3072:aozz42sho5vVwOqYop2YA3+kzOFtvc9CFtYEX9s5ic0GK1VS/i9SkRnDKVi:hz3sSFVkYopjAXk79smei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031887, "uuid": "058e3e84-660c-453a-a017-17714e6549f9", "value": 126184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031887, "uuid": "5c960ea8-51ce-4aaa-bcd7-35b0c2a97796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031887, "uuid": "7e635854-6907-4cd4-9a38-8610b718bb18", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba43805-e4e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767033284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033284, "uuid": "3c83b448-9d99-4210-9183-53bc8e9bd202", "comment": "Malware payload (Mirai)", "value": "dd973426c7c3451d405afd4ecce15582", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033284, "uuid": "d7dd67da-ca84-41bf-a1be-25905319b540", "comment": "Malware payload (Mirai)", "value": "ad5b21edf00aaebe2f56d3d9a29aa5ae1a5c889f597503d98ef5a801a4dda536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033284, "uuid": "fb919cb7-7ece-4a6b-92ae-4067fc6193d4", "comment": "Malware payload (Mirai)", "value": "abcf7e470d03aad068e9ad589eb2412c5f48544a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033284, "uuid": "2a573cb4-c461-4db2-894b-737bbb155852", "comment": "Malware payload (Mirai)", "value": "6c556ce333ae226f32d707f29c945c8d13327b3eb7a6400620fa8b07cfaf0c852d710c5cdf37f27de8a09e7a4f5b8fbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033284, "uuid": "134a551d-b495-40d6-9dfb-c88001ee17b8", "value": "T17F34C50AAF650EFBE86BCD3702E91B0529CC601B22A93F757634D928F54A54F4AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033284, "uuid": "39697704-2c5d-49b7-aeaa-8ea6aeadd183", "value": "3072:hdcnP4/qVJ0kvw9g/5ViRMU3YTjDUEIRolFw4Y+Rth6BPK69fA:hCnAq0TWhUITJIRovS+Liz9fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767033284, "uuid": "cfcb7049-de8f-4e1f-b506-d302bd45b7b4", "value": 242216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767033284, "uuid": "f5181a32-23c6-4858-954e-b7328931e7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033284, "uuid": "9e766cab-cbc1-44ae-8d90-893621ece078", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc54356-e466-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1766979142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979142, "uuid": "92a96a1d-5222-47eb-b014-f9c468a76c87", "comment": "Malware payload (RustyStealer)", "value": "7140df2e1a379ae1558306567d2dcc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979142, "uuid": "dd87d2ec-a09d-434f-9036-1e6aa444899c", "comment": "Malware payload (RustyStealer)", "value": "ad930a4d0bbc040fcb3f44a9b6eeac8a416fc51a7d07571caa7c514e8c7351fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979142, "uuid": "e3f285e0-8535-4a93-a8cf-f8342363aa9d", "comment": "Malware payload (RustyStealer)", "value": "792621706024ec366b80edfce481082accbc6b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766979142, "uuid": "754a9cc1-dd2e-4f73-bad5-f029f4c5871a", "comment": "Malware payload (RustyStealer)", "value": "9c868139647a1e004b2e9e77b13cf9fcf5e2be7f5ce0c8931f72aab299102b972e2de0edf934b0a85ec9faf4259d0738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979142, "uuid": "cc5326c0-f13e-462c-9d96-f6e3a3aedb8f", "value": "T147A63815BA9A58EDC15AC874834A47239A31B0DF0B31B9FF448481793FA9AF91F3D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979142, "uuid": "f38bb94c-30be-41de-972f-83cc1ef1489a", "value": "eeb34546f747212c58df604582a9718c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979142, "uuid": "0cd97096-5985-488f-80a9-4ae0a49642e2", "value": "98304:f9sf2Iml/SxHmOBn9YI58pL5gvhkhzG0UfcV/Ogwb2HkCE:K0yn93SL++GIV/Ogw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766979142, "uuid": "e8066e04-5a02-45de-a3fa-716b8833aa02", "value": 10236928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766979142, "uuid": "b97c14c0-221c-4533-bf63-e17c95108dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766979142, "uuid": "de25683c-bf97-4fa4-b1c0-86b17a773981", "value": "kuina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c5a786-e48f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766996706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996706, "uuid": "c46ade8c-7ac0-4f1c-ab07-03335672251e", "comment": "Malware payload", "value": "3db1ce26ade51f066736b218e4f1ed52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996706, "uuid": "90ecf428-7621-412c-b6d6-713a5fd5bb1b", "comment": "Malware payload", "value": "adc8baebc4b1e22d46fb690bf61b0220833c49ba573dd7f0ce4c513aff969d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996706, "uuid": "3536bfe1-7db7-436d-a026-11a81b646d27", "comment": "Malware payload", "value": "15bb7bb55fd2b3a539685ebd6c43f0654e0b211f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996706, "uuid": "8c65ff06-d354-4db4-b19d-fe28e78f9092", "comment": "Malware payload", "value": "8a20eb7363ad68af5b5fbcdc3e2433221dd8d75e9f2cbd17f74d3638a695b23f5afb6c6a5c5748918ae1f6fbe832ec10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Filecoder-MF", "colour": "#720AA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996706, "uuid": "4469a14d-e8a1-4fde-b7c5-bd5fa5331d54", "value": "T14395AD24E3E911A8E937D638CA65A332D6B178520770E58F065DD3052F73EE19BBB312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996706, "uuid": "4dfd403f-7f40-4f95-ba30-a0becbed7244", "value": "029db62261cf32706ef84177901faf74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996706, "uuid": "8f37745d-4cdd-496e-96e8-e2d722488c42", "value": "24576:pkwpCotU1ZGVnsFbn1Ua0jUOqeXvY0wUF5XrXt57JFmcWt1Rl3rqoP:pkhotU1ZG0CLmDt1z7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996706, "uuid": "98e9410b-4e9b-4435-9354-cb1a436baa64", "value": 1967532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996706, "uuid": "81579388-967d-4add-9f4a-53b8b40ff3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996706, "uuid": "15092c9b-d0da-47a0-92a8-5413c9cec9d7", "value": "adc8baebc4b1e22d46fb690bf61b0220833c49ba573dd7f0ce4c513aff969d9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2beb6ec-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload (AISURU)", "timestamp": 1766988521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988521, "uuid": "fd1386a3-06af-4b1e-b281-ff7d53448a6f", "comment": "Malware payload (AISURU)", "value": "006d05676975ce71e1aab626d85259c0", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988521, "uuid": "a1541b22-07b7-46c0-98bb-7b51e91f8461", "comment": "Malware payload (AISURU)", "value": "addded16e05679dfa9b181131f2c8775425cc4548af2161c0ff7107e80534343", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988521, "uuid": "1db1abc2-4b33-4c49-bdec-c7ade9525b3c", "comment": "Malware payload (AISURU)", "value": "db330cd9b355dc36dcf57c69ea00ecb3053d7a12", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988521, "uuid": "f0305bdb-2076-413c-a713-1cc379919a14", "comment": "Malware payload (AISURU)", "value": "e9ddeed656d0c97f3b5e9c1ae3c9c5ae8ffa6a6c053e8b1d2ab65adfa5684bf487477021538714928f118f8a739c3a27", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988521, "uuid": "a4526e8b-77e4-44fb-bb42-3fde2d741c86", "value": "T112B38D33C83A6E68D12999B4B471DB7D9B53A51081871FBAA066C3F99043ECDF44A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988521, "uuid": "6137ec37-b4a0-4ab5-aad1-d7c53b571e58", "value": "3072:8mj7FpB72jUZqhXgavXk36EnFh03DnTR:8Al7rZGQa/k3Nc3nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988521, "uuid": "fc2f3def-b487-4eb9-9eda-64475b072440", "value": 108204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988521, "uuid": "b97ef18d-2f14-4d23-bc69-a699cbcf2245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988521, "uuid": "31c0c85e-2558-4d6e-9a5f-9e231e9eba3a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c3e9c2-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982429, "uuid": "ee11a2e8-356b-4c65-aa29-de236b74fe07", "comment": "Malware payload (SalatStealer)", "value": "9e05aafedaf9c9276c0f5fc6d9497edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982429, "uuid": "d7c2b561-0d74-465e-a576-f819db7285ef", "comment": "Malware payload (SalatStealer)", "value": "ae264d0647272e2dc13a91f0e6eac0bf5ea2ef3c847c66966cdcd54e7f771e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982429, "uuid": "2ef48f2b-2322-4be6-8849-ceaffbf28316", "comment": "Malware payload (SalatStealer)", "value": "cfd4fbce2da47a44284e594d9a5188fd3e62f9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982429, "uuid": "859a7c9d-fcb6-47f7-9fb0-f3d3fc367e02", "comment": "Malware payload (SalatStealer)", "value": "a7de88c40d38030555b064939cd9463f34e1aa25d9bdcf3ec071883b704f1b8d0cd97c8c7d8467ccc0ebf40701f87a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982429, "uuid": "3ceba186-2ff2-4bff-954c-7d7a779e703b", "value": "T1C3C65B51FA8B94F6E9031831405BB23F63315E048B28DBDBFB547B6EFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982429, "uuid": "854d79e7-976d-494f-ae92-62b5f005f525", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982429, "uuid": "9f90ff07-af18-4612-9f22-3f744ca20f3e", "value": "49152:DmKMmRcc+In8IkkUb/xcZAJZEpVrvu8413WUL8rakJNCt+BegA63gppG5mcSkRgc:iJmixJk0de9Yvq+vFJKwUPebJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982429, "uuid": "3879f5b0-1b2c-4aca-984e-2a93660024fd", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982429, "uuid": "103802ff-a486-4f22-8696-66e91a50141f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982429, "uuid": "a7895448-6e0a-4597-ab78-cc655199bc91", "value": "ae264d0647272e2dc13a91f0e6eac0bf5ea2ef3c847c66966cdcd54e7f771e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8b001f-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027244, "uuid": "21775ee0-5ea5-472c-a8b0-8e245a7b8752", "comment": "Malware payload (Mirai)", "value": "549c810f2103f76017d1e19104602f56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027244, "uuid": "52bf8603-c5c5-4e98-8ab1-05fe581edff4", "comment": "Malware payload (Mirai)", "value": "aea1040f5f89ee47ce974f9901109de5c66f91a7816aa5c8218fd6b1b42557a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027244, "uuid": "6815da95-9f21-4659-9b2e-9234324ae764", "comment": "Malware payload (Mirai)", "value": "db6d1cf4f938fca04c49b5bd085a5b22a9dd1142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027244, "uuid": "ab90c3ad-9f58-48a8-b076-b66be5b3d14d", "comment": "Malware payload (Mirai)", "value": "cd8f3ae03a479a33ba75bf09d8659d5db8684736e2f1733d9b1605c831777f54d7a1cfd20da9569cd70596ae0f2fc2ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027244, "uuid": "e6dde5b7-9ae0-4130-b029-9e8de28dc867", "value": "T1C97302E89B717059D586A1F365E5CF648AF72EF1C111C88243A5CB53C2E88783C91EEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027244, "uuid": "2bda9e11-b164-4ab3-a913-50ea5e3fb6e5", "value": "1536:bUtNuhVlVpd6F6gQTHZkiSA3y73LeBe6RVJuq:otkhVlVrSF0zc0eCVQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027244, "uuid": "17cf5b64-546b-43de-bb7f-0b5fe62c8645", "value": 74144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027244, "uuid": "bbece7ff-9226-4d92-a821-7ac21bc30320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027244, "uuid": "15e2badb-b6f3-43c4-a65a-7ec8df4990e4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84daa2e9-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989249, "uuid": "4ac66f89-05c2-4e36-be59-ef630957c003", "comment": "Malware payload (Mirai)", "value": "3c2a7a1f7babe4568a4d8e4d75d14655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989249, "uuid": "662e312b-eab2-456e-a4b2-a4e6fbf205ae", "comment": "Malware payload (Mirai)", "value": "aea53854bff9b042a2ae6029ed640972d0f48077d2cb32e0bfe905a2ecf0b521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989249, "uuid": "9fc18d63-2505-4775-b0a3-770016c62682", "comment": "Malware payload (Mirai)", "value": "17c6bdbdb53b771f6755a2c7069473c7a3ff2db3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989249, "uuid": "6ef36d31-f41e-4012-92de-b98f8a26cf8a", "comment": "Malware payload (Mirai)", "value": "24a2df563a48eddb40c3266dedc9ea96cb5d65aa2d45d6fb3f5b3600bc5b82cc183673e0eeae6c72998eb85d2eb959dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989249, "uuid": "9d4b28a2-4e0f-4520-b0a5-27a838539b57", "value": "T1D9C307327A701D1BC8CC537960F78361F6B2776960B8871ABE931E896F38385B5173A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989249, "uuid": "532be65d-feb8-4d16-99d6-2b43c36a69fc", "value": "1536:ZqMJEgIRv6QZaUdiIZ6jh61kXnQpbHUDofaM/YrHpPH310gqFjCKORR9D:ZqMJEgRELUDWn4lH3SKR9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989249, "uuid": "9e0eefeb-06bc-4fce-bbb3-942293397863", "value": 118184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989249, "uuid": "ac3c1feb-afc5-40db-8d1b-2d0e062c45f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989249, "uuid": "cdf7a167-e0ec-4f20-bb67-11186c9ad720", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeca9239-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982447, "uuid": "3539dfa1-65ca-47eb-b638-6692dc38d85a", "comment": "Malware payload (SalatStealer)", "value": "2a806b9ef69844c2646eb04008e1007a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982447, "uuid": "024555c3-84be-41d4-8ca7-6af4616116c2", "comment": "Malware payload (SalatStealer)", "value": "aeac8367711fa9a3b87315d6eee6426bf9049b40797dcd8dd5b13b31a5ec024e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982447, "uuid": "f54538bd-d850-4611-a44c-abaed5fb9ff8", "comment": "Malware payload (SalatStealer)", "value": "532dfb13602eadddf1611912f4afb7c7763c6f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982447, "uuid": "2d35aa96-533e-4f7a-a3d2-3b60b8bcd4f6", "comment": "Malware payload (SalatStealer)", "value": "06f92884cc720608e51b469ec933815089b61013b6cc2ffbfa0c4a007d805ae2521bcc76e93ea575d704562a3e91fbc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982447, "uuid": "870b28c8-363a-45a0-94e3-b72dd838cf2f", "value": "T11EC65A01FA8B64F5E9075831416BB23F23305C048B28DBE7EB587E6AFC776A11936749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982447, "uuid": "700c8e38-e9d4-49c9-88bf-1895600d4637", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982447, "uuid": "c020f331-2b0c-4a00-87ae-00c4f8bd6ecd", "value": "98304:JNKnPtF6QkFvmAec5mLLwChxmtBeNiEYQbz6G:ktFWe7cC/mt01YQbz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982447, "uuid": "555cb61e-4039-4238-9bbc-41a948d848be", "value": 12472320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982447, "uuid": "a41ce34f-239c-40e4-abb3-22f2f59fe472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982447, "uuid": "35c38927-f196-478f-aff2-dcce0b7efc37", "value": "aeac8367711fa9a3b87315d6eee6426bf9049b40797dcd8dd5b13b31a5ec024e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e0249d-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971403, "uuid": "b6b905ae-2ee3-4c28-92b1-53dc1ecf64db", "comment": "Malware payload (Mirai)", "value": "fa0e23676cb16a5a8803cb9a7ab72728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971403, "uuid": "f27e34b0-e01d-4051-9341-d3958390286c", "comment": "Malware payload (Mirai)", "value": "aef79964b2264cb0969d95dd07f69fc184583be7830622588e0d8fd8b5ed2cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971403, "uuid": "bf5c1c48-0fec-4157-84de-759bee45c783", "comment": "Malware payload (Mirai)", "value": "7a536e8a1085db5cf1e59edd3ffbeb7f597eb3fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971403, "uuid": "5f86d5bb-48c6-4dd8-a165-70eace824876", "comment": "Malware payload (Mirai)", "value": "af820310370680863a1a25f8199ffd98495d27ea1759a37846a726d2d349ee28f27aad263525792120205cfa751c3e5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971403, "uuid": "9f412a99-62ca-4027-8c8d-ec6efd480acf", "value": "T133938DC3DA52E8B1E8220079123BD765DA33F43160339D4BE7E52B75ECA9B409B513AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971403, "uuid": "de8ba4ce-6f46-4f14-9942-c05f39942cb2", "value": "1536:1qu+E9ubf4ZiVWv2NVGGsAWpEUEGr6gI+8AQB9OvW78GvKAYsp3QM6Wm1jexF:JM0kVPsZX7rJa9ZYGvKAYs9QkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971403, "uuid": "37508502-281c-4d93-91a5-c9f43f0daec3", "value": 95472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971403, "uuid": "070feb7f-9c9f-416b-9a69-6d8764709860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971403, "uuid": "c0c9cca7-2796-4541-8142-83bf287df857", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180d6522-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013977, "uuid": "07f7e1e9-bc2c-412b-b003-b76527e37f64", "comment": "Malware payload (Mirai)", "value": "d31f833f723f1ffcca29450e8d75cb5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013977, "uuid": "5355a5f4-7ced-4923-be8d-0135cef5c043", "comment": "Malware payload (Mirai)", "value": "af7f8c497b69d8358e9a367825754d740fcea282075f40b56ae00985038e002c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013977, "uuid": "780f8620-eaa8-47ca-9271-1eabe85f8bdf", "comment": "Malware payload (Mirai)", "value": "9c23c65560dca6b3ff4f091ff235faf715f987cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013977, "uuid": "7750aa52-e24d-4350-a63d-e812adb42cf6", "comment": "Malware payload (Mirai)", "value": "cf0fc6c9fe282f07b59e7d2b2f73bf0c374845fe301ae6a15e9eba6c4f47657268dd280e5697541f0998782df364449c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013977, "uuid": "0c608bee-80ce-49a1-9c48-afb6753ec30d", "value": "T185331980B8919A23C5D422BEF66E418D333667B8E2DF7217DD216F15778A82F0DB7601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013977, "uuid": "d8c949e5-b5d0-4e5c-8831-8ff74050d75f", "value": "768:dz8yp7ZowFQZyzfX8uvMWAwcuV6RchvjNlArl/HxbIT:uy5ZlX8qMRoV6ivklRMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013977, "uuid": "aafcddf5-667f-4335-9dba-4b6d6425d6e4", "value": 50760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013977, "uuid": "e1397d24-0212-4536-958e-9f2343e0e9ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013977, "uuid": "debe1852-defb-4c2c-9db9-f1032575a491", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9387dc1-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767011349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011349, "uuid": "2d4b3d6d-f0c2-497a-91bf-be7c61266fd2", "comment": "Malware payload", "value": "1b613bef696d1a1f0a022d96de65e017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011349, "uuid": "3cd6e809-fad5-454b-ae74-54167829f690", "comment": "Malware payload", "value": "afa56a90d2a66ba0ecd038dbd9b019e812395cb9c574521f6f926c5cf006e45e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011349, "uuid": "8a7324e3-f4d0-407f-b82d-859ad964674a", "comment": "Malware payload", "value": "91105331da3c251ba01ee0dcf01ca9af878eb110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011349, "uuid": "3afffa72-dab2-4a1a-b55f-942ee7658752", "comment": "Malware payload", "value": "d12417debf8eff5aecd655be0c97dffef05be38579f6b32dece2bd30372fb6ac9f3679d158cd10ed7df8b3cde3a8b573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011349, "uuid": "2b7e8188-63c6-44c5-99df-8870f7d11ab5", "value": "T1AEC3E746BD418F13C6C721F7FBDE429C3A257B6DD6EA3202E9257FA037864DA0936241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011349, "uuid": "fb007d66-0330-4b77-a868-9e505741842c", "value": "1536:fBGyj74eofgj6bStPRQ2PjZ44VbNn3bvSaPD2i/J4ObtUZPUb+OZlkSwyw2nREBJ:fBbj8rfq6+xRQ74P3bZD2e/il40b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011349, "uuid": "3d56d10a-5c9b-4e79-86bf-653757e99e5b", "value": 126852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011349, "uuid": "28f78d79-c79f-4105-b582-beab98b42ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011349, "uuid": "11b16919-e044-4653-971d-b99d0f060abc", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97f7c17-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986814, "uuid": "55ad3068-2977-446a-bfa8-abf6f8c04f82", "comment": "Malware payload (Mirai)", "value": "918ac9a4bf551359d78f4f9bfb258b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986814, "uuid": "1c024ab3-54e2-4043-8217-456dc2d05127", "comment": "Malware payload (Mirai)", "value": "afae3f6390b067171988379904e14e1e5050d103d3f9e5064bc0f83a767d4f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986814, "uuid": "e7acaabd-e066-4d3d-b1c4-d7521180aede", "comment": "Malware payload (Mirai)", "value": "5a0891efd60f47c96d20dc9e712695706a405b01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986814, "uuid": "6e75a87c-25d1-4a5c-9230-ec80127e2d04", "comment": "Malware payload (Mirai)", "value": "93eca58cd4b032785512c5ab5d2e74ec56e036b69fda560e946e1b2ec3a21308c7b55ebb8a6d3668f89f1731e78f665b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986814, "uuid": "6d17a083-24d3-41ec-84ac-622dde2ce7e2", "value": "T12C431896BC928A16C6C412B7BA2E51CD371663B8E1DF3203DD251F50778A81F0EB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986814, "uuid": "99a37bff-bdc6-4d32-9c2d-b0ac1964c7f8", "value": "768:2rK44JdmUMRDTYWNdLD4DvNVo0hXkdpAoY5tTcSPdt5Cjn1RavNPKquFmo:uK4gkRDE1FVoyApctTcadt5Cj1QYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986814, "uuid": "8b5a4f9f-3855-48e2-b68a-8fef8449c423", "value": 55656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986814, "uuid": "62a0f7c3-4919-44de-9bf8-ea903eae36ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986814, "uuid": "8ba0856f-405d-42cc-b99b-86cedbcaabaf", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8a38b4-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968349, "uuid": "6d80972f-d04f-4fdc-aeab-73d8057f222c", "comment": "Malware payload (Mirai)", "value": "4c0fe9d81cd32c289959577a4bcde229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968349, "uuid": "ad4b6a08-28d3-426d-acaf-511dac4b4f7c", "comment": "Malware payload (Mirai)", "value": "afcc4a034dfc09fdba21069698500aebcf41c650e444988337e3e22fb09915f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968349, "uuid": "d9834cfc-381b-429d-b43b-4285bb8fa9d4", "comment": "Malware payload (Mirai)", "value": "3d465ea9bbc8ffc9771605e998c089dda13bc971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968349, "uuid": "09aebcfd-8805-4155-a9c7-231652094d1b", "comment": "Malware payload (Mirai)", "value": "c837ef9560209f2d4d997f3f8da8653b56626ce41265e42169b63f7934aacdb00de7f5633fb7348f3a0652be4bbb22b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968349, "uuid": "938fbb66-19ab-4e9b-a429-3975fd49ff43", "value": "T17D730785B8D29B29C6C14B7BFA4F53967312A7D8D3DF7313C9184B64368B54A0E3E602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968349, "uuid": "e80d87e4-68cc-46a3-a93b-032e36dfebb3", "value": "1536:SWTnz2ant4i4RDc2N6qUQbZj1Mlh7khSrVq2eJTXkinz:XzK4t4xN6qUQbZRCh7MSrVHeJT3nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968349, "uuid": "22066323-6b71-4beb-86bb-2f1b34a4e140", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968349, "uuid": "cc525b11-540f-4ad7-9202-9cf6c11b6579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968349, "uuid": "e42e458f-576e-4fda-a940-3ebcaffb2c65", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d328f28-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995276, "uuid": "3a07735f-a4cd-40b4-bb67-615d48022668", "comment": "Malware payload (XWorm)", "value": "b28fe9a2735089aae29dd7f7cde9c051", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995276, "uuid": "63219970-f124-4752-9581-7903d7471e0e", "comment": "Malware payload (XWorm)", "value": "afcf3c06cc92aee7dc18c22e5fd4114222eb5d60ac3fce2ced75973b08ecc6d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995276, "uuid": "acda7bc5-1b61-4df4-8ff8-c7e650486065", "comment": "Malware payload (XWorm)", "value": "2027a15fa28fd54f1917525e03d18ca93b3cdbc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995276, "uuid": "5415f217-fe33-4b19-b525-9f06fd4e4580", "comment": "Malware payload (XWorm)", "value": "d7e4d39f73a8fcff23dac1d014932f2ab218daeeaa3b5b89545cc26c519583d3f6a9d0a1e3cd60e5d74a7aa51fa6a3e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995276, "uuid": "caf749c2-c269-4250-9f63-d48ffb71b221", "value": "T1E1633C80C75362E8B7BBF4BC851128CD2CA4F4981B766C52E54DB4866BEF10B19F18DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995276, "uuid": "18672366-5109-456c-8aea-ea2bb57c9728", "value": "1536:I9l/AoSSMWwt6No+NxKlbjWKUsc4JWQ2OlNYgHlKMeYjo6D7qu7H8KIS7N4Djusq:I9l/5MWwt6No+NxKlbjWKUsc4JWQ2OlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995276, "uuid": "8ee43a66-dcd4-4ac7-a978-7f9c94067014", "value": 69664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995276, "uuid": "05360536-3362-4bd5-b628-9908187fb6f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995276, "uuid": "2175b5db-43b7-4879-bacf-43e9db50fb98", "value": "invoice-1645080830.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acab92b-e4e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767033282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033282, "uuid": "2eb12126-91f7-48ba-8126-b3587742017b", "comment": "Malware payload (Mirai)", "value": "2688a0ff78f6aa67cee70d2d1a8c07bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033282, "uuid": "52f0b9c7-9b56-4603-aefa-9ce797cbc2dc", "comment": "Malware payload (Mirai)", "value": "afe21567a7f62493d7db5fcf88ba23a576451d2b74244865b1fa4f3cefd48f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033282, "uuid": "c3604ab2-0bae-48cb-92eb-9595204fc9d4", "comment": "Malware payload (Mirai)", "value": "8f26dae8e09b7a767f947724d2abd2e14ba4a80f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767033282, "uuid": "cd9b87a4-a717-4f9f-a6d1-da55f928d887", "comment": "Malware payload (Mirai)", "value": "7443a7c5aaf313819312333b4893b6ff7635226ab511ff8763898f8fe3bd8129cdf95e12900bd01b648d1d4a1fff3163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033282, "uuid": "7c0b5424-dec1-49e8-9f87-fb6fda3939a7", "value": "T1A894E0A6F3532E42C8D7953518CA9684964EE45F33F2834A3B13A5B638397778F38385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033282, "uuid": "ced5e871-2118-45ec-9a9e-c59594936d62", "value": "12288:wouodNYDGkAzJLoetj+1zR1/l88pgg/f:wo8CkAloYizZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767033282, "uuid": "3d41e583-7f0d-4b5e-b5b2-6e43b68dbf75", "value": 445100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767033282, "uuid": "29bff17a-47dc-4f78-95c2-f8d3e803037f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767033282, "uuid": "f68a2a2f-9085-4688-8a29-042eedf98dd8", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eccb4c-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966883, "uuid": "c4af1b77-084e-4469-8126-18aaa2ae0a7c", "comment": "Malware payload (Mirai)", "value": "b8675395ae2b4857da4b053d1a303bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966883, "uuid": "bfc094a2-c262-4061-880c-35d5ddfcc6f3", "comment": "Malware payload (Mirai)", "value": "b000dd53cd61eb1a012906620ff735becf3b3d90f08c5e793723d575e3143c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966883, "uuid": "6d3ededb-508f-4692-9bbc-b078fafead23", "comment": "Malware payload (Mirai)", "value": "5e5214748f7df80a857a349340493eb81d53ca32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966883, "uuid": "05385705-dfae-4b8d-bf9d-924a6063363e", "comment": "Malware payload (Mirai)", "value": "98cf2f93d5bd3d985524c0f5d1e8c78a97c2e45677b47192d9db825fa7e2fb1b4181f501f4e08ef4819ed4ec4360be61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966883, "uuid": "9939c53a-d45d-41fe-8bb6-aeed4a5e703d", "value": "T10C631232B70BFCD29692C5358ACB86851B1CC769D3F773B32F2C8579074558A936029B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966883, "uuid": "76cdfb60-c0eb-4543-8173-c84f8d2e02c4", "value": "1536:N+piQs5CtjJzAAG9ShlFwdsmR32HgoMpdUFE3IYVh5oy6Zr0zZSO:GiF5CfzAAG9ww132AoMfUUyA91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966883, "uuid": "a8dd1424-d809-4abf-bf53-2a532affe232", "value": 70168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966883, "uuid": "6161ad38-0998-4eb6-9f5a-ce761ef826ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966883, "uuid": "ba8a4f09-e2bc-4315-94f8-472062911bf3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d181742d-e4b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014718, "uuid": "6ee1e89d-9934-4c54-aa80-de56f15f3910", "comment": "Malware payload (Mirai)", "value": "33b42146cc38925fb90759cb486387d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014718, "uuid": "cb83b366-c06e-4d80-9ac9-53cfccea9265", "comment": "Malware payload (Mirai)", "value": "b1218b2ce52c3643bf267ef6a09e56a2ba6b20d2f9613ed01db3513201b4832e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014718, "uuid": "1fc593bf-00d0-4774-ab68-b13c41de1346", "comment": "Malware payload (Mirai)", "value": "20df0a5d92982c2cc124a4487f3796484bc36d56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014718, "uuid": "bcf2297b-f4a3-4576-8d1a-823d0a11464a", "comment": "Malware payload (Mirai)", "value": "63e3c9afa38baf7c4ac477453df73bf4877df51192d739e00711ca206169c5196f9f4eefea8a5e03d35e7881cdaded6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014718, "uuid": "a1754e60-161c-475e-b306-adb036490c7c", "value": "T18A146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A9977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014718, "uuid": "3a2bed52-3a5b-4f2f-b03a-788ae858c4ac", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtz:BZAyFzQSdS7IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014718, "uuid": "58a5a5f6-5d1b-48b3-abc8-483009d596cd", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014718, "uuid": "dd314b51-0003-4c97-aff0-aad68f8ce9e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014718, "uuid": "dcdd42a4-d666-4703-927d-da5e372f93d3", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7190d6-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995540, "uuid": "30b25135-f06b-4948-918b-ce966b1538fd", "comment": "Malware payload (XWorm)", "value": "f24c8f4465c9b19cf4761baf35423061", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995540, "uuid": "dd7b7096-ef30-4cd4-b73e-18b9c40d2217", "comment": "Malware payload (XWorm)", "value": "b139530de1fc515516961d902e9165537c0e7c08547127b0b8fa301e4bf1ba08", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995540, "uuid": "803f1e37-abd2-4090-a9a6-16091222b3e9", "comment": "Malware payload (XWorm)", "value": "91ded6b3cfdbec5554ed6941c26c8479be7f7d68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995540, "uuid": "4dd52c1a-d05c-4585-bb6e-5cdffcae55b7", "comment": "Malware payload (XWorm)", "value": "ee29598e3608fff61fd33fdc52a9542ce7004a68391a55351c7968c90be1b0a0c8743c21ae668e6b06fa4e85e21a264e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995540, "uuid": "03b6ae4c-12c1-4442-aadb-3cb65fdb3661", "value": "T1F0730BABEBC324E674D2A9389E49E407392C4D7F54B37A87025DFC9A4208D5DF329847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995540, "uuid": "06dd91e4-5dde-454e-be68-c61a4cb1c868", "value": "1536:I9l/AoSSMWDyDfDnDIDLD6D1DgD4DRD4DqDbDpDUDWDmDxD1DRDvDUDbDKD6DKDN:I9l/5MpJusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995540, "uuid": "403ca0d5-5bb2-4348-8c16-b4c83be4335b", "value": 76361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995540, "uuid": "8e75246d-4e30-4cdb-850e-491b5b4cffd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995540, "uuid": "b1342db7-85a8-45f4-8a06-46d9c7001bbd", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445aef67-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967236, "uuid": "7a12a22a-9d37-4925-8ba1-5e3f4ed9bf3e", "comment": "Malware payload (Mirai)", "value": "fab09bce9593a1a0995e8f492d61d503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967236, "uuid": "10f56316-5d7f-4eb2-aa3e-ef1696df5e54", "comment": "Malware payload (Mirai)", "value": "b13e9787aa2fc61e98f971ed588a9e57b8a58e5cdc54cba39a42df8e6615e638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967236, "uuid": "695b07a2-6c49-47e6-9b20-3bbc55a6f688", "comment": "Malware payload (Mirai)", "value": "5aa348aa17e27547480c862fb41c1b68a9235d16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967236, "uuid": "d3b6942c-7cba-4031-bc45-6b8a86e584c7", "comment": "Malware payload (Mirai)", "value": "cef07c2bafe352ec84d97ba9ca7fc797f1802ca919c9d14e53b3941cb2569af25017a697744b3bdf71fd06ebc39b563a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967236, "uuid": "8371242d-637d-4b20-aff1-61518d2c4ab2", "value": "T184C3D70ABF610FFBD86FCD3706BA5B4525CC594622A83B357634D418F24B24F5AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967236, "uuid": "757707ca-1e84-49fb-9f22-47eb6074a224", "value": "1536:6T49TcHNDF8wZydJ5Cj0MnZmvoBGLHRSju4PRR6hg7Pc5Ul/sYDgEHVEKuZ7Rdv:6M9wHNDF3ydHCV4LCIhg7vqoVEKuZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967236, "uuid": "ed6145e9-ab75-4ab4-9cc9-bcf9fdadea1f", "value": 119276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967236, "uuid": "55eff68e-6789-499e-a82b-065e54b44fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967236, "uuid": "226068d6-d691-459e-97ae-8141ef0d0893", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d888dae8-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767029762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029762, "uuid": "a49ac8a0-7bf7-4644-81c8-c440fe9d6823", "comment": "Malware payload (ConnectWise)", "value": "0bfdd4a7f15bef4020c8b5c7252b9b0b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029762, "uuid": "cca6252f-e94c-47f4-be10-ccc263f869d1", "comment": "Malware payload (ConnectWise)", "value": "b14dcdc31234226e0ee5003d74c9e64cf765ce2be4795624ff26feaa634efbe0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029762, "uuid": "863f70e2-6042-4f83-a817-4bd2ca2ef14c", "comment": "Malware payload (ConnectWise)", "value": "0d256526b3d0d5641754c88b378d0f9db56f8710", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029762, "uuid": "103e7d4b-f7d9-4581-a9ab-1815bb303ace", "comment": "Malware payload (ConnectWise)", "value": "75fcdc201de1f8483685dd5e13992276e8b356d020a180e5f1841ef9977040bdfc1ea5104476e1e1c25dc6d3f139a082", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029762, "uuid": "89819a8d-4be2-482e-a188-77764d54d217", "value": "T154A6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029762, "uuid": "8ab42efc-d05e-4b29-8edb-a2a7e25fe29f", "value": "196608:AsuCcGaDpNmcYMDCsuCcGaDpPsuCcGaDp+suCcGaDp:vuGNhMD1uGpuGeuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029762, "uuid": "d1b1e7fa-ff11-41d2-942e-be7d1937e0ec", "value": 10059776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029762, "uuid": "cc828ed9-f1ee-4cd1-b458-c9a5c2470a94", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029762, "uuid": "433aeb38-eb35-4d70-8a34-28ad6c3dab56", "value": "2026VIPcARD.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4338c0f4-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968952, "uuid": "59111a09-8a3b-41ef-9caa-41fafc00d261", "comment": "Malware payload (Mirai)", "value": "ec68e4f8abbb8796a811768e847f9b77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968952, "uuid": "075b9387-cd90-4848-9a76-d94aa4867640", "comment": "Malware payload (Mirai)", "value": "b18b6021c28ea80a225376535b682e2f3a581940328dbe47d9019672da7e29b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968952, "uuid": "da3a3bea-8630-443c-847e-528708b01fcc", "comment": "Malware payload (Mirai)", "value": "101cb0e053645ce2c992835dbd24e8cac0972b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968952, "uuid": "638eda24-d7d2-4f50-adae-1b4d6078f683", "comment": "Malware payload (Mirai)", "value": "5be7335df4fb3807ceb10fd3ef93cfda19c2e6096f3360f0b32e1c5dcccdc992cf8137dad27ad6bffa6f2759dc2ce7d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968952, "uuid": "a3e7f644-a19b-4a50-b1d1-8d3d34de26ee", "value": "T15404BEA3B70B28D1C86006F807CB5F9D6A2321138DA7D6E3BC5F35396A365DE25163E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968952, "uuid": "f517adc8-4995-485c-bee2-3c0f9f171880", "value": "3072:TWN8CaqqZ6PKPbdiM6lWL6K8L0vBYGObLWgICvYlOE+ub01qMq:CNoqC2WELOqVb0CvYllMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968952, "uuid": "2db05671-51aa-4f66-b9da-b4f05a57e4db", "value": 190132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968952, "uuid": "7c6381f6-5dd5-4b2c-a7e5-9b4b0246bb5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968952, "uuid": "fb54ec5d-89ed-4fcf-a9d7-69bba6396629", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bd0608-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013978, "uuid": "af283dec-4be6-4db9-a284-88a58d3dbf05", "comment": "Malware payload (Mirai)", "value": "12148af102127b2e26ef8065564cb1ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013978, "uuid": "4ebe42c8-d68b-44a3-9ff0-8a0db7004d30", "comment": "Malware payload (Mirai)", "value": "b1ae5dd7c7751e19e690ff321b9b4d6f61e914c27fd2276efd665d6003c39bfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013978, "uuid": "746a19cd-93e3-4905-81b1-c2744decffc0", "comment": "Malware payload (Mirai)", "value": "6cca4bfd7f98006776364f1bf48bf32f4267de93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013978, "uuid": "9180a144-b131-43b9-8dd1-ff8ffc896f0f", "comment": "Malware payload (Mirai)", "value": "d4fbf246896098a77d836b02b5edb77d14510f1b0ab60658f00a860c6e24a4265a50ad4a7bf346e9d51003a87b5b7030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013978, "uuid": "004537c0-fd88-498f-a771-22b50d3db3c6", "value": "T1F5731985B881DA23C6D422BBFA5E41DD332653B8D2EF7203DD256F157B8682B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013978, "uuid": "1b90ee89-8839-4424-bc6d-bdf1a766e6d8", "value": "1536:w7GJSnrf5V7CJL0wKfAnBoqgPkAYhbnnwyPT2bVR:w7GJtJL4AnUmTn3PT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013978, "uuid": "d3ed4579-b4e6-449a-94da-23214212732e", "value": 79780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013978, "uuid": "c3eca1c7-5c51-465f-8060-696a3271ee2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013978, "uuid": "224bdfef-9195-40df-be63-622b90c9d805", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59062005-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995188, "uuid": "477fc5d1-c182-41d0-8c73-8aaf44316af4", "comment": "Malware payload (XWorm)", "value": "2eca031a20777997081744e32ef5ac80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995188, "uuid": "27f7e644-1069-47a2-9887-090a492e3604", "comment": "Malware payload (XWorm)", "value": "b1c53e1df066db5b9a447b9cb93ed9e90b18375cf7fd01de354aed60e68e5977", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995188, "uuid": "a4cb32d3-4b86-4342-b757-29580574a1f2", "comment": "Malware payload (XWorm)", "value": "e9a7e0f4c2e03f2b300e561653e593c8ffc98cc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995188, "uuid": "7be373e8-e6b6-4e51-9893-49f9e61e60ec", "comment": "Malware payload (XWorm)", "value": "0906c062439f52e77042705664bbbb79187666fefbd9bd5fd34ee3ac437e3e8698f5105b2b70462790855d1c2e11c28d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995188, "uuid": "ecef3a84-e35c-4798-8f7a-48c16c1780a2", "value": "T170731BBF6F2451F7B831D5A08D293B4B3C9C7A911DFA6CBE13B6F921130426B824615B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995188, "uuid": "28eba98d-c728-4c57-b304-77e69ea1c9a2", "value": "1536:I9l/AoSSMEIFIYIvI8IGIlIDIbIuIqIJI0I3IOIMIiItI7IAIdIFIJIAIlIeIpID:I9l/5MVQusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995188, "uuid": "fac00556-049a-46cf-84b6-9c2dd0fe7250", "value": 73515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995188, "uuid": "d9d0e6bc-587f-4935-ba58-d842a200f42e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995188, "uuid": "fa97c203-ea71-49ca-8395-b4e3a57aa2b1", "value": "invoice-1645080830.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7388420-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972610, "uuid": "c8eefe4b-25b5-4bbb-b886-053fc22d25c9", "comment": "Malware payload (Mirai)", "value": "ad0533f4309f79667e6b116b1c040d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972610, "uuid": "26915704-2d60-4f70-9eb7-55a6fedaca98", "comment": "Malware payload (Mirai)", "value": "b26d9f28bd02ab5e05990b5894b607e175a406f5bfdb9db11db2129e7400c3a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972610, "uuid": "c973e30c-622a-4bfe-9960-cbb0b4ac9eec", "comment": "Malware payload (Mirai)", "value": "a86827f95b9a40c140e42d906c361b87bb2b1ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972610, "uuid": "87b54bc3-2829-4157-9052-6e44dcd45643", "comment": "Malware payload (Mirai)", "value": "a58d6e64bb2e979efd468442c5c96e0bc7570736ba4f506d7db883e973acc8fda820d6bce5d3de1964a207aea0d3b502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972610, "uuid": "3474e16a-deb9-4c33-9528-601e11128485", "value": "T190C307327A701D2BC8DC533A51F78320F6B6376960A8871ABE930E996F3D79475173A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972610, "uuid": "16ad269e-2c56-4120-b5c3-ffeb2ee0fe64", "value": "1536:4blqzk6s1snKdJqG9MGliVr352m+MEd08rPFM0f3draAYTRg3IVhbx:4blqG1tPQ5j3ElPFD3dRVIVhbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972610, "uuid": "506cc107-c93b-4326-b190-52a9f651433b", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972610, "uuid": "ad41f001-3298-4247-b8b9-277e41d23edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972610, "uuid": "63e4fd49-6e46-4905-a3ed-62aa0adb1eec", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b2cdad-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972411, "uuid": "ec07343a-0326-438a-a565-b539e7204ffe", "comment": "Malware payload (Mirai)", "value": "4aa468ac5548eb43249674103ec88216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972411, "uuid": "6745d708-aaf8-4778-93bf-2af8266f5c42", "comment": "Malware payload (Mirai)", "value": "b27b1e9b4a3c56740432931f804f4bc0801d55ad4433ae9b55de1fea8414cdd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972411, "uuid": "d96c0ccd-f718-4905-af4a-41351c5d2962", "comment": "Malware payload (Mirai)", "value": "fee883d38705ee403807e44f53a781c482a73093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972411, "uuid": "99f1571e-39d9-4718-a75d-ae9313ea03a4", "comment": "Malware payload (Mirai)", "value": "3a5fe8190c9ac8c551f9e77ae8d91a3a1d736b1aa5d70d4f4e0fe7e12af4360db1446e77bb4b0da2410423f4ae392d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972411, "uuid": "ac769e41-67fd-455b-868a-894a5e27dd17", "value": "T138637CA7C9261E08C129D9F0B0F0AB795B639565858B0FF91A66C675D0C3ECCF6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972411, "uuid": "26370326-f934-4e74-8625-502b656c29f5", "value": "768:mXqucsfZiit5TlWNXVwKKnTcxa5vof3t/CZkj19dh0ud9f9WLOtINW6yXNygXL/k:mXPwcl0KnTccS/t/CwbtW/W7XNzHRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972411, "uuid": "ac0de7b9-2a0b-4926-9f40-869276b79fcf", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972411, "uuid": "4b9de23a-bf97-4c2e-a1f0-39cb30ac9297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972411, "uuid": "b33a59f3-4f56-4e5e-9c2f-8fbe4e081e16", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa8fc6f-e47b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766988051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988051, "uuid": "07afcd35-6c03-4627-8e53-6e73fe15699b", "comment": "Malware payload (Mirai)", "value": "46ccbbf869c0fc8d2f4f17077e19349c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988051, "uuid": "c4905ece-07a3-4a50-bec2-cf6dc5b8af1a", "comment": "Malware payload (Mirai)", "value": "b2a5357daca8b566097e7702516fae0625d20d00f55fc8c5c76b7fff8814abcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988051, "uuid": "cb79523f-6f1b-4a46-9767-8cbc93ef4699", "comment": "Malware payload (Mirai)", "value": "7e0bd84cc6e0cb296d622275daf8277d503da968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988051, "uuid": "f5a05bbe-b6ad-4fa5-94a0-7b9ee3ac6b2e", "comment": "Malware payload (Mirai)", "value": "181a3d077e9ef4ea3140ed66639889e4ed11a0cda3ed3e1ea80670c866b0475427f1d4a349b0ff14aaf93ac0314c9426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988051, "uuid": "0f71b934-24f5-40c1-8df9-fa1d18fcca72", "value": "T13BE31945FC81AF10D5C226BBFE4F428A33135BA8E3EE7212DD145F2427CA95B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988051, "uuid": "1fc5c337-79ae-47a1-b5ab-4555269e1fa4", "value": "3072:XFSmLwtdl55jnVh0XBun1L2hDzlrVeK95EhiatQNROY7+HJkO5ORFz4XMmrwnTP5:XFjLwtn55jnVhgBun1L25l0K95KiaqNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988051, "uuid": "3f3a6204-04af-4f80-b97a-fc18a2ff0fb7", "value": 148748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988051, "uuid": "d9c4639d-7775-4ce9-ae0f-f4343fcaf775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988051, "uuid": "a3c520e2-616f-4b6e-9785-3032a713a21b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37c60c9-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986804, "uuid": "25ae80ef-f34c-4ca8-bed7-a5802463fa13", "comment": "Malware payload (Mirai)", "value": "b97a0c9f5ced43eaae19b0d9f7637432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986804, "uuid": "44ff1b34-0ccd-489c-a18c-3eaaae9770d8", "comment": "Malware payload (Mirai)", "value": "b2af2563d7be6953b0d71e6fe92ed1120e168568c22871f7cb4a24eaa4834faf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986804, "uuid": "26786b7e-338f-4b1b-a0de-14847b5cdd9d", "comment": "Malware payload (Mirai)", "value": "bd210efdff1af3e15162a2db3ca4ec2b21d843e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986804, "uuid": "0aca7224-2ea8-4ef8-ac2b-d42f83202b64", "comment": "Malware payload (Mirai)", "value": "55ba75bdb3383ad792dd6dfd662cd32cb6a6b669363ee79a6abd217b12044f1876fba380775dfa0ec05b452a6a8f05d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986804, "uuid": "49b1a5ff-9bae-4b68-825d-d108d272ed01", "value": "T193631946F8928A15C6C412BAFA1E118D331363BCD2DF7212DE145F607BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986804, "uuid": "680c7811-3bf6-421b-8941-3f37d1a7a48a", "value": "1536:ZBnUqG3dCZf4jRGf1xJjaZbkladAOyFbKMViqV1krAo:MqGSf4VGd7aBkladAZV1krA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986804, "uuid": "12086d11-b1b1-49b6-81c5-df02d54efb4b", "value": 66844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986804, "uuid": "aa84b0eb-b8cd-49fa-98f0-5a463a2fbbbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986804, "uuid": "e686d172-18c9-442c-bc9f-44e3f1e59bf9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0d1be7-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026973, "uuid": "d8485ef4-9a8a-48c7-baa9-25f3d8ce410e", "comment": "Malware payload (Mirai)", "value": "68dc7d3a6ed3d2b199ed496e12978503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026973, "uuid": "c9958acd-9fb6-4452-b9ce-d2fb49de3263", "comment": "Malware payload (Mirai)", "value": "b382c79cb327b122849bf1c2dad9142baef34b1c675a89f62cb82788b3782589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026973, "uuid": "901f4885-bdf4-46e5-88da-89f1bf133ea3", "comment": "Malware payload (Mirai)", "value": "82f0c84b0f591619b2a1954827d77bdad2f738d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026973, "uuid": "26662c5b-79d3-4dbe-8743-dbd22210a812", "comment": "Malware payload (Mirai)", "value": "b352046205a4ee47af5bef2134b0606dbe351fcaae5a070f88b7e7937bdbca9efb9235758d984ea7aafb89fcf4b43be2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026973, "uuid": "35e2357f-3ad7-46eb-a1e2-ae2a15453f58", "value": "T1C8D38CEB738BD850C46106F007C78B8E2E6322158E1B99E72E5E2579397D6CF1D1ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026973, "uuid": "1cd275c6-2f3e-492e-9643-1412df33f9a5", "value": "3072:3HTFLRvSjV0UKwx7VRfQHH9/kvxIUCggV0TygHnd+q:3BJSGaPR7vxLSIUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026973, "uuid": "e0ccf960-0bfb-4693-a2da-2a95ffda1b52", "value": 140648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026973, "uuid": "d849e43e-d361-4b77-843c-1bef14779a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026973, "uuid": "39c52e0e-03b2-4c41-804e-bb58d02914d0", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34366ca-e511-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767052463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052463, "uuid": "fcc0b2de-7d9b-4e08-8566-b7faa63a0b8a", "comment": "Malware payload", "value": "536cd72ab724b566019126fc50d862eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052463, "uuid": "b740f627-0c44-48d9-aeb6-57f0e7b06f6f", "comment": "Malware payload", "value": "b3a1923db049a29cf8f95979a9919a977a45f82a6736048d4eec34b1996c5c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052463, "uuid": "c22d6f52-d0c0-40b4-bb09-80e05e473914", "comment": "Malware payload", "value": "d051abe5ee783c812f763169b67fc9f97b6014bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052463, "uuid": "5427e02b-a56f-4011-a939-0c3285d503d7", "comment": "Malware payload", "value": "aa7c76e117c49594206b30bd3ae6f75635c18d5647ee7ea4c2b5f9b73289f25e77b16f1fe678cff72900eddab81bb038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052463, "uuid": "e2243da1-62d5-4698-b95a-e8572abadbaa", "value": "T1085733DA13C863DDD7C20588658A418A74C4F8BD48FE98197DCB1D06D638DEB90AEDB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052463, "uuid": "26f5829d-848a-4176-b2f9-e134c48ae1e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052463, "uuid": "344c106d-7323-4fc6-bca8-53bb1ea40eeb", "value": "786432:hsc51W0Y0//W/8Pfsg7rNH9NjLwm/NO4bu:hscfW0VOk3zx9NPwmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052463, "uuid": "b6b6a9b5-151e-45e7-b699-7a10c337e309", "value": 28258816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052463, "uuid": "a7ceccfa-9664-49b2-8610-d8aaa8e0e6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052463, "uuid": "e554b744-e8e0-422e-9cfa-ebc4945f3667", "value": "956EAFE70CE4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8ef8f9-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982501, "uuid": "d592644c-adae-49d5-992d-2ac5b7fe139d", "comment": "Malware payload (SalatStealer)", "value": "68c1f9449bd5ba63c037bca776c252b3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982501, "uuid": "177fc7b8-2dae-4969-b813-54be894ca817", "comment": "Malware payload (SalatStealer)", "value": "b3b72b9e5843e3a3fcedbe4d5229de9364faa9aa5cb407fabddd364fbead27e4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982501, "uuid": "f81e1539-5b7e-4944-a3a9-44d8d38f6f41", "comment": "Malware payload (SalatStealer)", "value": "7db9912a7e6cce127e61a40356294a7929200cd4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982501, "uuid": "fb9ba43e-b539-4487-aefb-86928f5aa97e", "comment": "Malware payload (SalatStealer)", "value": "58b55a0d321d62526940095270999881ac3fe93defdbb919273c2a0089e66ffcfd287865812befca768dd722a166a241", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982501, "uuid": "efc412ee-5800-4558-866c-05a5e9009529", "value": "T14C22D76278190C170494F4968C7788423BAF42FB36816FD471DB105E6BF738A43BEAE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982501, "uuid": "96cb7c0d-d1fd-4a53-8b74-e7f9a542e314", "value": "192:ckv82QHaSS+o3hLT927t1Qx+zZ0LzncC4pOWjiYJ8zmrmEuT3DH+/nJpFNc9cjkG:cwtQHaSS+oxLT927t1Qx+F0Pc7pOWjio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982501, "uuid": "f616adef-b562-41e3-aada-761c49a6f0a3", "value": 10299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982501, "uuid": "6439c022-3ad9-402b-8c14-8bc75dc5f127", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982501, "uuid": "d6f58d3c-568e-4e94-8860-f7a2661c22cc", "value": "Deterctor.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3300bf7-e494-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766998829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998829, "uuid": "78394a83-3655-49ef-a549-c920c16a0f55", "comment": "Malware payload", "value": "21288485871cf5401af40f99de3a0686", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998829, "uuid": "91671902-7c4c-4ae4-a814-ada350f2222f", "comment": "Malware payload", "value": "b40d1d081d3fc54d640a6f1137f3508d04a45935a8b2cb12ea67a01c36506287", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998829, "uuid": "2079d04c-1ddd-4631-9094-8198e12e9e2a", "comment": "Malware payload", "value": "fa31ab3b030abd2ff89d3aefa66f3b8efbc2946c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998829, "uuid": "f97e5cb0-0cc7-48a8-986a-a3fa16906e9d", "comment": "Malware payload", "value": "94896ad47b7ac14d229379a879a743eecdfd4b8b91ce9604bc5ad0a57f360f2a024d311f20843fa02d1edf0a0a65f556", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998829, "uuid": "80764bb6-2b59-43b7-b08a-43693d0521b8", "value": "T12701266DE2A88A4208B5C5CBB5F4550AC041808FA2AF97F9F38D092A6F28C5E345320C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998829, "uuid": "fb8eaeea-2cbe-4cbf-9f76-c6807467bca8", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+MjRq7MZ7eBcBc5ZhG+E/:FH8j/wWi2jz8VEKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998829, "uuid": "ee51558b-1d1b-415b-a0d3-79f12bb7af3e", "value": 747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998829, "uuid": "70821c28-58fb-4ca3-abfa-fe2c73de48d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998829, "uuid": "f186a48d-e777-459f-961a-f950bab78b3a", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae1b498-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968348, "uuid": "9dc045c1-5714-4f2c-a3d4-c2fab06f5392", "comment": "Malware payload (Mirai)", "value": "069e436bd70b867626c4c2b0dd15b65f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968348, "uuid": "0d11e554-d138-47d4-9bb7-df0c96114c0a", "comment": "Malware payload (Mirai)", "value": "b478ae15fc12ba5b35d3b572ba0f23e18cf9daf39e6339a9bca12084e58797e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968348, "uuid": "7e31e1ac-8eb9-4d1e-8e70-3f98388b7111", "comment": "Malware payload (Mirai)", "value": "4956eb6d8d1e9a8c4138447735126db1bf38e1b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968348, "uuid": "407bde99-6e51-4554-92bc-b9f295023019", "comment": "Malware payload (Mirai)", "value": "eff1ce7904383c16f60dfcab8a0dc5f59c4cceafc18aac4ba2a7d29bebfe9e8054f0a1140a4d0161ed05eaf9b398395b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968348, "uuid": "f9d5b495-2517-49e4-8aaa-888cc0d48e6c", "value": "T15D9319D5DE53D474E8390B7610BA17338F3AEE7A5079EF56DFA19EF0A840201A24726C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968348, "uuid": "639a45d0-0049-49f4-805e-8ae8eb90ffd9", "value": "1536:vIuVvzNWnOaRpYnQMHZQbnfOxFsbEGgfiJ2zXldQxsstH+oDpRRhiiiuw1r:vIuVEJqW7fIFvGg+2TzEReoDriiiuw1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968348, "uuid": "60ca4cb3-36d9-4280-b7d7-c45969102f45", "value": 93040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968348, "uuid": "100ff52f-5dc6-4a26-ad36-6e5a5d231816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968348, "uuid": "c8d1ac4a-5759-4373-8fb5-8c9e7f2726f3", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b664d20a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995345, "uuid": "07d6eb80-c607-47f8-9a72-d2b638e32c0e", "comment": "Malware payload (XWorm)", "value": "fbffda1c10b9d3f9d6648da3be3a8c5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995345, "uuid": "97071c7a-ee0c-4ed7-b30d-b6c1d9d79d30", "comment": "Malware payload (XWorm)", "value": "b4b1d3af5af5625ce591717233be500d142c09eecd0e2aee2ecf9c401cc652dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995345, "uuid": "d72d8fdf-a268-4edd-8b62-58ef1b174434", "comment": "Malware payload (XWorm)", "value": "c749f4cd66572660a77fe210c953d09aed5d3d4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995345, "uuid": "e50c153b-dd81-4307-9f4d-4cf2ef8436e2", "comment": "Malware payload (XWorm)", "value": "eef19da8496b7bf90619382c999e1be6d7b05dd60688e7a3b62ba52b23c0e42483b71a471b71d58981b45bef0040b021", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995345, "uuid": "4ff50431-259d-4c7c-86fe-8466125e606e", "value": "T1B07308B6BE0471DB0473AEEB75CF6213631C62216D24A8D5B8C5FBD064BDA10EAC1372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995345, "uuid": "b8f686a2-e9ae-4568-9272-10a763ff9347", "value": "768:I8w/h62/jWs6oS+xISN0vpsmQVLQo/ydkfScBYrwz2y8kTAlGB:I9l/AoSSMK9LQwyusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995345, "uuid": "2983e5de-435a-414b-8f3d-87fb336ed120", "value": 73435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995345, "uuid": "992ddb74-90d6-47fe-be05-7eb62df832ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995345, "uuid": "7fc33606-5365-4b9f-9e41-952d01d7eca9", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a1bcc8-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767029680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029680, "uuid": "b41e3de1-355e-4865-95d4-cb7566fa8df0", "comment": "Malware payload (ConnectWise)", "value": "0228bbb0b7138f4406fe554457752f43", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029680, "uuid": "620f55be-30a4-4afc-b067-6a33aeb848cf", "comment": "Malware payload (ConnectWise)", "value": "b4e20e6ced6c0f6a405f19cd2955e30bad60b7fa3490842c8b813ebcd184761a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029680, "uuid": "e7e67942-a883-4618-838f-33328d0a5981", "comment": "Malware payload (ConnectWise)", "value": "785aa22d0c6ac062d85d23991ee10ed40bac7916", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029680, "uuid": "aa181c47-946d-4fc6-8aae-28455ceba3a3", "comment": "Malware payload (ConnectWise)", "value": "a11d71497d1e7f6d98531a623ce230abcd51762062cce1705802442d10fda6004dba7e68e33b6e445e1554ccf6055306", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029680, "uuid": "e83798b2-b4bb-470a-9139-ae004a7f3c14", "value": "T1EAA6233066F8D226F1BB0A31FD3991B14C7ABC64E922C15F0364391E1DB5E81AA72777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029680, "uuid": "a65f1c8f-ce81-4eb7-abf0-f8183e58ba42", "value": "98304:rqPUuYs+fvXPYGyOQYG3L3WsjOW9BMQwqPUuYs+fvXPYGyOQVqPUuYs+fvXPYGyP:rgnsvfO3WsH9B0gnsvfYgnsvfpgnsvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029680, "uuid": "a32a2420-51da-46da-9481-34df5657f5e3", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029680, "uuid": "f09f452b-3eef-4242-9642-973ddd1e0296", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029680, "uuid": "c4847dd5-3e3e-4b1b-b7eb-9faae21cbf48", "value": "view.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06bbe42-e44e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766968760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968760, "uuid": "4f1dcbcf-8815-48a2-9408-c0bd8f6c0771", "comment": "Malware payload (Mirai)", "value": "47dc4166503e4e93efbd841b8bbe178f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968760, "uuid": "c0f67527-8f6d-458c-bdfd-ae48353adbf9", "comment": "Malware payload (Mirai)", "value": "b505822ce0162021e1e00832d250c1abc4459a0de6512fef48665016d12df42b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968760, "uuid": "66c97457-bc59-4695-8bda-33e292c6865d", "comment": "Malware payload (Mirai)", "value": "0dafcba7fd084e30998e596f9b502c2239b20249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968760, "uuid": "6a5117fb-9717-464f-bde9-fdc333c54cae", "comment": "Malware payload (Mirai)", "value": "60bc328345e9cc7f2520eae2a49038e5a97e42701f958e9848fd7616349a1a1c3fff3f2e82ae415e210c5b433a8af0fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968760, "uuid": "7104ea2d-c7b2-48b2-8491-807dac755146", "value": "T1C1930856B8818B16D5C412BEFE2E128D3313177CE2DE73139E14AF24778A86B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968760, "uuid": "3061f701-bd8d-4137-9565-8a007ec22031", "value": "1536:RpnGezQgXLgbHIWpqTa1s/VdfD7oZ0V13BWvj3JT2lTAKaWQw4kwMihiaNKlbucn:BzQKLapuE8VZD0Z+3B456lTAKaLNKhuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968760, "uuid": "66967a26-30db-4600-943f-3e6b41cf8ce5", "value": 93952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968760, "uuid": "92cd3850-2e7b-4458-9357-74e83236c2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968760, "uuid": "4e03d8d3-617c-4233-8bd7-8a0aba851d97", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0adcf6-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027241, "uuid": "96d832d9-01ad-41e9-96bc-54bd47b9f644", "comment": "Malware payload (Mirai)", "value": "16016f44fd3ff0bc3d586a38dfa10a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027241, "uuid": "c79b8da2-6c79-46f7-b7da-c7180dcb37e5", "comment": "Malware payload (Mirai)", "value": "b512026957363ac2ba04b8f0e5347d7b1efa0903fa78cb8f5d90e8d66064cc55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027241, "uuid": "58d65b81-82da-4933-964e-d16faa544fbe", "comment": "Malware payload (Mirai)", "value": "09acd6861038af4df7c0952311af2743446391fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027241, "uuid": "d43543ae-5281-441b-9e97-6fd444fae894", "comment": "Malware payload (Mirai)", "value": "32a15876b03aa77c16c54df2fbf54d59e0b4c8ef9ee403660ef7b654e8cb681de846261ce1bce2015b99044560b7bb18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027241, "uuid": "8c54104f-1825-4ea2-bbb7-a6a7acbb6d6a", "value": "T1FE83D509BF610FB7DC5FCD3B09B94B04288C950A21E83B3A7974D818F25B65F69E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027241, "uuid": "e1aab8d6-6e67-4d25-92f4-8ccea7cee608", "value": "1536:onhuWG4eSN4+4vJI453h8w9pmiqp583ny9Meu+7R0p:ohuQeSS+EJT33Lxeu+Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027241, "uuid": "7283e4b0-f740-49cf-88f0-cb1f906aec3f", "value": 86240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027241, "uuid": "03ac3c05-2790-4381-b2e8-a3d084d77b46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027241, "uuid": "e6e52584-ac74-40e8-9146-5e7a71d2cf47", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4552965-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028064, "uuid": "bc2ddb6c-0669-45c0-82fe-bc2996b581d5", "comment": "Malware payload (Mirai)", "value": "01c33e8c267bd9cb80a6171aa9bb12c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028064, "uuid": "26d164f3-a353-40e3-a4bc-0c864be6357e", "comment": "Malware payload (Mirai)", "value": "b5169ed289e060fca1b45ac784f909bfb2be8af98b1b02ef326540d887f9e9b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028064, "uuid": "9fb14c6e-086d-466a-b7ff-e895e4247519", "comment": "Malware payload (Mirai)", "value": "45a542a5cf0fcbdbfff0a3d6a7a9921d56cd57f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028064, "uuid": "14493455-680f-40b1-ac24-5818cf43a5cc", "comment": "Malware payload (Mirai)", "value": "2169f23e511b564643c180b80573286ea42439e9087c42aa757811757f6609613de169f409cd7afa1da26993fc63a27b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028064, "uuid": "93284835-6519-41e4-a85f-0763043e6282", "value": "T1EC83C509BF610FB7DC5FCD3B09B94B04288C950A21E83B7A7974D818F25B65F69E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028064, "uuid": "b668066c-b807-4e78-8185-efe4cbb6aa97", "value": "1536:onhuWG4eSN4+4vJI453dKy9pmiqp583ny9Meu+7R0p:ohuQeSS+EJT3HLxeu+Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028064, "uuid": "7031c4fc-6105-43a2-9aa8-5e44e3871180", "value": 86240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028064, "uuid": "cc8ef72d-e71d-4b72-9777-66cb85158c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028064, "uuid": "fd9cd05c-b703-4e2a-a543-c7aead3fd9b6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077f4c73-e4d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767024257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "87d78e54-7866-4a05-96d2-85026b77010c", "comment": "Malware payload (Mirai)", "value": "650edfebb41e97ae7a1eef2427ecb511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "af52d7f4-2d20-422a-9a89-0380268a1b15", "comment": "Malware payload (Mirai)", "value": "b52eba70dd3ff85cac6ed1629f16aa174f8c2a517d74c9492aceb139e1d17152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "dc2cd9e6-94d1-4b00-abe1-2af43d23317f", "comment": "Malware payload (Mirai)", "value": "1f5dc61210617adf6a912fc1af8803e7365f6a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767024257, "uuid": "966c6566-0c7f-4ffd-ade8-b05676708149", "comment": "Malware payload (Mirai)", "value": "4484109d7e0540d16c4c47bbaacf85352c9d3df200892b40007ed7cb3b088f8caeb8964f544a416bd25677e2ea151784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "2ada2a47-002b-4b34-9944-29ef9bfb01de", "value": "T1D0436D4372184A57C5A60A75253F1BF093FFAAA020E0B3C6640FAB6A4675F371486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "5901217a-8e25-4031-81c7-1bb80480ba91", "value": "1536:CqE0XyOcpQe28zZn42XW9xSGe6xXuM7RW:wlVV42eSGe6xuMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767024257, "uuid": "36ba7ab3-b366-4590-882d-6746b8121fed", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767024257, "uuid": "0b7c76c8-ad99-43d9-90d4-a4754999650d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767024257, "uuid": "072b3e6e-7418-40fc-a15b-c7c15d34aaca", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ce89da-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971806, "uuid": "0f27d305-589e-4169-879c-af8455fb4dfa", "comment": "Malware payload (Mirai)", "value": "957cd115aa86bde586aca964cea671d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971806, "uuid": "f364e4e4-36d4-47b8-99d0-4a17cf35e08c", "comment": "Malware payload (Mirai)", "value": "b55176bb337840a7cd397b2f07f7af9e5f1dc7a40e0c363f80c56fb680b05610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971806, "uuid": "422802bb-11e2-4f2c-afa3-8a126cadc8ae", "comment": "Malware payload (Mirai)", "value": "48b6e82dd04179e0f7fb3d1ab9e28b6174d3f8b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971806, "uuid": "99a40443-efe2-42aa-ba33-72b6c9c85e1d", "comment": "Malware payload (Mirai)", "value": "48a45a5778da7a33e943d8c3d71b9f2fe7a32845b37b91411f014fcf296b7edbf45852df5d9ec5fa0b121b0898f575a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971806, "uuid": "a2f58ac8-df85-474d-90e1-e22e5093a391", "value": "T12DB3175AE8819B16D5D922BEFA1E118D331357BCE3EE72039D209F2467CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971806, "uuid": "1e6b31e2-f381-4101-8b74-d07ab61efe23", "value": "3072:wbzUhDgMF+NaTIe2+7GJBcLqjCaaxRFnr8XUWDrbVHqL8MuZq:wXUhDJF+NaTIN+7GJSLWCaaxRFnrSUk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971806, "uuid": "0c2681f2-1cb4-44d3-9091-eba00c31393e", "value": 116052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971806, "uuid": "68882bf7-2df3-4a08-aa39-407890721b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971806, "uuid": "4e51adf6-1821-4b71-b2f8-338f11141148", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da32595-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995169, "uuid": "10b7c1a5-a101-4742-8503-83bc8a08333e", "comment": "Malware payload (XWorm)", "value": "903b96c2ec9699b1b1fc1a6061b6b328", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995169, "uuid": "3d86d75c-4f80-4eec-a166-8217e28daf29", "comment": "Malware payload (XWorm)", "value": "b5b86f00a6750e27fd22db4d3bad661d133f631da2a05246f40e4ac71ea01400", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995169, "uuid": "ce924e8e-12e4-4aa8-b553-5a42ca0bc264", "comment": "Malware payload (XWorm)", "value": "ad907f2a5ce99b2f6d896e14fcd937ee3e5fdff8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995169, "uuid": "156f8f04-9285-439d-93ae-aeb2e0c0987d", "comment": "Malware payload (XWorm)", "value": "dfe24f2e17b223ff2cf324b45065f3b9d4c0fca269c8e4016cf28d417d1c435b9220746de12e15904b96e6c1fa9a4d3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995169, "uuid": "5eab6934-3f15-4f73-a53e-f7162585472b", "value": "T1F063F8C22D31BDB81DE02610EC553F49120885879E0DD45AB83B7DE734AF259DF6A2BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995169, "uuid": "b5d0c9d9-d967-43e7-948c-132e1fa3035c", "value": "1536:I9l/AoSSMGzBMmh7L+VTeI+8lM/nw5E33WnMr0t/GwiDSi268r/MSS7rC2NLiVGl:I9l/5MGzBMmh7L+VTeI+8lM/nw5E33WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995169, "uuid": "5909bbf8-c0b1-41da-bd5e-8ccf1ea03cee", "value": 72492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995169, "uuid": "e95ee179-ea3a-4770-83a8-7d0ac7ed13ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995169, "uuid": "ff940a73-c2d1-4e48-983a-adea0e6c5380", "value": "invoice-1645080830.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2841d82-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986802, "uuid": "2c3e6814-f053-4239-ba9a-9280c609675e", "comment": "Malware payload (Mirai)", "value": "1bbac8f6e37a166391bd9265c1d899fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986802, "uuid": "e96bca5f-30a9-4cb6-bc4b-ff734cfafc94", "comment": "Malware payload (Mirai)", "value": "b66821f0c7d27699ff069669a8ea3c6ca23fd9e6d0d65a8b820e6827bbc45d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986802, "uuid": "d8e90114-158b-4281-9f58-e4a18f4e0cb7", "comment": "Malware payload (Mirai)", "value": "91291a4236be8af966298fcf693c22120df36881", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986802, "uuid": "e89a2d6f-8f62-40d7-9320-a6d631848e61", "comment": "Malware payload (Mirai)", "value": "6a60976791504d7998cb557bf63a3a46378ba50fc7b79f2fffe931dc9aa9305e58e530f57a68c044ddedbe13f003d785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986802, "uuid": "6ce1cb85-25e2-476d-b53c-60851c644233", "value": "T12663B606BF614FF7E86FCC3745E91B45258C601A22A83B767974D818F68B24F05E39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986802, "uuid": "c3b115cd-abd5-48cc-9f3d-1a39242292c4", "value": "1536:VrVPMLYlyj9etUAzMQLA2eqfKEpev7PL2b29:5VPMLYlyhezzMQL1qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986802, "uuid": "eaa158a6-d1b8-4c61-b453-477c8404144d", "value": 72252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986802, "uuid": "541a375d-7a9b-4a33-9680-2f92a2284605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986802, "uuid": "04282678-9352-4770-a23a-f546417fda7e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b15647-e47e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989245, "uuid": "c8e62043-2139-4b90-9ae0-47c0ae311f24", "comment": "Malware payload (Mirai)", "value": "81a6ed175ae280366b3367fd7ac6b934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989245, "uuid": "7179954a-5ce5-49c2-89f7-f38a1feacede", "comment": "Malware payload (Mirai)", "value": "b6e0ca7fddb79a90871d9e7a6fe269f5278ea81a06b8fa8401936ad4a5461c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989245, "uuid": "f3c4a662-e413-4d26-86f8-983c37349e05", "comment": "Malware payload (Mirai)", "value": "fef144d9ec3cb0f2799e4e31f93bb4f3d9fd3461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989245, "uuid": "019de9b4-7ad2-4e52-ae29-3f14c7fa5d94", "comment": "Malware payload (Mirai)", "value": "8598f658074a5bdc41fd41a673715fecd54692cfe2a3aeddff4fa8dac39054e1973813b22c1fdd884f8ac60310de1214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989245, "uuid": "5ea2081d-16d9-42c1-9047-5993dee050a6", "value": "T11AA35B02A318844BE5F70FF037FB53E1936B665126E4D286730897855676F329A0AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989245, "uuid": "eca767c7-2c5d-4550-9a86-933ccde4f984", "value": "1536:j4wiebQeUCfCbXyARYYZyuTQ06K4jDPaqkiYMvBqfMLOQiSss7xP0Eipg6SOY8:MwVXiHOYcIQc4jjOkwfManxiOY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989245, "uuid": "3473713b-4403-42c9-899f-c8570f84eeee", "value": 105240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989245, "uuid": "0f2ebf57-f6a0-459b-a343-e9471a4dbdb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989245, "uuid": "a56515dc-7d22-4d97-823c-665dc5a13b00", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d809b858-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766967484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967484, "uuid": "506324d4-393b-445c-ba3c-234a80100be9", "comment": "Malware payload (AsyncRAT)", "value": "cc604d6b6a1e0e9d8ca76854a7692252", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967484, "uuid": "abbcf43a-09a2-43ef-9ec0-c2e2eb817777", "comment": "Malware payload (AsyncRAT)", "value": "b77c77ed02380df45f6c94d73a4d742bc62e07be8b287f2dcdad8a27b8463701", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967484, "uuid": "3231d1e4-c063-4343-b952-4f5b99518670", "comment": "Malware payload (AsyncRAT)", "value": "83f7498abe322936b3fa69f1b3e71629a7236ce6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967484, "uuid": "aecf0a36-600e-456c-a016-7a2abf561210", "comment": "Malware payload (AsyncRAT)", "value": "3b4f6a114042d0cf1cee36c776125e1595b1b5e8568d50612510392f5d5dfaabf4f374366ea1f0303dfb9fa589938fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967484, "uuid": "a5159ced-ad97-45d2-bda5-579141ea1066", "value": "T141C22A0473F48262D1ED4BBE48339600D375E58B5D53DB9F2EC494AD2A23BCD8A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967484, "uuid": "79917c72-4997-4fff-bc79-e17bf175aba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967484, "uuid": "2c875db1-3a52-4674-8b37-ab34af09759e", "value": "384:5QaA9XyfjjzgeRSQkeKwMymrJhxYHqqbuUsJQxnCJf+BWfXWd/8u+:5QzMjjE9Qke3MyCJhx+FbHBFBiu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967484, "uuid": "3d30d278-72a1-40dd-8ec0-9f18fa85f48b", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967484, "uuid": "4e735e84-a8f0-4706-b1f3-6ecc99e00129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967484, "uuid": "c1414c01-4959-487c-ac6d-6a84a42478b4", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b9a92b-e4d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027509, "uuid": "8612cdae-e61e-455a-9502-1619c24e76b3", "comment": "Malware payload (Mirai)", "value": "30789124a53bca12a79c8ce9ab5d735f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027509, "uuid": "fdceba3f-7f30-47de-be87-ca0ee0a8ed67", "comment": "Malware payload (Mirai)", "value": "b77f3eca4f50dd56692b29585d6357a48054d3c3d4f3d6b428b331afd82094d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027509, "uuid": "8cf36da6-9130-438a-91f1-bbac2f81c311", "comment": "Malware payload (Mirai)", "value": "a8e72782090a7a2e427bad66124bdfa2cceabecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027509, "uuid": "2f23785e-7d08-43db-b67b-ace958289ce8", "comment": "Malware payload (Mirai)", "value": "1802f4503d12c69f26e25873487ec6742ee9fcb2c65ff10f4a71ca527a554bed7c934c0bc27069ceb346139b903ed225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027509, "uuid": "4df945e6-b80a-44a9-a5d4-2b43250f0b7b", "value": "T1CBF2E12314842C38E9B05C38F9DD8BA56BA20FBDB5D170A04D16D592E88183F9EFB757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027509, "uuid": "f2ee9aa7-37c1-445e-a6b2-46c534940bd6", "value": "768:UjixXyja3AjTUQzpYueJDmDzVmjNEC4ZfqVs7Ws3UozS:U+xijawj59qmDh0Nr4CWPzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027509, "uuid": "ce631a0e-504e-4eab-8c14-78d324039419", "value": 34612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027509, "uuid": "d8f67937-d3f5-41d9-a7b2-7ca1afd8c2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027509, "uuid": "26495ee0-4480-441f-8161-f22a20d16772", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04e36c6-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986799, "uuid": "6bc9448c-cb81-43a8-857f-4bde830a514e", "comment": "Malware payload (Mirai)", "value": "7991070f33499749cd01b21e2272fd32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986799, "uuid": "badfb1d5-731f-4db9-9c64-c962ddecc778", "comment": "Malware payload (Mirai)", "value": "b7866729d0c1273ef1dbc3ff8b23bce758909eadc49999b7a75de12e25679482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986799, "uuid": "cebe62f1-ad3c-4b83-9529-aa3484f8e46e", "comment": "Malware payload (Mirai)", "value": "a25c1f0b248ff357b43cf9e4065ce0a006fef619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986799, "uuid": "da4497f9-09dc-4765-9c4c-6a3047076fa8", "comment": "Malware payload (Mirai)", "value": "f0f1251e2efa7d0fe2fc5fe38c9a119dde9f87bf79563ce73819e22fffdf00da3f89485a534b0c2582a7a63bb5d7b8b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986799, "uuid": "47f66467-28ba-4d35-bf59-4bcd532b58b2", "value": "T18933F1BA82AB9D62C17056BB152D549D640A2338D3F6F00357614470E6CB2F34AFEBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986799, "uuid": "3098324d-33ea-4a3a-8427-b576af6b18ad", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JSL9VE8amFZP7R3t:Soqs2Twh6P8JSLJ9ZP7R3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986799, "uuid": "1870c25e-0d74-4a55-a1dd-44f354d5f833", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986799, "uuid": "9782cbcb-b191-4017-90c5-b0313025977c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986799, "uuid": "26253231-44e5-4ff8-bd64-1b9608e6e363", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e179a1-e451-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969769, "uuid": "9df8b161-5e40-450b-bf5d-bffce43a3827", "comment": "Malware payload (Mirai)", "value": "efbe272269cdadb82baaa2152d367f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969769, "uuid": "000b40ab-9347-470d-b97c-47a6563c8da7", "comment": "Malware payload (Mirai)", "value": "b7996f07a9e4438d7a240acdce6265740d3cf4968c8ff158cd18bb02de8cc079", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969769, "uuid": "f8a41da3-9507-4561-a76d-159f58195663", "comment": "Malware payload (Mirai)", "value": "c1e6a2c1bf85946fc77ab7e2ac0803b9bf69dede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969769, "uuid": "ca8c5fcf-1157-4ad2-8f98-a83c7360cb67", "comment": "Malware payload (Mirai)", "value": "849628a4277fd2628f9c90fd708f5f014da830a4f0de5a56cfbe56cfd2e47825aa9379bc4181c3dc0e4d0799d4e5a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969769, "uuid": "3a8d36ba-3f1c-410c-9ab2-02e9d306fcb7", "value": "T1CCB3C80E6E219F7DF768C73187B78E21975873D227E1C645D25CEA011E6034E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969769, "uuid": "55f51a05-8a7c-4c72-ac62-ffd43b6ed8f3", "value": "3072:Xeq7v/hpTvqUmus5JrCSTWWdumSVoEh7/uZaq:XZv/hpTvqHuqrCapUoEx9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969769, "uuid": "c8bb2f22-a77d-4e10-80c6-9a4a20dd4cdb", "value": 117644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969769, "uuid": "e0812b86-2407-429e-bcbf-2ebebbce5bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969769, "uuid": "d977d85d-f572-406d-9e0f-42adbee2515a", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e963af-e504-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767046610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046610, "uuid": "6edc3e8e-7953-42ef-9c39-5cd3725a7a7c", "comment": "Malware payload", "value": "ab8c5e65559a79e0c822edc690500f4f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046610, "uuid": "a9dd16b4-e7a2-43b3-9de0-7663f29d272c", "comment": "Malware payload", "value": "b86b26edc4ba78868793450f3b3b6f74afd4304bf005e0583e311da548a84ef5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046610, "uuid": "f8c79edb-ea47-40c7-844f-ad81e1792a04", "comment": "Malware payload", "value": "29dfc3afa7acf21f8ea12a33181704d0afe09bb7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767046610, "uuid": "69ab45c1-41bc-4f8c-9967-a4dd62269404", "comment": "Malware payload", "value": "094ef2b14942917120ccd4616f284244242596251f06f38b2d89fada69dfcce0f3abfc85b145b0acbea38cce31fc8961", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046610, "uuid": "f77f87e3-07ad-40a0-a2c2-aef556ff4c54", "value": "T1DBC523853BFC4948F6BF9F702DB626248579B8A25D21EB5E06C1309C1931FD5ADA0F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046610, "uuid": "d61143c6-2455-43c3-86af-4539c291a9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046610, "uuid": "9b511464-1834-4c9f-9be1-6e1c585aed56", "value": "49152:xLvL+2upjBVhbAbXMtQl/wLz8r5S5l7KdVSZ4eY83TAcm:hL+2upjBVGVl/lQrCSZ4183Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767046610, "uuid": "80e6339e-4f2c-4b23-855a-64ea8b39881e", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767046610, "uuid": "46ff49d7-6585-4fd2-bdfd-ad1d0a93bd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767046610, "uuid": "89e14458-b388-480d-9017-065d94837748", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd7b1d5-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967061, "uuid": "ad21ba09-ae49-4e5a-9fb0-928bd50ccc82", "comment": "Malware payload (Mirai)", "value": "4e1c89a50f6ce0fb3ea666b912e6461f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967061, "uuid": "2534f8f3-3fef-4b31-816e-424a76d9cc94", "comment": "Malware payload (Mirai)", "value": "b89f259a0e7e8d65507087f7ef5f9ca8fd3a8d96144bf3f3283473afa228ab44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967061, "uuid": "61e28b5c-4a8b-4df2-90aa-ca367479d58e", "comment": "Malware payload (Mirai)", "value": "441750e7b03c387f2bc6fe3a18479562672bbc52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967061, "uuid": "8ff72e78-ade2-4de6-b4cd-954c708ae174", "comment": "Malware payload (Mirai)", "value": "1641d92831c7ce33951f3f6b53de56f4747b6509a92975f6e9952607599dc01d0365583ddc4d8b929b1b3d0f82acc572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967061, "uuid": "1e5e23b2-0a9c-4237-86f1-055e9064d31f", "value": "T151533A95FC419A12CAD105B7FB1E428D772B036CD3EA33039A259F21379B86B0E3B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967061, "uuid": "b5b668f7-537d-427d-aab5-f1432707a0a2", "value": "1536:/Osmfl2dt1exXv/L13OOeaJ5EVOeB+Zd3vJr:fmtWexXLCXzWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967061, "uuid": "84d31c2f-f89d-4f12-87d3-87462a95b679", "value": 65204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967061, "uuid": "cce9055e-2169-45d3-ad04-3020f74390ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967061, "uuid": "a9c14768-1582-4193-9620-6c1c28205457", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123210b2-e47d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766988627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988627, "uuid": "4175b0d5-be5e-432b-b76d-7e5890465058", "comment": "Malware payload (AsyncRAT)", "value": "2ea5d3286d3a7dbeaac31e9af2623434", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988627, "uuid": "fa7c15f1-db4d-47c8-b211-db3fa0efe976", "comment": "Malware payload (AsyncRAT)", "value": "b8d8905420988bceed40495970b2b88c354b0a2e3acc5059da040e0f194a071d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988627, "uuid": "f6da78f2-c20e-40d0-a2cb-860b827c5d27", "comment": "Malware payload (AsyncRAT)", "value": "f145b6b6277f702f40d34d01b9d8e56fe0a20a63", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988627, "uuid": "4c030bfc-1f58-41a6-bc7d-42eb29d0075f", "comment": "Malware payload (AsyncRAT)", "value": "905373f9f67592751338d4fb350e82ec18c18516d061ee59d177a618d82e70f42514b991876f74769d40885c9aa1a5e0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988627, "uuid": "309f9dcf-6d1d-4dc7-8fa7-96ffe09574cd", "value": "T1DF534B0027D8C965E1AD4BB5ACF2950106B1E5772102DA5E7CC414DBABAFFC649223FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988627, "uuid": "1fdb6e3b-a7a5-4192-941e-98965acf0b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988627, "uuid": "85854a29-ddff-4e92-8f42-31ea94b148aa", "value": "768:zyP+2h8LckiPRlGiV9Jeq6yaanDXwic1+bSCv7mqb2nJpwH1oGmGV40u9NIilI8v:2Qc7bDauwicJGbb8wpPIIivGwTiVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988627, "uuid": "c9feb190-c39e-49d5-9409-c21b61dac2a8", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988627, "uuid": "79577bd3-55f3-4533-9835-4107ded5f929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988627, "uuid": "0cad4f40-64ee-456c-87fa-96c688d31a4c", "value": "FortressIdentityVault.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc677ac-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013504, "uuid": "bb8af7ef-509d-4002-a00d-bba66aa06182", "comment": "Malware payload (Mirai)", "value": "d90fa57d0d2efaef964d02da29447d7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013504, "uuid": "c1dc19ad-03ec-411b-96f7-82ca2f5852aa", "comment": "Malware payload (Mirai)", "value": "b9acf60c4a9807432779cc79689495e0ad4ea94bbb4ec6bc3b0c60113d258a6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013504, "uuid": "692e6b70-39a8-45ca-8670-2724c4678c12", "comment": "Malware payload (Mirai)", "value": "cf2eaa413e135c5833b843e474d277dad3f5a9bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013504, "uuid": "409debc9-2182-417c-af68-bf62805dc638", "comment": "Malware payload (Mirai)", "value": "462741e0be5fc695642f11e1d257a6fbec72505145fd07e5fd26228a9b01e7eba41df7edf83c7af4cfc819af74bea16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013504, "uuid": "8b1c68b0-13a1-4edd-8976-af751c3e0e72", "value": "T161532997E800ED7DF80DD337C1970A01B534BB554E921B63F727B9A7AD76088482EE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013504, "uuid": "bb3cb0eb-a5d8-4d61-97d5-e60ba5a36e6c", "value": "1536:TWHgwPDr0/rGb8udOhEJZ4XGzVCY+iAX9ETPK:Te5k/CH3Z42zVCYANZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013504, "uuid": "1fa5f636-be53-40c6-ac50-99da5c6f77f9", "value": 63372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013504, "uuid": "68332e1a-804a-4436-8531-db50e4dac8f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013504, "uuid": "1c802654-6bd1-4b80-8d2f-8b77e30163ff", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6603023-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016471, "uuid": "07fdca33-0f7c-4a84-83ce-67246b0c38ec", "comment": "Malware payload (Mirai)", "value": "e70e26513403c76297f69a5003ac8249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016471, "uuid": "4fa46951-2750-402c-b6f3-6bc7ce799cc4", "comment": "Malware payload (Mirai)", "value": "b9cfff75c8b1253f99b267d95f8102332213e7051bdcd0abd6f499ff7f6c6e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016471, "uuid": "393f88ad-d86c-4562-a675-d8d0e4b8c099", "comment": "Malware payload (Mirai)", "value": "cd68a9e10c93b4d26d731bee48286af452eb4d2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016471, "uuid": "b8c33de3-76bb-4f9a-a8df-414b9df5d655", "comment": "Malware payload (Mirai)", "value": "c98fb7bbc4eac619a3505ca1ab210f27e102b6463d0c95186721fcc1ef24e38450b9017328f1e2baec42a2f36e890b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016471, "uuid": "1c1928be-f0f2-408a-a6d9-030848015388", "value": "T1E5739D72C57AAD68C1A845B5B8B09F351B63F100D2532FBB2A98C6758043EBCF54E3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016471, "uuid": "4ddbb419-cbda-4b1b-81e9-08de7de31166", "value": "1536:WaywtxRrz9gWc/Vout3oSUrYfKV0MgSqhCfJdiDXUum7Rc:WRAridoo30rYCV9qhsUjUumO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016471, "uuid": "4a274e7c-4338-49bc-9962-72a370674d30", "value": 75444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016471, "uuid": "919c974c-3af1-4caa-98db-18778ef31e43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016471, "uuid": "540e4014-f802-4e1e-a447-d6e86455e3ab", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad339e13-e492-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1766997907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997907, "uuid": "948cda5d-981c-447c-9ae0-69382b3a6cc5", "comment": "Malware payload (PureLogsStealer)", "value": "7b6bea2dedf149413ecee1aa046b83a9", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997907, "uuid": "48ed8af9-fd12-42b3-b4eb-f7be305f2baf", "comment": "Malware payload (PureLogsStealer)", "value": "b9e52c8c68fce3ad5daad8774fcfa1e00356f29e4754ee2f0734ce6789fe6fa6", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997907, "uuid": "cbc1c739-96e2-4aab-b25b-f752a0ef2a1d", "comment": "Malware payload (PureLogsStealer)", "value": "e3f9c687d103978a32f4443faf5b1da8de20ef9c", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997907, "uuid": "62566065-df3c-4c50-9481-89b6c9639d4f", "comment": "Malware payload (PureLogsStealer)", "value": "33496b00d75bb61c480ba1b744713fb311647b27fb26d88b4c987bfc7d3119c335a2732eceb305b9ad2796708f9ecf52", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997907, "uuid": "8b2efb2b-5365-42a7-b370-c28fe897bbfa", "value": "T1D495F1158DC82FB5CFAD9A1C80BE161EA7F04A8F501A754AFB27BD466FF7A4402071C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997907, "uuid": "6e54e5c3-1b7d-4864-9eca-65ee8d749fe1", "value": "24576:kYFY8ZlnpJkbJcg1IL6s+YRygG58K8WiLWZGOWiO3oqhZKNUbTB4D0nI2f9OUw:JHZlilILTTog+6WQR95FnI2fTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997907, "uuid": "f8b05856-3f64-4bd1-8d12-326ef0746047", "value": 1891504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997907, "uuid": "9856f7ee-b44d-4f8f-859b-e916e359caec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997907, "uuid": "a2fea741-a65b-4520-a5d1-7d55562fb2f4", "value": "RFQ 385048.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1c3d6f-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986575, "uuid": "bd5ad41a-f0f1-4d9c-8f7a-e6c88ebd11a0", "comment": "Malware payload (Mirai)", "value": "102ecbaf249ad904bee785129dc63def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986575, "uuid": "45ce17ad-a067-4e9a-909e-ab74f7b06d4b", "comment": "Malware payload (Mirai)", "value": "ba054058f73d95142ec12f5dc9ab5a8a5ba419eaf2af04a95c57c1a63ade8bf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986575, "uuid": "9e6edfbc-4111-4a88-9c1f-5b899c5dd7e4", "comment": "Malware payload (Mirai)", "value": "0914690f8d85fa282a985c99a5814f84c6915fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986575, "uuid": "e7f1b9a5-dff8-4da0-8cb8-c950cfc90baf", "comment": "Malware payload (Mirai)", "value": "de2a16e46b282267a2b5cbf502513e9c73d9395eced01583a1fb018f79b617a3bf3d1fb294fc8417ca8e3118e01e4d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986575, "uuid": "cb5e4948-e95d-4404-895b-560f05e359fb", "value": "T1A8732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986575, "uuid": "a343b275-6419-468e-9a31-5bc7236937ea", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WK:927jqCt8v3GI/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986575, "uuid": "361ae558-c3bd-4fe8-838f-27d6538532cd", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986575, "uuid": "796206a7-e310-475a-869a-4fc501674795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986575, "uuid": "a389bfe1-3814-49d8-9604-909fe059ef7d", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e102a7-e47d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766988761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988761, "uuid": "150254f5-4aa6-4de4-b635-852a2662f167", "comment": "Malware payload (Mirai)", "value": "23f441f2477d54a25beb6c2fb10cc151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988761, "uuid": "158319e8-6142-44bf-a93c-c8bd88c6cf8b", "comment": "Malware payload (Mirai)", "value": "ba416f1fd5f2388d06cf1c9beff0b6f1e2c9d888e45d013168b87e5eab1f52f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988761, "uuid": "dde2bb68-6168-49df-b18c-7340c3dc9e45", "comment": "Malware payload (Mirai)", "value": "dd906fc34fb1ede8ebeef8e3d0cdf432861274f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988761, "uuid": "3a3b618e-8809-483b-a1c3-caa8d35b9eea", "comment": "Malware payload (Mirai)", "value": "3b78fd1e5856712034c515750e02fbdf50f63839105f6ddc0bf92db40b73d4cfef70735d69cc3919fecd1e443925f21a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988761, "uuid": "a3dbe730-86e9-4cad-ba69-79dd41248325", "value": "T1E9B31886B8829B21C6C246BBFE4F118E331357ACE3DE72139D185F64378B55B0E7A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988761, "uuid": "2930aa7c-3ff7-4f31-8b4b-02b58c394443", "value": "3072:SUMBmNtbIaDg91qDrV6SNVSTJW7baRA1zSYq8qoEaCnzW:SU6mNtUaDg9MDgSNVSVWvaaQ8q6+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988761, "uuid": "90d158dc-9060-4c2b-94b4-3a37d93c3d17", "value": 116424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988761, "uuid": "1d1315a6-7e7d-4d3b-879f-97353536f216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988761, "uuid": "1149691a-27a2-4b1d-8a26-ff5a63eec454", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501299f4-e4bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767016219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016219, "uuid": "d3a64773-a5a4-488e-aeb0-0db3d2cfa8a4", "comment": "Malware payload (Mirai)", "value": "9e49cb408e9eb8cff97d0a2bc807d201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016219, "uuid": "6dae9bb0-b3a3-40b3-a33e-258e5f8868b0", "comment": "Malware payload (Mirai)", "value": "baacc106d62761c74d1f461c4053ef76af23597392ee802913a1bbc251722c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016219, "uuid": "87008a31-934f-4199-91aa-4a2195a7f384", "comment": "Malware payload (Mirai)", "value": "abf5ddc5a50db449abf5549915bc3e15a7221462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767016219, "uuid": "011da9c0-033e-434a-b1e6-91f1e6a5fc0c", "comment": "Malware payload (Mirai)", "value": "8208e81e92144a9ab319b702e19f9bd9c8ff99999113581e155f49746fa39730b9a2cd3df619ba6a3f04c05eb93dfd1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016219, "uuid": "f4313016-f99f-42dd-b095-e81c1f820b39", "value": "T108A3F70A7B650FF7D85FCD374AB94B45258D920B22E93B7A3974D818F24B24F09E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016219, "uuid": "2191ad81-76e4-4bc1-8a2b-cbfcca0432d2", "value": "1536:EPoBCHLmF4Ewdh/7qoio5js6VWrwTuS65dH3NQ3ZHCJcvGOgqWT2bVR2LI:EQGLmqEmhqoZjs6QrLcOcTgHT2uLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767016219, "uuid": "c2f34108-5b9c-4bfa-9d61-083b0984e614", "value": 105364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767016219, "uuid": "2c393ed9-56de-493d-85c8-29928bf0fce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767016219, "uuid": "cd9b2882-f3e9-421b-b6e3-08bde8cd807f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af727474-e4b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767014231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014231, "uuid": "bd18a8d0-0455-4c70-b117-85ad40be75ba", "comment": "Malware payload (Mirai)", "value": "9fc58377d38672db7a975270d0be264c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014231, "uuid": "24dfa856-b38a-4c0e-a0b6-9e76cf6316bf", "comment": "Malware payload (Mirai)", "value": "bb0e6e15683599907cf9a3336f99adb5e7d23b85923d29adbf7bac4d72c735e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014231, "uuid": "6adf7b58-f11d-4672-b9d1-b2559b1beecb", "comment": "Malware payload (Mirai)", "value": "aa87480f0b1397c927ce2018b09c8c18f88f17df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767014231, "uuid": "1109d13a-5c88-4d51-9584-6298215ecc1c", "comment": "Malware payload (Mirai)", "value": "b479f1e9011d8302e0a97d08aabd32975aea645d13d9b078137da424cc2418984b22b57112c00213867076d19738d417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014231, "uuid": "7f131a9c-2e11-4604-8618-57837ec4a838", "value": "T1AE53E886B851C613C6D56277FF4F82DD371643A8E2EF73039918AB25768B82B0E3B544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014231, "uuid": "a6f4c753-c8f0-4864-ac51-2928ad3c08d2", "value": "768:eefjDYLoWgFGeKM+bVkZIGeJHfBYmNz7O8n761ypDgZL7+lkMAt7bvTT2bVRmh:vfDvFGeKM+bVkitf7Bic5DWbvTT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767014231, "uuid": "781218ea-2362-41fb-9e9b-61245e82ba24", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767014231, "uuid": "47f170d8-63bd-4230-a5f9-4b556479310f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767014231, "uuid": "4b7330bc-3078-4df0-aacc-b67a04683a7f", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1b7e4f-e509-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767048859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048859, "uuid": "d3634add-51ee-4e00-8d65-07ca844a5085", "comment": "Malware payload (Mirai)", "value": "507e6ba36a99600477cb9228574165f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048859, "uuid": "1487e793-69d6-4744-b2ad-5bbea1c7da24", "comment": "Malware payload (Mirai)", "value": "bb2a437b82c59859df28b246c00e6743fd4a8951ab0dffebb1d17382250115d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048859, "uuid": "bee664bc-3839-4648-b3d7-58b4bc84a02d", "comment": "Malware payload (Mirai)", "value": "419f94e78453d2a73af6e7c3aee7aec836a7dd8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767048859, "uuid": "0ffb5035-4c12-4329-9ab2-4fb3e8581ac5", "comment": "Malware payload (Mirai)", "value": "a18ade9c194534f298e973b7737c81fcc1aeb6a350e22f92904fd4c8f3d769a4e8c72c6e95e26b0d9a25d992ea7137b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048859, "uuid": "44ffe1a7-36b4-4e80-8ba6-9f9a9c38ba10", "value": "T176635B22797D6D1BC4C4B47E51F78335B1B2570A32A8CA2A7D730E5EFF24660210BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048859, "uuid": "4686a33a-def1-4de7-a0f6-814e52321a57", "value": "1536:oH+ESu0vZuWVF4nk4So0ZeHxK0y8e/bAZTAENoPke+chg:uU5IEF4eyxK7r9ke+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767048859, "uuid": "6134ffa6-350c-4871-b984-231db2405faa", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767048859, "uuid": "6e3737ea-e467-4000-a720-e9c1d3c28e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767048859, "uuid": "8cc09bb1-0c83-4445-b1d7-ed9b5e32b6b9", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5cc560-e488-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766993340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993340, "uuid": "feaf9bc3-338e-4cdd-a546-b54a5a81f1f5", "comment": "Malware payload", "value": "0c2da93a46708ff3013d402fb28d5b26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993340, "uuid": "0b818695-c41f-499a-a201-ec6f29567cbf", "comment": "Malware payload", "value": "bb60d9a5b5a493cf44b8005b9b5c7e83b125bf1a978290e093c47fc134c59275", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993340, "uuid": "b1dff84f-b695-47c4-8c73-2360e151e95a", "comment": "Malware payload", "value": "ec27820008b9162410fde47fc1ad82df40613c11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993340, "uuid": "431ceeab-de9c-46ab-8d88-056565f0788f", "comment": "Malware payload", "value": "ab72bbf3b06eab69e4dc4f739cf078e53770c6a4751002942db59394bbb570b536fb85155bd559649b77c5584b709427", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993340, "uuid": "81acab3e-0e4b-41fd-a3e6-aa882eb4147d", "value": "T135B54C07FA5394B2CCA302318A57F36F19756E7489248E97FA887E18FE769E2015D3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993340, "uuid": "d3a25997-6b35-4a6b-a9d1-50cadd98fa52", "value": "5ac84e9c2171260547a866c78a163e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993340, "uuid": "7246fc24-30fa-4367-a61c-be241bde99cd", "value": "49152:WFgIuWDo/RW+3yUZB2ynQQUTbyQPNoeiChH9jFqmnvqP/2Vw6U5v8gB5ECfLJLWX:WFgIuWDo/RW+3HZB2ynQQAbyQPNoefRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993340, "uuid": "29be00a6-1484-410a-88ac-7ae522a2b38e", "value": 2282496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993340, "uuid": "dc1146e3-8e4d-4d47-87b0-6cbc3765236f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993340, "uuid": "64875459-1719-490c-9d4c-c46dbccc7ef0", "value": "bb60d9a5b5a493cf44b8005b9b5c7e83b125bf1a978290e093c47fc134c59275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73340b7b-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966885, "uuid": "3b12593d-e542-432a-a6ff-54df88fc86de", "comment": "Malware payload (Mirai)", "value": "4c8a388a8ac47b7dd207041450872ae7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966885, "uuid": "b7ddcedb-3faf-4bb3-be03-c19bf3f01dff", "comment": "Malware payload (Mirai)", "value": "bb9f7e25fbe7f03913c6634535042e3c0d3e0a5db383bede56c3b0c4745e50e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966885, "uuid": "b43a0ca3-4a2e-415c-86a8-1603ab7e2842", "comment": "Malware payload (Mirai)", "value": "01cb7582926422c0236a1344789daa3f7bd659c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966885, "uuid": "3f6aeed1-3f39-41f4-bfb2-79cf75b6fc69", "comment": "Malware payload (Mirai)", "value": "e7d48b63a29b37d60ef6428dc13bdc1b7c3a549e1b2dd9863ad051fa24df3ab69df2f0c7b2405b8eb141373682cfd9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966885, "uuid": "8b875c65-a591-4a81-81b3-cf2e9069e36e", "value": "T16AA3B71E6E219FBDF67C833047F34B30939963D623E18685E2ACD5151F6424E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966885, "uuid": "332d67a8-d47f-45d5-959a-522e000e0f63", "value": "1536:c+KlgLojF+1BUqUZQCQJR93Kyx30QmL27q+auexiqHm4Sg9D6Lwm:9oL6nKyx30QMGq+adHm4B99m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966885, "uuid": "38ea4633-2542-4b07-b62f-0138444b896b", "value": 105656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966885, "uuid": "2ae27243-fd80-4a4c-a3d1-570fe83c77cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966885, "uuid": "e40b7d67-dad5-447a-a686-f53fb66a5df8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a8ef4c-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972612, "uuid": "25539d71-93d9-4339-8963-93a6d73589fc", "comment": "Malware payload (Mirai)", "value": "d2a0dfb5a9a7a5a65ac7452696863ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972612, "uuid": "765acbe3-97e7-491e-be9c-3fc23c239092", "comment": "Malware payload (Mirai)", "value": "bba9359fdd56c9c80e5af44ec8bcd2df3a6f59c51c0a856031203e0c513140df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972612, "uuid": "d8642acb-9fbf-48f7-8a9f-c5e68e3e4834", "comment": "Malware payload (Mirai)", "value": "3edadac8d16dd88af25ca04ee6d6506f53b19155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972612, "uuid": "f603e218-2d43-4e19-86a0-37e68aaf9fa8", "comment": "Malware payload (Mirai)", "value": "1b7354e4a1975b115d00596d2938d853f35c47ca4aad445b3839c0dd041481a320762e3a4313a51dff8e9dfc421671b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972612, "uuid": "0abf5e62-c626-43e1-9b95-6ad112ce1ed6", "value": "T1CF436A62DD212E58D19985B0B0309B755F73D066818B2FBA2562C738D883ECCF6593FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972612, "uuid": "788dd80c-e3ee-4d88-a385-3e7f58a2f9eb", "value": "768:WVo3OsBnZwtypQOEPhKqZQMatQDowt/OZCSaOhXhfd4poOtE62uSroH/pIC:WVoJCKqZQPfu/OZCSJT6mnuvx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972612, "uuid": "d30a04f7-fa4f-4ef6-af42-39d3c462855a", "value": 55592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972612, "uuid": "656ec8d3-f35b-48b0-a90f-9fc7d89f5062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972612, "uuid": "98567a75-0f63-4405-b819-f494fc6d7bcf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6592c22e-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995209, "uuid": "aef965ad-3e96-421e-a28f-e42d9649d072", "comment": "Malware payload (XWorm)", "value": "a33a08ba2d75701eb3c8e798bceac22a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995209, "uuid": "a0e78227-d677-4ea4-b1ef-d8577210326a", "comment": "Malware payload (XWorm)", "value": "bc336127e5e5ec77ebe218974b13608d2f2750a415dca947e344ce91679538f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995209, "uuid": "86f4cc29-2400-4eec-b2e7-8fd1fba3ada8", "comment": "Malware payload (XWorm)", "value": "065f250eeb3481ac84b04baee7a234ee1fac9fe9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995209, "uuid": "cd71be2f-8c47-4f7d-b5ab-a33353854a8a", "comment": "Malware payload (XWorm)", "value": "7f57dcb2281db34e5272f4c16f2715c9eaa26c3ad113bf687a5aaebc2e832bcbcb39e6c71128767dee1849770aa168be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995209, "uuid": "dda37b13-445f-48c9-a3d1-90d9fa0955cf", "value": "T135732D5A5B36BFC3E52B2E27D4167321206508CB7CB2CADD6D8FF26B4941037885F869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995209, "uuid": "fc46929b-21c1-403d-91e9-0a03f602fb9d", "value": "768:I8w/h62/jWs6oS+xISN0vILf860epQzO/saJ4jPCNn4Hofqo0JkIMiZ6OC5VOmZv:I9l/AoSSMTzusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995209, "uuid": "df44ede6-a83a-48c4-ae21-2577bc073359", "value": 74396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995209, "uuid": "3f36a9c7-14ae-4fe8-8822-c047cdd591c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995209, "uuid": "532c8b17-7a49-445a-a521-fe0eae04449f", "value": "invoice-1645080830.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e75378f-e511-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052267, "uuid": "6c53bec0-6eb4-4392-8e9f-1c91d5a647a3", "comment": "Malware payload (Mirai)", "value": "8b16091cf12517080f4ca14c23f4d316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052267, "uuid": "ac70bb7f-383f-4f8a-8cc7-6a708c7d4c67", "comment": "Malware payload (Mirai)", "value": "bc6203bd9c057d3886ca9aa0c7f8454d54c86e81c359c999b3771905697de478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052267, "uuid": "06fd88fe-8ccd-4c72-981a-3dde567b0e70", "comment": "Malware payload (Mirai)", "value": "987137c2a4b922802c7cbf8b673b35f47a315977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052267, "uuid": "4e13fa43-12d1-472e-92e6-1d124b06181a", "comment": "Malware payload (Mirai)", "value": "9cd83c715d339c5ab6c3da728b576919c9d70390a80c5bcf551be3fe72efc7e5fbeac812594fe73159baf9264b5b3665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052267, "uuid": "0cf8b577-7ea5-4f03-85c7-bd370f0717df", "value": "T1DEB31995F941EA22C6C256BBFF4F428D73165398E3EE3203DD185F64338B95B0E2A245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052267, "uuid": "dadaa11e-42c4-49ef-ad62-17f54d6bc7bf", "value": "3072:p2LaTPPtj8culi4qkqHeosstvqtrU/125XOV5onT4:p2LabP1Hu44qkqHlsstvqtrU9qXOnA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052267, "uuid": "a128f530-78aa-4d30-b5c6-3110abe90b7f", "value": 117004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052267, "uuid": "0b6ec60d-168d-4be2-a070-80da7affe74c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052267, "uuid": "c0a38f01-2d81-44bb-8a89-f1ebc4e0e484", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9470e44-e455-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766971808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971808, "uuid": "e762699c-688c-4e4b-8ed8-518d01f565ff", "comment": "Malware payload (Mirai)", "value": "d3d00205beb75c7f2146055a2761e871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971808, "uuid": "8bca510f-62ec-4b63-8098-396d224eaf5d", "comment": "Malware payload (Mirai)", "value": "bcdd355e1b0e42c40e72ea8c9adde28faf130c9031babc02c7aa3be938d52d91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971808, "uuid": "184dc711-fbca-42a2-9a04-59f26076f028", "comment": "Malware payload (Mirai)", "value": "543cafd18a557429695640d0d998c8bc7f22c961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766971808, "uuid": "5537a9b1-9fb1-4886-b504-fab89c6d95e5", "comment": "Malware payload (Mirai)", "value": "b90285f210aa55624f787a357cf5ba909f42aae7bf13a2d48d497b806eb4099ad9721f95ad299b3fa4aed468f6e953c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971808, "uuid": "7b58e3b4-2c89-4b9f-9f23-675211fd2b42", "value": "T189A309557892CB61EAC412B5FF1E328D330347ACD2DEF31BAD185B25679B0270E3A856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971808, "uuid": "83f3ac17-20d7-4a4e-9986-52ed08643c32", "value": "3072:s2Y+BIus2JLF40HU/LLSnKnFz+W1MWWVno65A:s2YUs2s0HkQKnt+y9We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766971808, "uuid": "106d23ea-7251-40e3-81d1-7b438ab3ccfe", "value": 99496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766971808, "uuid": "816c6ae9-83bf-471b-933b-884dbe5f53e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766971808, "uuid": "b1134808-7341-4f24-92fb-f7c229246060", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb7907f-e487-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766993319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993319, "uuid": "68c31ed0-e6ef-4a22-a650-da8382c30119", "comment": "Malware payload", "value": "0034748c5b8030c42e430a4ce35ac6e2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993319, "uuid": "cd074132-320c-4dea-89dd-8b1e1c699a69", "comment": "Malware payload", "value": "bdbba1ed208457256047bf766e477b8b7958a03a2aa33c9db68fb18f88e931ea", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993319, "uuid": "dfb2def6-db64-4f7b-a7de-bb60b068175a", "comment": "Malware payload", "value": "d4924ab39c4402d1b98af8445d97d8545f542a02", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993319, "uuid": "193e33bc-3cd4-4bc2-9179-a17467263951", "comment": "Malware payload", "value": "cebe43b2d70b0ae99f02306197d494d899f8fdecb3b8b6d73e46ec515a219fffefbba642e26666000f7a7058aac0921a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993319, "uuid": "5842a772-ea35-4d37-9f0e-4e8dd5a31ebe", "value": "T19E6153717B60C1DD18F3EFF09B9DE712B45A800AB0493B15FD88C9B476608E79E8496E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993319, "uuid": "260e5883-3e25-4165-ac8e-a5ac429de051", "value": "48:2lgljlOOYl2Nl2gl2glSxl2gJHOXLHoXl/SbVl10Ylp:6Mp1U2r2M2MU2gkLHoV/qD10Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993319, "uuid": "f804a369-7048-4ed0-bd3c-7c2977baff43", "value": 3398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993319, "uuid": "5232966b-53b4-4368-b413-e25a7f9c5d81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993319, "uuid": "f10756ee-afd3-49f8-b393-ffcfecb33736", "value": "bdbba1ed208457256047bf766e477b8b7958a03a2aa33c9db68fb18f88e931ea.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03833173-e454-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766970993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970993, "uuid": "1b3e6976-9c25-49dd-bc21-03c466660996", "comment": "Malware payload (Mirai)", "value": "10daf15a52169e19cf7d2aa080910aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970993, "uuid": "d99516ba-86fe-4b58-92f4-465ceabc5f41", "comment": "Malware payload (Mirai)", "value": "bde425fa9dc4b7b1b92e1d596b5acfe80a3bdd7065ce80a43221b38ca3fee45d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970993, "uuid": "7fea3909-b08c-449b-8242-ddb2eb3cbecc", "comment": "Malware payload (Mirai)", "value": "33e4971c1b84eb825ef14f8b23333fd74c218b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766970993, "uuid": "13f5b366-44cd-4653-84d8-32ad186299b3", "comment": "Malware payload (Mirai)", "value": "2a924e1c5fd59032e84702d189b9634b2a65fe71116c6627dbffadf48f46efdd5ba547f87da61db87896288f59464a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970993, "uuid": "bba3f9d4-f0c3-4a11-bed1-5d3d902984e4", "value": "T162B35D02B328884BD6F71FF427BB13E1A3ABA69115B0E286760D53454175F329A46FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970993, "uuid": "e59cebb2-51a8-4f64-aff7-f990197ab3b5", "value": "1536:h4yYdItMtxwL+EhjO2pPEtzHxRopgaqb1eBPbFH1yuFy57ohcIGVPNRjbd:79gxMVhTZeO6SpVZcUw1Rjbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766970993, "uuid": "1d20e5ec-f0b9-4448-b42d-1e4f842738fd", "value": 108848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766970993, "uuid": "4deb2c4c-45c9-45e6-8dbd-1576e8ca9e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766970993, "uuid": "86bb8e2e-a02c-40a4-9bbe-850988ec08ff", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03918213-e459-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1766973141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973141, "uuid": "805f2b23-f06f-4942-a3ae-e3ae1010353b", "comment": "Malware payload (CoinMiner)", "value": "d924a64a68fb15d9cb4210585b87d090", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973141, "uuid": "9275126f-abab-4d42-9456-20f41b8d5f4a", "comment": "Malware payload (CoinMiner)", "value": "be6928a5935f0b49ec86015be3f600a635d3aef55f602827a7104a661b13200a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973141, "uuid": "5bf5ee27-08e8-4c2b-bfb8-70e568f7b7f7", "comment": "Malware payload (CoinMiner)", "value": "835d5d0cfd9c8f63a401457d24a8f1f04581f5b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973141, "uuid": "492fa82b-d8f6-40fd-96b2-7a77ced030d7", "comment": "Malware payload (CoinMiner)", "value": "04f4f7025794936db921e2913f33f5b124831c7e957ce0db7f2b075bd12d9b70e54b039020fdb808e8d628e4c3f78a00", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973141, "uuid": "7d9f77c1-28b0-4542-83e5-e456fdb144c2", "value": "T1FAA5336D7B0E0528D338B3F4623BA1229FA18C38CD59F1EF2B8C994610D661F5A35E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973141, "uuid": "acb224b4-f44f-41b8-9874-b3a3173f6640", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973141, "uuid": "40208e60-27bb-4438-8a01-7a90182e6ce5", "value": "49152:gBFrgKLwRGJyTcT83ezM4sLis7Wr6N7hnGeb/AdtuJQPKiX:YFhMGJyQTjfsirNeTUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766973141, "uuid": "c31bafce-0e1e-472c-b489-f337c409677d", "value": 2234880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766973141, "uuid": "5c1a2563-2a9d-42da-be32-0b2d60c356ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766973141, "uuid": "56a0a69d-53f0-431a-aaa4-aac2610a09eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a13f11-e512-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767052730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052730, "uuid": "3f5acb25-dd82-4a71-8fa5-1524d26d88a0", "comment": "Malware payload (Mirai)", "value": "dd522802558b3ccb367325ca90bdc019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052730, "uuid": "c324968d-03a9-4b14-861a-3774e8b95dc3", "comment": "Malware payload (Mirai)", "value": "be94b854d9704fccb80ec87e514b1837076ea2d467e2819149554486934a04ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052730, "uuid": "df31c4c3-b8de-44f0-88fc-9401f809a3a0", "comment": "Malware payload (Mirai)", "value": "b0fa1045826eb939110a2a5afef769c54c8f0a0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767052730, "uuid": "11cc0bd6-0838-420f-82cd-d0371a9eff5e", "comment": "Malware payload (Mirai)", "value": "f1bbad412456c68426c1efc6a0c1f1ae0ed5257416e504e13e2c9990f0244b203384f946745e530b879602b87dbd2414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052730, "uuid": "5ecf1af2-4d7d-4797-8617-b4f029ee7b1f", "value": "T1E553B60A6E268FADF76C863547B78E2197D833D226E1D241D15CEA011EA020E745FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052730, "uuid": "fed92270-8a93-415d-8124-db86cad950f3", "value": "1536:7IGFad3aWeHma1QrB7etXn4TnyRTnnju6SaPxus:8KmafHma1QFN6SSxus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767052730, "uuid": "5e76456d-794f-477e-aad7-25e6a6300d77", "value": 63548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767052730, "uuid": "cf8bb18b-02bd-40d8-ab66-23b7f4753782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767052730, "uuid": "ab07dbd8-188f-4033-ba3f-70e4bf39b90a", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da62bc24-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986815, "uuid": "bc7f34ec-4ed6-4fdb-b42b-a58aaadfb2a5", "comment": "Malware payload (Mirai)", "value": "8eea925596356cdcd2d054fef3f96cd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986815, "uuid": "900e3dbe-3f33-4875-8b1e-3bf1d651aae2", "comment": "Malware payload (Mirai)", "value": "bf0118d86df74e5e5f21a574d17b609fcc319e46212807ebc1f536eaf0b4b334", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986815, "uuid": "b1f65a33-0763-404f-958f-ab5d2c4d5d6d", "comment": "Malware payload (Mirai)", "value": "879483ebb98c9928ea8694250ca6a95f7f011cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986815, "uuid": "a0ac436a-a6f5-4cb3-bec3-6dd1e26f0106", "comment": "Malware payload (Mirai)", "value": "95e7c6daa3c8575af4fe759e738986f9556c466d5d1989a5614cc2fda509288d0ef48917771c6894bbd2ada19ee302ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986815, "uuid": "6e67ebb7-0531-4f91-8e10-35795b94c281", "value": "T147339D23C4790DE4D00441F476259EF89763F20AC6933EFAAA458A668047FECF6693F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986815, "uuid": "55ad57c1-653b-4433-a555-0f95b1c65ab2", "value": "768:k2ltacr0TWL4a9JlLzjxT/AjepUQv5KzHJ+LllrbSoynQkXCaoDDwCTE:k2ltamkaDGoPh4slHkXO/wCTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986815, "uuid": "1860783f-c418-4bf9-93f1-77f4da21adea", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986815, "uuid": "23b03797-64b6-4115-99f8-7ea909ec2ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986815, "uuid": "169c00ea-3e2d-4ab5-9d23-f2bbc8e7485e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8c832e-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995468, "uuid": "fccd6f39-823b-4591-9944-b6f55fddff9e", "comment": "Malware payload (XWorm)", "value": "92dbb285661666e31a9ef1cc9bfd88f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995468, "uuid": "8b86de44-2ba1-42ae-a6e2-fa97dde77519", "comment": "Malware payload (XWorm)", "value": "bf954b932f41cf4717f54dfce7fb23f036e2b138149b78b1d09dabd028314eea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995468, "uuid": "c0e81a77-dc2d-4256-8ada-4e1a9ba66f4f", "comment": "Malware payload (XWorm)", "value": "bb5be0daf99fe46ac731ffbf8665eaf27588e1b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995468, "uuid": "d7fa5dc2-8280-470d-b39b-bc69db35f0d4", "comment": "Malware payload (XWorm)", "value": "6e5842a64314c30968e843025d4edbdcbe515d3b0ec83b7d018fb1a56e9a27c50a0c4acdba7a1abc68b902019f45de48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995468, "uuid": "1efe5476-971c-41c6-b73c-6e3004007990", "value": "T162731AAECC192C0E91E6DCC8E43D3BDF37C3EC4242971CD49D023A919D1D5D96A9AA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995468, "uuid": "3a2d3f37-414d-4d1d-9ce7-b6fa0b9304c3", "value": "1536:I9l/AoSSMNGFYUjgPMnJ7JtJ3J2JJJDJnJeJiJyJJJaJI+JK7lG3UGiCIpSgIsOV:I9l/5MIR7NIjlBowIXkZS24usriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995468, "uuid": "c499b650-3861-4682-a32b-7bbd8a8b4b75", "value": 76351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995468, "uuid": "13d97049-d142-428a-8de2-c5823eaa6e36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995468, "uuid": "c8a1b1b4-96ae-4fdd-902c-a1064470451f", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ebd18-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995161, "uuid": "a50b5bdb-a014-4075-b651-113595d2b976", "comment": "Malware payload (XWorm)", "value": "9f174e88b30f66dd70becfd5ff5d3c99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995161, "uuid": "a1c9bb0c-01e7-41e8-b024-505eb4ce6962", "comment": "Malware payload (XWorm)", "value": "c000a7c76cec5b21f001f0c648de40a26788f3910e70c6d460032a4457fe56f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995161, "uuid": "b310a5d2-5b6d-4419-a202-e3e313bbb5e4", "comment": "Malware payload (XWorm)", "value": "8c82e90ba56dea0811c59179eee767ca27c79b2d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995161, "uuid": "8b5ec16f-a514-4bb6-8b2b-57a9cd80320c", "comment": "Malware payload (XWorm)", "value": "1d157a07c2bfdd961564a0abfcb15788e9988c524480eac05c8b13f8b732ced7fef0dab19c5d60e8025718086b2c5798", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995161, "uuid": "8d0aae01-c080-4226-9d91-c329b90cb77b", "value": "T129633B8CEFA37F95AF0AFE0E9C49B3D5674DA80F6C272AE5412FA947970D30445A1E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995161, "uuid": "37798141-aaae-46f3-9495-173e9804f360", "value": "1536:I9l/AoSSM17vMtm6hYCA2eauMGpd960QVUQMKOAp85sOAgDbwONy6jcJhEM46pLH:I9l/5MopCusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995161, "uuid": "877c08de-e679-4c4b-bbaf-1dda2be5291e", "value": 71540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995161, "uuid": "ce953110-a0b5-4713-92fd-e1180e099e62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995161, "uuid": "c09b74dd-1610-4be5-9973-bf89baf6f701", "value": "invoice-1645080830.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cea015-e490-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1766996794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996794, "uuid": "68072a86-61b1-4f2e-87fa-e958fa51009e", "comment": "Malware payload (ACRStealer)", "value": "dc6317f9ebbccc043a9a988d6ba22555", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996794, "uuid": "fc170750-03b9-4a04-828e-df873b1b8fe3", "comment": "Malware payload (ACRStealer)", "value": "c07e18e61caafcf3508530428f96b58455fe69952d63e65d7067081795aa120e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996794, "uuid": "4e1dd55c-3a11-4501-b993-cbd55788cf03", "comment": "Malware payload (ACRStealer)", "value": "f551c62e82db39e1b8c38018c08fba75a335c94d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996794, "uuid": "5cdb1a1a-219f-4487-ab32-85b1947a4440", "comment": "Malware payload (ACRStealer)", "value": "05fbdb8f73022f93aeab6e4065d71ca97c00a93bf89f54908688067c7218f56e52fd3c874fd25d3b18e23b9d6edec2e2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996794, "uuid": "637fb484-e5d8-4f47-ab4b-ac01a00ff4cb", "value": "T1B725239DF21A4362E54B45313D9A17145A476D9DEA32062A37BAFF0C3BB12E406BCDC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996794, "uuid": "210fa271-e67b-4a79-a12b-cbd66436d38b", "value": "24576:YSpEKQM6Ylpil8JwELC4Wpg7zTlOFnjI:LtrpilqwEu4WpYzTl+nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996794, "uuid": "7add4b0d-dd19-4be4-bd90-19a29c71a8ce", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996794, "uuid": "760da67a-2bb4-41ee-beeb-a5a0337861a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996794, "uuid": "433bf9c6-f0d5-4f13-b1a9-36c074c71f6c", "value": "immunewait.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fc7c61-e48a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766994277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994277, "uuid": "e832331d-ce31-4c73-bb27-09cd2e463de5", "comment": "Malware payload (Mirai)", "value": "88477fa47c1fba17d6774baf6c5aead3", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994277, "uuid": "500bee76-84c0-49db-abbc-827f035c36c2", "comment": "Malware payload (Mirai)", "value": "c11ac0604e10530546efdb56eee81b8f32368fa0ed0af2d1ea4964fd49d32129", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994277, "uuid": "b97e9861-f5c3-46d2-a3bb-de013c7fa3ee", "comment": "Malware payload (Mirai)", "value": "f3fc1ea71b988e562dd8262d3e39c1a433b6c690", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766994277, "uuid": "1aa8d3f0-3d27-416f-91b4-acd3c5e744c9", "comment": "Malware payload (Mirai)", "value": "ab0d6eb2edbc65382937a8de640bda2814a8140979f5883674d07b3aa216c093eb9fcd6bee7144565dd47eb569ca4ab2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994277, "uuid": "f51c09ef-e6ab-467a-9171-096a104a2aad", "value": "T1DE562953ECA541E8C0EEC635CA76A213BE617C49473033D32F60B6252F76BE0A9B9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994277, "uuid": "cd4283b1-331a-41e1-bb71-0c0e81401115", "value": "49152:+7BER5UGej6E+fV9KqxNGppmJhykSozIf80OkRtYEdoLgkOGx2WUBUdazfcmmOTC:+da5dtRQEyuY80zLtGxHUBUgfTB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766994277, "uuid": "0a4a91b6-b554-4661-b16a-303fcbcb5426", "value": 6009213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766994277, "uuid": "f35bb522-03f6-4365-aa10-64a1fd563538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766994277, "uuid": "d85bebe9-2575-4b54-9342-12f512221a73", "value": "int_driver", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e2e9bf-e44b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967434, "uuid": "e0a8b1d6-2ea8-4b6b-ac1e-4f1dd994e882", "comment": "Malware payload (Mirai)", "value": "4784c209acd1c3f3716e13593e2964aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967434, "uuid": "36986f8c-d9f8-4131-9ef6-65f722164864", "comment": "Malware payload (Mirai)", "value": "c17a90765f924fa3d22c904c03ef785fc03090fd1c833de432d5924c1a25e6e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967434, "uuid": "ad174b36-0271-433b-bef0-bd6dabdadb74", "comment": "Malware payload (Mirai)", "value": "b65ed2e815943edc3d2e18cb776d721468341c8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967434, "uuid": "89e37819-e38a-40a9-a2a0-05bd6129c575", "comment": "Malware payload (Mirai)", "value": "9dc8d186a9b72eaf58df252bc601f071ecc78ef4bab01b4ac8085ad610187a31bc8694f7e15c065d92d3eec12debb8d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967434, "uuid": "226b21a2-e551-4d4c-8424-e2c34e13f08e", "value": "T186639EE5264D41B6C6E6007DB963EC59AF709237C302E64B0A2EF4381C61F477A8BB57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967434, "uuid": "70ca2a59-6658-49a1-9b04-fc238773d717", "value": "768:zsUXgr/jxw8iOpxN9adjLqHME/U1SVdRWuYy2R0rmVmnaz8Qj9Ej6rDwm286N39o:zeTqepxHxXU1SVd4ArFazE6N6aa43n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967434, "uuid": "f2bc9374-2adc-4b4b-8381-a72fc5691b4e", "value": 66976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967434, "uuid": "21311739-9a44-424e-8b4a-5f8429852417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967434, "uuid": "646821bc-b9ea-460a-87ea-9bab0177077b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45971a98-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027798, "uuid": "52a56ed3-a833-4e38-9087-2eaed525ec53", "comment": "Malware payload (Mirai)", "value": "5eac93f807c3125d12fba2e8825b1e36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027798, "uuid": "e7c6ea8b-4f20-41ba-9c76-9d36e36e9e76", "comment": "Malware payload (Mirai)", "value": "c18bb6d53f4b67eac745eab06341154cffd63a2692396eab5432363b24050eb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027798, "uuid": "abb82a61-a3f4-45cf-84e4-9dd6714bbf11", "comment": "Malware payload (Mirai)", "value": "bbc87b88ae74f72022f92c3c0bdd1bcda82e4484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027798, "uuid": "10ca58cc-cbec-4a0c-b4a0-1c496ad34c5a", "comment": "Malware payload (Mirai)", "value": "6d2f037e95abf84719a534fe89d0d92fc791651ce1ab58194f3ddea749707a1a7ec39786d0c7559140f5a8c7a30e909c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027798, "uuid": "ee333c79-5190-4137-a6e5-d030b56b7823", "value": "T1EA13F989BC91CA56CAC55577FF0F42DC372643A8E2EE73039E14AF557A5F82B0A2B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027798, "uuid": "5b1bf552-c35e-430f-84d0-3448f73c1082", "value": "768:22fyj4HqRoDJWb7XlVXmNwwF2iMMCHUr5tu+7Rj:bf+YDMPV9wnph9tu+7Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027798, "uuid": "3ed0150c-290d-4049-bdd2-858ce33efd58", "value": 42500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027798, "uuid": "62c30432-a2bf-4b98-88e7-afc80cce28e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027798, "uuid": "8f5e9897-4d1d-460d-8aff-173bf69ae958", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e5b63d-e493-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766998116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998116, "uuid": "e3517898-3c3a-49f6-85bd-c54d0bd2daf6", "comment": "Malware payload (Mirai)", "value": "d00f27784092a3305f88f5acabbe976d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998116, "uuid": "f8407ed2-2533-4f12-955e-3b403167295c", "comment": "Malware payload (Mirai)", "value": "c190caee5975a67dd0d09a66f7d1634b6a72712f6ae38852ef4442383b8d8426", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998116, "uuid": "2ebe0415-9063-4045-ab7f-c8b10cb7bf51", "comment": "Malware payload (Mirai)", "value": "ab951f6e31c2bac649552fbebed912d53a83ec2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998116, "uuid": "30215874-9398-4b1b-a8c6-fc00c2419199", "comment": "Malware payload (Mirai)", "value": "f6574250cbc887bca1d82c87ab98072f16ab0f7d3947a2a11fefd56a2fa41d1e495101892ab375387520d163a82abcff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998116, "uuid": "ab187606-afe6-4279-9808-798902ec1bdb", "value": "T18F3301A9EE8FC4A1DA105DB218ADD4C35F1B67DA417725237958CBFC64F02C2B378A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998116, "uuid": "a4e2c92e-8e60-4bf5-8132-f6cd1ecece10", "value": "1536:JySozGHGQshs8YpGCurIhXiSgLTEi2PShYO90:JN6GXshs8YgCuEhSSgLTdWRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998116, "uuid": "bc956254-9aaa-46a4-a5fb-d4329539113d", "value": 51552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998116, "uuid": "d850c12d-99c6-478f-8093-00e38978be97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998116, "uuid": "31583004-ac8b-4a45-a1e2-8a36e2f37190", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f775f6-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986857, "uuid": "610ed939-1bc4-4739-9dfa-394a90e11f3d", "comment": "Malware payload (Mirai)", "value": "8c91b6374b22774cef90c6373aa3a289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986857, "uuid": "e856e93c-d71d-4608-a284-f4371b9dfcce", "comment": "Malware payload (Mirai)", "value": "c1a790818744cde8a5bbaa73f7048e7c91bdba77b495753feada28d039f13498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986857, "uuid": "00bddf57-94e6-4325-a3f3-d1a3843e369e", "comment": "Malware payload (Mirai)", "value": "d052ee0b95376e8e1c0bba8c87500fb4849d2cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986857, "uuid": "9a2d05c6-dbcd-49ac-84b0-badf2ebe64c4", "comment": "Malware payload (Mirai)", "value": "8daadc89c7f9566bb71ee3cd1774babe87aadae764a3eaf42c1ebe3241f642e785b34ab1a0f835f0df6da3dc2d1918bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986857, "uuid": "c7daa619-9b96-408d-b992-7aff29bfe58e", "value": "T19D630891B881A626C2D1137BFA6F018E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986857, "uuid": "0ff3daae-e3ec-43fc-a829-edfd6bbc41f8", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986857, "uuid": "a85b61de-a987-4046-9838-bc613dce89db", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986857, "uuid": "65c823ca-fec9-4f1a-a32c-3172aa14ccb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986857, "uuid": "03ce3f8a-865f-4047-9743-b4420f2ecac3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3218c30f-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995123, "uuid": "1a9ad4bf-d61e-4b43-900e-63e4f9e1a5aa", "comment": "Malware payload (XWorm)", "value": "082135841234473d62f67bb400575afe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995123, "uuid": "bdb06ab4-9f13-4854-80ba-6b255e48702f", "comment": "Malware payload (XWorm)", "value": "c1ea22b9fcbfd084e9364e52bf6b5739480cc2a8e551e18ea9a8e69f22d41f30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995123, "uuid": "f61db407-6d57-4193-a3ef-9b13743f8409", "comment": "Malware payload (XWorm)", "value": "7cdad40ed1d8074ec439deefe948182481cd6b1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995123, "uuid": "d95fb498-71e5-4a29-a8cd-a403a08961c3", "comment": "Malware payload (XWorm)", "value": "511094d25c6e1858a09f623f1026a29749ee6d176935e43222204e7f943223f72eab9f20c5c4dd598aa26774239c05e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995123, "uuid": "6b931cb3-5819-4c3a-a7ac-0acdd5691dd5", "value": "T174631B67BCA8DEDE7DFC41916FFC847BB326C89121CE026C14C01B02D559A1AAF1A97D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995123, "uuid": "d5253109-6dd2-4dfe-9844-9ef66afb74a4", "value": "1536:I9l/AoSSM4TeTeT+T5TFTlTxTST7ToTIThTlTATcTPT5T3TJTXTSTeTSTnTTTSTU:I9l/5M4TeTeT+T5TFTlTxTST7ToTIThy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995123, "uuid": "143c30f5-c7a4-4128-bd37-f17150a5064b", "value": 72500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995123, "uuid": "178f91a7-ab15-4423-a044-03df0cb67eec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995123, "uuid": "9e44b993-d2b6-4201-8a9b-8c9f210e9669", "value": "invoice-1645080830.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c222f4af-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026718, "uuid": "9bc43c1d-3b38-4cfb-bcfc-1362c7825dca", "comment": "Malware payload (Mirai)", "value": "d26d3a7aa85561893ab3f6626e5f5d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026718, "uuid": "1c99e131-6cda-460a-bbd7-bd623bf36042", "comment": "Malware payload (Mirai)", "value": "c2fb0ea88da07e08c165e86fca2e6f157cf56fcb015cdf6a2611b5442a05de6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026718, "uuid": "cd0b8f2c-6405-48b4-97c0-8b9d8be6e3d3", "comment": "Malware payload (Mirai)", "value": "c62feccb98e8bb8520b59ababf933e6eaa6347f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026718, "uuid": "11dd3c6b-6bde-4753-a927-0cbbf0b57b75", "comment": "Malware payload (Mirai)", "value": "c5b907c87d90861a1d3bb99e3cf429691956a352d8263ee6d428ff9b147fcea346ddb4cd0ab64fd30c73189f87b53f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026718, "uuid": "e15706a1-1ee9-405b-969d-5b1dea835605", "value": "T15883A50E7E219F6DF76C873587778F209798239627A5C242D1ACE9005E6030DA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026718, "uuid": "55f2ae01-7eb8-408b-a943-b53b43177bcd", "value": "1536:Daj5eEYBZ1VMHd0WiNv4rY4AP1qyC91cGG2iu3jZcP+3Y+3P+3P+3P+KbnuTG1h0:DVEK1VpP1qN3vG2iu3VcP+3Y+3P+3P+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026718, "uuid": "e7e9f8a2-3ba3-4c7e-90d2-2397e358b08e", "value": 84368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026718, "uuid": "a80960b4-f0c2-4404-a23a-3c7022b08542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026718, "uuid": "c7d958b0-fc96-463d-b27d-b481ce6c70b0", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e33b794-e4b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011598, "uuid": "9a00f18d-6ef7-4088-b8a0-bf1fca208eff", "comment": "Malware payload (Mirai)", "value": "892cc859bfa2f3d964fff591e5032629", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011598, "uuid": "1fdb3c24-f6af-4345-b3c6-f364551fff3a", "comment": "Malware payload (Mirai)", "value": "c3252617c43442a4b4493884a73dc4c2e1a86ca50093803475caacd1a4545ad8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011598, "uuid": "4aca7c6a-b029-4957-8744-907e43474c54", "comment": "Malware payload (Mirai)", "value": "440310eacb82cfa23dfb8b922b6ae93814960722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011598, "uuid": "729763b5-7fb8-4554-ba9c-3dd605cc100e", "comment": "Malware payload (Mirai)", "value": "9b448bccc4b6e6ff4da3d16354ae66a08674a0b2ebe11535b7a05779ab3b99849352b9468d90c19038050fb2b91aefb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011598, "uuid": "306dc5ad-143f-418b-b8e0-7a134fcfb5d4", "value": "T171C3F185BB6369D1C1A342FDA4C00AC387916E318BA313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011598, "uuid": "d2a538b0-dc4c-469f-897e-0a27b3f37856", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTny:0OCDjXG9qTWywxlxTny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011598, "uuid": "37be5706-18b7-4c7f-b13f-e3caae078a19", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011598, "uuid": "581461e9-4d38-4ef7-a3d8-6b0f3bdd7d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011598, "uuid": "9a02640f-7b71-43e9-a359-b70ada5d8b46", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c66d85-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995555, "uuid": "b6dbaf6d-db64-4b80-a5ab-e7e22a9a70b2", "comment": "Malware payload (XWorm)", "value": "4b6ef8aa77fb5b4c5bc7c9e855031914", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995555, "uuid": "be0ba448-d67b-49db-bbbe-3c17bfbe108c", "comment": "Malware payload (XWorm)", "value": "c3aa4f1eeb9074a3952edc8343fb88534ffb6a9922850db00c14df4ff57e0aa1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995555, "uuid": "8a61c075-97c0-40ee-987e-c331ec42aff3", "comment": "Malware payload (XWorm)", "value": "578aa42bdf680e26463607718ce385e4020066ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995555, "uuid": "f6c22e0c-a671-48ef-be8f-b988707307b8", "comment": "Malware payload (XWorm)", "value": "9606a7b6467d89bcef7fc0700250b42b165e07807b5e072df5991fab0e27ec3d41d2f4688c55f2278d1ab24cb2384825", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995555, "uuid": "c734e82d-9c65-4f19-8ecb-bb76558e9965", "value": "T1B7631B9FDB3139A835D69BF269FA3801C399EF71560B62EE0B02F05C44187696512FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995555, "uuid": "62db707e-83bf-477d-b300-951d497a811e", "value": "1536:I9l/AoSSMyeDFeDpeD6eDveDAeD5eDweDKeDTeDAeDIeDceDkeD6eDzeD2eDVeD5:I9l/5MyAFApA6AvAAA5AwAKATAAAIAcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995555, "uuid": "7270f445-df92-4148-b76a-67fb5027d324", "value": 67778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995555, "uuid": "947c16d2-567c-4b28-af42-af1c4fa6faa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995555, "uuid": "2c00f0cc-a4b5-42d5-aa01-60c4d69375e7", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b52e4fb-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026492, "uuid": "be579994-5076-46b5-9e87-21df45bdc217", "comment": "Malware payload (Mirai)", "value": "c8a321456d77223a5c31ff6879d6a4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026492, "uuid": "8938f111-1024-4952-a2d3-34f79715b5b2", "comment": "Malware payload (Mirai)", "value": "c3e61865aaffcfcabab85e2af9c0566b85296384de99ef3ebc40f2a9b7022643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026492, "uuid": "a04cbbc1-78db-4cd4-9379-0ac9ae4f2faf", "comment": "Malware payload (Mirai)", "value": "a67fa3dcacf4a6e3101871c5579c97e9b30c5339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026492, "uuid": "727a8f47-634e-452f-9b0c-414f66c01399", "comment": "Malware payload (Mirai)", "value": "0f728ea2b35d1f3453361172af16016b5a71ad4658a20310558b5384b9fa66ea27c6b609ee5e794f465f1758c27fde36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026492, "uuid": "ff55514c-3133-4ac8-973a-a3f8d39a8261", "value": "T117142B43E9418E12C5C211FAFB6E514D37136BB9E2EE7202DD246FA037868EF0E7A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026492, "uuid": "abaabf09-a08a-40a8-a793-524987ff175b", "value": "3072:iWNkWMUnRgCbca/QgDHIXWJRMaAJqc61E/at/8q8x1j6hh1eRwi:i8kzURBbcgTEXWJ+aEb/a6q8x1/Rwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026492, "uuid": "87ff7550-16c8-4f64-a0bf-215c2cdcf639", "value": 205264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026492, "uuid": "1b1b3eb4-48ed-47b1-8010-842c37a3319a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026492, "uuid": "702f96c4-5429-4f7c-80b7-fdf7b3f6cec3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9de2250-e48e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1766996183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996183, "uuid": "fe45ac44-7eb6-4f2f-9556-7217954d3b8c", "comment": "Malware payload (Vidar)", "value": "ef43509d84c0464588b2c7394e2f5c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996183, "uuid": "e703de71-db2c-49d3-ab14-ff85edc17464", "comment": "Malware payload (Vidar)", "value": "c3e984ae59b1fa59e9c97c775b69014e63d37558bda0ea61451597a788116b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996183, "uuid": "ce31b890-ff2c-46f9-8b1c-2dc40bb91967", "comment": "Malware payload (Vidar)", "value": "f734ddb9e7ba8d35b6eeb0c6d93b7a44c1bf9f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766996183, "uuid": "3df56da2-5339-442f-b185-639543f45ee1", "comment": "Malware payload (Vidar)", "value": "ccf9b2e926e7d6bafc101cf023f4cf98aa170a246cc1e0a7c0f419781a1ec8889c9da553186333729e61c372eae8ce8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996183, "uuid": "08aa1bf8-e6c4-4c99-b8f9-79bb225d0446", "value": "T1AEE53313F2D74430E5A59B3285661805BE6370981EF6606B3CF8C20E5AB9F81AE77773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996183, "uuid": "63e8ddae-d0f0-4e03-9a0c-5dfdc5257a73", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996183, "uuid": "b34b4816-3787-4876-a4b4-488317b4ad94", "value": "49152:YAnaVsqDTClIlzH7udUcE/ibU+4sb7+Er5Nsu3Ijsr8WByFCJKmBosVfY4pviM:0FyGH7uTE/ibU+4I5qu3IjEByAnGP4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766996183, "uuid": "c7d8cb19-60f7-419a-bd55-74263a88bd5c", "value": 3254469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766996183, "uuid": "c6ef5237-8103-4064-879a-48cad56053e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766996183, "uuid": "73db8875-c725-4220-b155-60e25d2da041", "value": "c3e984ae59b1fa59e9c97c775b69014e63d37558bda0ea61451597a788116b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7e3d86-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766995058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995058, "uuid": "932b3027-c6a9-464a-a0eb-edb52e6c9dc7", "comment": "Malware payload (AsyncRAT)", "value": "68750f728d1ed8810917c49224196328", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995058, "uuid": "d154e0d0-41f0-45d2-a6a6-8af7f9581a3c", "comment": "Malware payload (AsyncRAT)", "value": "c3eaa1354cfca5b39c91c34ab0dd8361834ede6ba9ed0981306e91f410b59fe3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995058, "uuid": "4e33e10e-caa1-4b1f-92c5-6583fc05ac99", "comment": "Malware payload (AsyncRAT)", "value": "4bbc309e89ae003e65c3092f805a595276582f3d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995058, "uuid": "c3718d24-28cf-4f27-b54d-89bfc31aebe6", "comment": "Malware payload (AsyncRAT)", "value": "9a75387809d70b33ae320596d1962458fd04aeef14b643f371d4ed354ac07fac45d25844d9257daac26fcfc6788e0aa3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995058, "uuid": "511f8ab5-08cd-4d85-b5f0-78069a475cbd", "value": "T102232B043BE9821BE2FE8E7D59F11545867AF6533602D64F1CC002DE4A23BC6DE52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995058, "uuid": "9062a898-083c-4ba4-a11f-cf97fbd9193e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995058, "uuid": "c699d8ba-7e70-432e-9f84-f3dbc401055f", "value": "768:sseYKKfWUoEcveKM2f06jzuGnuvTYzqHn9eb1+gUptw2rAK8RccCrWBNjJM:0jEc82fBjzNnbzqHnUbvU3TrvYcR2jJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995058, "uuid": "1613407e-65a4-44ab-9a82-4b4e81221219", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995058, "uuid": "cbcd9683-63bc-4c08-afc7-a4b0bb862a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995058, "uuid": "68a4a637-2b52-4131-81c8-be5f143e3e89", "value": "gStub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ddcb31-e50d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767050801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050801, "uuid": "356cb97a-c0cc-4083-bdd2-649e05f4a786", "comment": "Malware payload (Mirai)", "value": "5115615a9da7f4fe44191422c6e68d40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050801, "uuid": "20644edf-eea9-41ed-a07f-6e9cb89c15a1", "comment": "Malware payload (Mirai)", "value": "c4fb17f0713882c45b97644e9f04901d36ee9bb845b675a53c8341a36f236a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050801, "uuid": "8f0f5d10-8c0a-444d-9fa5-628bd9a6f43e", "comment": "Malware payload (Mirai)", "value": "271dc0c6b39545ad3ef45e22f462085859a51261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767050801, "uuid": "1b5c3e8d-31d1-4856-a80c-502a2c95a296", "comment": "Malware payload (Mirai)", "value": "18c34681401ea91dcc51359e338828c084757c97f686334384b2392aeda17ca7e167f921ca29278a5318232e7ba653ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050801, "uuid": "12120680-009f-4de0-ad69-b0222d27db1a", "value": "T17A533B217A792D2BC4C4B4BE52B74734F6F1174A32A8CA2A7E730E5EFF146502107AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050801, "uuid": "9297a384-04b5-4434-921b-5d514c23b952", "value": "1536:EFWSASZjjGILD6SQfi+nhW9rSOUZdobB0ke8chj:UHAeT65pGmke86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767050801, "uuid": "15831c0f-08cf-445a-868b-3c46b50f1f9f", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767050801, "uuid": "b2fdaa15-6be5-4b69-874a-0729e800882b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767050801, "uuid": "5bc7fa0a-02aa-4eb0-85dd-4d2d21a2d1e2", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e9225e-e493-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766998158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998158, "uuid": "92059755-848c-4f2c-a43a-fe40ef771b79", "comment": "Malware payload (Mirai)", "value": "83d51e5d7ca46014f1dc54b7e5e5aedb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998158, "uuid": "ac49b6c2-798a-48fb-967c-80cba05fbff4", "comment": "Malware payload (Mirai)", "value": "c5547951af60334e9f05b0dcef6804b3891e6fc12bc172c58bfffa2e9f5102d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998158, "uuid": "803bd76b-b9a8-4e51-a26c-24667e4fceed", "comment": "Malware payload (Mirai)", "value": "deee1779b3dc303c9fb2fe9504c6c9fa8233a59d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766998158, "uuid": "e3aadf1d-1ee2-4135-814a-565f2ecb8335", "comment": "Malware payload (Mirai)", "value": "277337d2cc1144c12d8440058f929d9fe9cf0b473b18023b2b1f267c5dba2807d3d4605df617ab8e64095f5b9a09b8d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998158, "uuid": "631d270e-c0e6-4da1-8a75-afc72782900e", "value": "T135E37C42FA418F13C0D517B9B6AF02493322A7A593DB73069D245FB43F86B9F0E63A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998158, "uuid": "ef80d619-0612-4440-b2ab-05ca9efd83f9", "value": "3072:LpRG1dyZdVcpPYOwGfNFQqS7Kz3X6PVbn7eQM/9S3BcIS:LDG1dyZdVcpQOtfNFQqSez36bn7NM/9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766998158, "uuid": "a472298f-87fe-49f1-99d5-af70acaaae39", "value": 143008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766998158, "uuid": "6ee2df42-6754-404d-86cc-534a5e20ce11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766998158, "uuid": "027a0cd6-bd9c-4ad1-ba0b-13d6f22508f7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe453bda-e4d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027248, "uuid": "544457d7-5d96-444e-8dfc-716b310fdb61", "comment": "Malware payload (Mirai)", "value": "2a87c59d1deafdb9fae85ae799d83c8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027248, "uuid": "135221f2-6a6d-4370-abe7-87ede3229024", "comment": "Malware payload (Mirai)", "value": "c567dcef15ec413c57e8813094c2b8172e9aede77feff8d0bbeacbb1a35b9545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027248, "uuid": "03cf1d2b-b7ea-4ccd-867c-bde6e5384f33", "comment": "Malware payload (Mirai)", "value": "3344e8d5a87c0fadd5adaf4886ec1d04297d5af5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027248, "uuid": "35276beb-af29-45fe-9f13-892acd3a7945", "comment": "Malware payload (Mirai)", "value": "975ae622acdc4b00f5d81a1a3c4aeecc27ea148ce810c6fc9fa2a028de8fd583faf5345d94118bf3818a8927a9237336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027248, "uuid": "50f65bd8-dee4-42a7-b999-7d0860591fbc", "value": "T16E237D407308C543D25A5EF1293F2BF0A3BE9AA01264E3C5B91DF68D4272E336447EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027248, "uuid": "89ddc6e7-5d89-4cb1-a67d-0933de9f25af", "value": "768:/7zq4HmBEgQD0ubpQN1Uy0eWnbYDAWcIutf8L6mGXCaC7gWZou+7Rf:aYm+gcKWvvM3Ot0mnya0ZZou+7Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027248, "uuid": "d899b6f8-28a0-4cfe-9fd8-16c94e396e32", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027248, "uuid": "6c6a9d77-c06d-4cfe-8a1c-7a96eea63cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027248, "uuid": "3303dffa-836e-4d94-95e2-3956237d7e60", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bc4550-e50f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767051390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051390, "uuid": "ae955273-b0d0-46b2-84fe-bfeb5c7328f2", "comment": "Malware payload", "value": "54a7d8d8f6ee586e266f369b0a8a8dee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051390, "uuid": "f3c46429-a239-4a75-83af-97f0b203ceaf", "comment": "Malware payload", "value": "c5ab0adaedf391a395387df33b0bf6854f1ccc9c5da937915ea86b5eec6e6103", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051390, "uuid": "cffb032c-d191-4f33-ab5f-8aa2110f5657", "comment": "Malware payload", "value": "3db0f3cb7565a183f8601f5515315ce8e36823d5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767051390, "uuid": "34539a2a-8f86-461f-89fd-eb7ed9f9df68", "comment": "Malware payload", "value": "a1e42262445e82119a3f1a129c2b7099411fe8021ee333d285f7ef5f97e9b1b65bc511fd65d8e12b06c0deff216a4253", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051390, "uuid": "630b4c35-6082-4f93-bb4b-bcbac1dc5768", "value": "T19FB5F042BBC4AC1FCCB3D4324BB5877B11455D8A868AD313CA60B65C5DB7EC09E86EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051390, "uuid": "7ff87e49-ab10-434b-8723-9afcc26c0971", "value": "49152:CY9l8FXNHt0RIoeXVQ/lTiiLl8qLmRk4kNtwHDAdgvY9Wh:t9l8F9aeoeXVElTiiJjgaMAV9Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767051390, "uuid": "a8309cd1-02ce-44b9-9e75-3cf888762652", "value": 2332330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767051390, "uuid": "ce3162ec-35d4-4007-826f-2c289901ca2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767051390, "uuid": "e6ea65aa-3ee2-4377-b935-ffe7e539e723", "value": "evil.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ce8a9b-e4f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040200, "uuid": "df22f1ac-2016-4838-93f8-bddaffbbb983", "comment": "Malware payload", "value": "901d0307546c933dbe5911c3898d6625", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040200, "uuid": "a53c9b6a-e626-492f-a491-50c460a5e75f", "comment": "Malware payload", "value": "c5f2e40bbcf086e36bce2fcb973115badd08ac3b2ab1f83cb0cb5a3e8ed7ea91", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040200, "uuid": "6b4f01e3-a757-4d70-940c-783e6ca5ae72", "comment": "Malware payload", "value": "8187c53b3283a8238e26548f4466ad8503d6d4b3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040200, "uuid": "da7dbe47-461c-4684-9b04-397726db9d74", "comment": "Malware payload", "value": "48392a2e9c23b2794f2c82ef29f15db01c817f7a9fb4a8b30041b6cce3a12c1f94b5ef88fddf8335a1e086d993783ab3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040200, "uuid": "209d62b0-dfff-4f7e-b85d-4dc348eed7d7", "value": "T1F7F533604F06A45DCA63CEB0B2EE6060C97B9272547A3F163AFAF46531D725C3492E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040200, "uuid": "04679f2d-94b0-4292-9ea6-39e9bd97332b", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040200, "uuid": "8c99b317-55b8-4a51-8ff7-48231bb16025", "value": "98304:6Ku++Yysv9YEhIUHg37aKgffh6ZUbZ36romp:6Ku2K4ya5hjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040200, "uuid": "23d4556b-b64c-466e-8034-c71bd73dc5b7", "value": 3497984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040200, "uuid": "1cdc7093-93da-4074-8d95-8a82d816832c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040200, "uuid": "2907e665-d4fb-4959-8650-b92897991ae9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa335d3b-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013498, "uuid": "fa1fdbc9-2f7c-416e-ae5f-6f4376d7de54", "comment": "Malware payload (Mirai)", "value": "626f2b9b96a7dff233c71dc24075f722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013498, "uuid": "f3d617f1-1731-4ba5-8db7-54d001f7916f", "comment": "Malware payload (Mirai)", "value": "c61bfb1d7d331b91f618a599931ba880357f14d81774013da7d4a6a3d309fc6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013498, "uuid": "7db953fd-5e6d-491f-beaf-4d672a6cb8b8", "comment": "Malware payload (Mirai)", "value": "9ea66f7bebe7766f923652a9e9d2a52c5670e912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013498, "uuid": "7ea3e6ea-32a3-4869-8412-54a3e7b483d1", "comment": "Malware payload (Mirai)", "value": "8378f221e594f63d7ab5005f7df48849e6e72d76b70e5e017928d86fa0868fe42fc520537adaede6835eb1797ad673b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013498, "uuid": "9e6d9561-51ae-4cf6-b8c1-2d5be5740c36", "value": "T1245302F6A0D4BDCDC2954774020F0A063EC6B278A09A652B76D5E25C8BF2344CFD9BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013498, "uuid": "a8aeb96f-6292-41e0-9213-9c244eb34e4f", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASAkLkg4azH5:CM5az1Fy0oPgdZX6hTo8R/LGazH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013498, "uuid": "a1af471d-4b8b-4402-9eb5-a7486e7bfe69", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013498, "uuid": "a1ffa6e7-3f47-42b3-b485-aab38eb41fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013498, "uuid": "f9d0d835-3dce-4ec7-a31f-285ee968a932", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884085bf-e4bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015454, "uuid": "1317fb1d-1ad5-4a8a-a674-22c40e1c3545", "comment": "Malware payload (Mirai)", "value": "dc309f60300caf90f54d03c156106873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015454, "uuid": "51873d65-8f0c-4420-bbeb-f46ca943e66f", "comment": "Malware payload (Mirai)", "value": "c766d772bfdc8665862ba1e9c4665a57fac5f998516cc1c6ef81d02042772ac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015454, "uuid": "f24e2231-8713-4d05-96d1-62a63ea39704", "comment": "Malware payload (Mirai)", "value": "2fb69fc80010406a7b265dc7ef093dfa8e5732d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015454, "uuid": "1e040cf4-32f6-455f-a44d-301851efd6a9", "comment": "Malware payload (Mirai)", "value": "223d6ace93db401bf3f9c090d80db5b27575cf0e0b0d660b458df1f0971bc044ff1d6a370a6b3810040b1637e30aff9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015454, "uuid": "ad7945a4-a1b1-4b61-a182-c231e547afae", "value": "T1A973A44A6F719FAEF67C873287F74A21974823D523E0C685D26CE9001E7034D682FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015454, "uuid": "dbc261a5-9c42-4b64-8b16-ba95e0e2ec5f", "value": "1536:K+tm+wsYyfxAb+KEdKe08gZDK+WA9ANaNsFC61lO+mYyRnGRxjGRRusotlZ90Idt:K+3jKzs+WA9AMNsFC61lO+mJmlDdQT2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015454, "uuid": "c2f9f65f-51df-4b7e-8763-2b8d413d3da5", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015454, "uuid": "39d2cdb6-93c6-4bb5-a87c-723c9c805483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015454, "uuid": "098feca2-5aea-4c7d-94c2-83729e9461e0", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c83027a-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995114, "uuid": "e44a7838-7b39-4815-b89c-085f4be15dfd", "comment": "Malware payload (XWorm)", "value": "fde13212e02b2787417676d832f8d9e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995114, "uuid": "a24379ce-c0d7-4277-8df1-71f923a50ac0", "comment": "Malware payload (XWorm)", "value": "c769df21e4dc00da52ac7b81849bf3752f766ee1caf6dfd4f639db4cdff02bd0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995114, "uuid": "60d70de8-81f3-4997-8998-7dfbfe699a16", "comment": "Malware payload (XWorm)", "value": "57359b304dbc797704d2aee1df73cfa108034bf2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995114, "uuid": "1bc4455a-611f-4370-82cd-313620b564c7", "comment": "Malware payload (XWorm)", "value": "34973c84705a6b0ea63bd6230dbc631724575428397cf908b9b2f39a84531118153571a33ba94b9d1237fa8bec635881", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995114, "uuid": "83e3c755-0278-4542-a8c8-08a7fadd3d7c", "value": "T1B0631B5B6B30B5DDF1EF89F948054EB44CE19B121FE9161208A3F1741A8DD4C78AE2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995114, "uuid": "7f3d8d28-5ccc-49b8-a2b2-aebaa01078f9", "value": "768:I8w/h62/jWs6oS+xISN0v1nQx/pyEvVVN7dYVWdd9djXtsVIziho/352af/ELvma:I9l/AoSSMtyusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995114, "uuid": "a36c78d7-6e48-4322-b8e2-04fa3b1a485f", "value": 72500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995114, "uuid": "251d0690-18e4-43df-894e-510edd0fd0dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995114, "uuid": "939972ce-66ac-496d-a7f7-ef2aeca4e343", "value": "invoice-1645080830.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4289c967-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766968951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968951, "uuid": "c1e07141-fc03-4989-bfe1-52b59d630e8c", "comment": "Malware payload", "value": "fba8a1a5d2aca7376f0cf63d8f8f659f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968951, "uuid": "969b6891-4a41-4240-83c1-5142cc524240", "comment": "Malware payload", "value": "c7a14b3c594b10a456e1cb442021af49943c90b1e7530ce644d1dc0f13aa19d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968951, "uuid": "0deed44e-3ee7-44e6-b423-731e905be099", "comment": "Malware payload", "value": "9b30b4e806bd123b406df5885286b00e7b3f750f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968951, "uuid": "42fedf6b-3bb3-4da3-8ad2-135f3c125a65", "comment": "Malware payload", "value": "89d105065d0b9297a9d1a45d1dcc6d03894d83d3a7c4fcea268579685d9eaee7a74dc4acf00fef21bd63230d145bd92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968951, "uuid": "68bb90b4-a178-436f-a04b-8fcc6722691b", "value": "T12F730985B852DB6AC7C147B7EF4F438A3326A7C8D3DE3317C81847B4268B55A4E2B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968951, "uuid": "957289f7-b75a-4c36-aaab-bc919c86848a", "value": "1536:MECXJFefqWZylCIP+rNY2UXU5LMv4ykK9N/h1caik8DmSzaj2qFmJ4kvnz:20qGwP+rUE5QvxkKfl8Dmrj3FKpnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968951, "uuid": "0a4e836a-2819-45d8-9767-29c1cbd049d5", "value": 79224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968951, "uuid": "2ae920c5-5ba5-4dfb-8c7f-7c66abd849fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968951, "uuid": "9b1c0418-ac89-441a-8456-be3f0a8813e3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bb74f5-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1766968036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968036, "uuid": "f9830334-d851-4c1f-ba25-3d9cdc87fd14", "comment": "Malware payload (PureHVNC)", "value": "64b1235220fd29f8bcca83317a2a8ebd", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968036, "uuid": "3f40da3c-2883-457d-9d27-a5391171f503", "comment": "Malware payload (PureHVNC)", "value": "c82b37d36f7a555c7294787b815df61f14c7abb4d7e67110d45436d6a5b220d2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968036, "uuid": "e1b927d7-bd16-4d69-a157-b12dfe8164a1", "comment": "Malware payload (PureHVNC)", "value": "ff39d3787e5a550e0c60d760e3f8223527c91e6d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968036, "uuid": "9eac8f01-6c50-4be4-a8b1-284e8a1a8655", "comment": "Malware payload (PureHVNC)", "value": "1231294cece49891687d0145d820b83a0c7fdb3fc3fabed2834d88ec2e74286ef8d9e162cea015eae8c7f8b1879c1141", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968036, "uuid": "99275377-da33-4e5e-883a-6024fd8fa739", "value": "T160E633709F72895BE53702336FC2064467DC2EB920B15B673BAC3FD6A54A360469E38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968036, "uuid": "5b5c0265-11d8-4081-94f0-9316083818c3", "value": "196608:RH8QtP009tb+5gYypzskn+TtQyq1m1A0sTSz2ERyfZnpFEjJkhwhisMP6UMLmxdP:F8QNAOVmtQb1m1LmA28RblSde/HYBOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968036, "uuid": "28f66053-f054-459f-a5e3-af4d009ab66d", "value": 15257600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968036, "uuid": "17e3ee38-0e97-4cb5-b21f-97c765fcded1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968036, "uuid": "92035822-b6f1-494a-91c1-673b9580b09c", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2550facf-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967614, "uuid": "6601ec90-f817-4ec1-813e-1aab4516a5bd", "comment": "Malware payload (Mirai)", "value": "5125d155531539f9c6a77b979bb1181f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967614, "uuid": "505da975-73aa-4d1c-a87d-9c4319180fb7", "comment": "Malware payload (Mirai)", "value": "c84d84a3c0c13cf74150d437c649906bab68a95d94d0b9f74efffe84eb428d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967614, "uuid": "e5b45286-2443-4b5d-97bd-e2d5a636ce67", "comment": "Malware payload (Mirai)", "value": "6d8611995f928afa89c5f2c101fe88fceff7ca9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967614, "uuid": "f231b9c2-055e-411f-9518-50c30327d59f", "comment": "Malware payload (Mirai)", "value": "d8fbb7ffaee1df22d95996c4d419c31054ffe5872059ddd75ed0afcea530ffffc9f77dd2ba798d7ac4447a9139c927e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967614, "uuid": "7c60381d-b7a4-4854-878e-9e3b501af260", "value": "T13F730785B8D29B29C6C14B7BFA4F53967312A7D8D3DF7313C9184B64368B54A0E3E602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967614, "uuid": "fff4826f-4169-4271-8214-c46d471cdac9", "value": "1536:SWTnz2ant4i4RDc2N6qUQbZj1Mlh7khSrVq2eJTrkinz:XzK4t4xN6qUQbZRCh7MSrVHeJT7nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967614, "uuid": "eafbafbb-87d5-4d5b-bee1-abcf54fbec52", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967614, "uuid": "dda37c7e-3c68-4472-a36a-8a62f5a26c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967614, "uuid": "e6b3082c-8da2-4585-84a6-32bc8d0dafc1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf04dc3-e4ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015193, "uuid": "9f1fd6f9-3487-4050-9cd7-6817834ffddb", "comment": "Malware payload (Mirai)", "value": "0aa6c7929555fd03cb82faff38578461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015193, "uuid": "6c7b2d8e-d417-4ba0-a0b8-7fb4f00e7b32", "comment": "Malware payload (Mirai)", "value": "c865360c54f7cb6c98840b96062e364f60bac62d7f97c30deaa5faec941d18a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015193, "uuid": "f2d0397d-e0b5-413f-8680-4b752894793a", "comment": "Malware payload (Mirai)", "value": "602290ce36eeab243f1ed04b3360777256fcef47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015193, "uuid": "0f7a9cf7-c5e2-4e47-813d-e954d6098841", "comment": "Malware payload (Mirai)", "value": "f2e7907e41169167183e48cf000beaffa2d6742dbc5c3476db7cf1bdf299012b9b614de00eb77f6022c3208a7d961d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015193, "uuid": "9e0ef118-6bd1-41ea-a469-415236be4d89", "value": "T107334B43321C0657C4A25AB4293F1BE0D3FFBE6121E4B288650F9B5A45B5E331086FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015193, "uuid": "c20a06ee-6c2d-4aba-a01f-553bdd2494c3", "value": "768:G9VjompQRfi50//pcy6aa1w07JiklspWtwChcSGIjqvzTT:SjnCiy6bLEkeWhcSGqATT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015193, "uuid": "9dec4c46-b2d1-4e18-854a-6aeb20323ad7", "value": 50460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015193, "uuid": "6b7628fd-2265-4314-a70b-51cb776e02c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015193, "uuid": "fe5ec602-2f2c-48c2-a5eb-e9093a4a4305", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83029b7e-e4b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767013298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013298, "uuid": "74e7a121-e8d9-4139-993b-12fc70e76e8f", "comment": "Malware payload (Mirai)", "value": "0b979f9b4717ac8d18ab4aebf3e1d866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013298, "uuid": "5851c979-db15-4506-a10d-d7aa2c251441", "comment": "Malware payload (Mirai)", "value": "c8a361bea8d5bbe96ac06e6e2dee41fcae58d093ccf6463fe77a66a5ae61a423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013298, "uuid": "bda8c758-f079-4b32-9f83-bc4feb263753", "comment": "Malware payload (Mirai)", "value": "85256c386d4f8f56b10ace6a1ef0b189774f4bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767013298, "uuid": "38585b52-b7d2-401e-9a09-17d5f5d60fc0", "comment": "Malware payload (Mirai)", "value": "e98568200f32a5cd699b822cd40d7943afbc3b5b75d0d8c5f61ead795816f082f04d1100be6043ca77c0e4b70616e544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013298, "uuid": "da9d83ff-c28b-4939-9c07-7f37d824de08", "value": "T1EAD35C0A78D274FCC687D170926E9F61E63A745C02183DBBA3C2AE711937DD05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013298, "uuid": "b7425c25-dfcf-48a9-b69c-c4045aa56cee", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQL:yIRfe3xvvSrlvZZ7UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767013298, "uuid": "043f2c68-45c5-4eec-a67a-90b5cdd74542", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767013298, "uuid": "68887f7a-402c-457d-adf8-bffb248b2847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767013298, "uuid": "33c7a0b8-5a3c-48c9-b374-5d3679db450c", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3596b689-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969359, "uuid": "da5b2f92-075c-40a0-9759-191aff623575", "comment": "Malware payload (Mirai)", "value": "48f0df5eb41717ed6ed0e5f0178e2707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969359, "uuid": "bd67f0de-fb9e-42af-99d7-585ab1c6b13f", "comment": "Malware payload (Mirai)", "value": "c903a38571866a1644e4f3525d404a3e28b5fb30193b6f402bf0dfd311f70c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969359, "uuid": "f1b28825-ed56-40d5-be02-1616a60394be", "comment": "Malware payload (Mirai)", "value": "95c32fc3df87643ba40531ff951a9bf93adc1161", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969359, "uuid": "a865acea-12ab-4a52-9998-fce66f44337e", "comment": "Malware payload (Mirai)", "value": "b2b7d45ade4ef7c5f857b3cee27b49c9c018112f4cc1623d86969b63deb4ba25296f00da8dedcf89b934223e8949b143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969359, "uuid": "1fb8eac7-9878-4ca6-9ded-b6583bc146d6", "value": "T107536D17B040D0FDC8DAD2755BBB6326EA7370391276712E27C8EE226E5DE211E6E710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969359, "uuid": "57b3f5f4-e9e3-49b7-86c1-cd1ee5aefaf8", "value": "1536:shZmW0/GTELLsG+djmuXsh2j1cHJ33lRu3:aA/G0L9+dCssh2qZ1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969359, "uuid": "b28f159b-bb7e-4764-9ba9-b658e6f8bbd6", "value": 63144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969359, "uuid": "60590f5a-d3d3-4a69-a2fc-f94d0531551b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969359, "uuid": "f143208f-c0e2-481e-ad1f-c69c37a3e6cc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4947550-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011341, "uuid": "d0a4a997-bd37-4b0a-a9ac-18c9a955d680", "comment": "Malware payload (Mirai)", "value": "d09671d0b8dc8ddd09a1de7395e0c939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011341, "uuid": "63791a6a-4f55-4bea-92fc-b7c737436f83", "comment": "Malware payload (Mirai)", "value": "c956bba76d9568202f648de673879f2eaccbaa56ae62a786e52df4084f7a875e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011341, "uuid": "f09d4625-8dc5-4d42-aa5e-5c329d96fc2b", "comment": "Malware payload (Mirai)", "value": "823a91c2dc071c5700bddeb98a865282feeb99ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011341, "uuid": "08f8fa2d-edf9-43e7-9980-26871ea63d22", "comment": "Malware payload (Mirai)", "value": "44c2276c3f30143101a3a5fb7be9c2baa9c76f1cf53641126fbbe958f9202d2feed8af63247242eee8a1e3058a779833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011341, "uuid": "f66615ba-4f34-47df-8d2c-f45194cb59f9", "value": "T167D3EA06A9419F12D1C211BAFF5E465D37137F78D3EE32029D247FA0778A8EB0A7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011341, "uuid": "1187cc74-7bbb-47af-82f2-afe775e66693", "value": "3072:nbjoBqXi7hH9foXtoMIJaW90bfuBxyGcpnYHC:nbj6XHaX6M4aT0yG+nYHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011341, "uuid": "d6feb0ad-c8a9-4d7f-b0a4-2782ab249536", "value": 138224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011341, "uuid": "19e6822c-3c2b-454b-a151-82a1805faf07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011341, "uuid": "9586502d-5b43-4459-abc8-f427a796a184", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7444d5d7-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995234, "uuid": "78199d0d-5fd4-438b-8a7d-a1fc223effa4", "comment": "Malware payload (XWorm)", "value": "43e762dbe75f640d359c71adb227de1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995234, "uuid": "e661320b-ae02-4e90-81a0-8b1195ec91ff", "comment": "Malware payload (XWorm)", "value": "c979471b42391b2d9564c39fd9eb3ad29922b341f065e269a4644065034eb5ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995234, "uuid": "5ef5725a-0768-465b-bd1f-5c5cd80c85b3", "comment": "Malware payload (XWorm)", "value": "3eca5688a44103ff63d36847e2c18abc6763c35b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995234, "uuid": "4d6138b2-e3b2-45e7-991f-4115c4ebeb8f", "comment": "Malware payload (XWorm)", "value": "5726c1d85290fe3aea66059553faa5c33e09b11cdbaca9fb3612a675798087021633f1c0af16dec828ae4ffeeac3a97a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995234, "uuid": "c6e836f5-813c-41a5-b1be-92f0ac91f6c2", "value": "T1A973F95507E1F83F21D7BA95ACF13300EBD50C8744AE82A45BA2F86206DFDCB8B54B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995234, "uuid": "2e4c6660-da14-4b25-95da-2a87faeb8055", "value": "768:I8w/h62/jWs6oS+xISN0vMv3JBnqdkfScBYrwz2y8kTAlGB:I9l/AoSSMsIusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995234, "uuid": "af81a4e7-9b45-4f41-96dd-53e88da20815", "value": 73494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995234, "uuid": "01c12f7e-cca9-41ca-af94-e4dba71c9805", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995234, "uuid": "7f74cc4b-67df-44e5-928e-e149e05b4ea6", "value": "invoice-1645080830.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ffc562-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995128, "uuid": "55e48f34-23e4-4a56-952f-3c9c893fa3bb", "comment": "Malware payload (XWorm)", "value": "65d0ee36e75825acf98d7be55f2534dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995128, "uuid": "6eb31d86-d7df-4145-8f0c-8341eea69a27", "comment": "Malware payload (XWorm)", "value": "c9822f095797b89d968bfd158a816a6b3eb46da07bd906cb2a30f25d035c9ca7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995128, "uuid": "baa15341-ba70-4a3c-93d1-5a13a57b6e35", "comment": "Malware payload (XWorm)", "value": "5785c778418b4a186b2efa2e1dd54a132c8c46c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995128, "uuid": "668af1c1-46a5-48e1-89a6-0a89d719f742", "comment": "Malware payload (XWorm)", "value": "d675a08dda206ab93db47e9523ec63cfe90c45fd2e1100dea80b3cc20f13e2bb3041bc7a30e412894271d8fe6126671c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995128, "uuid": "3f8cf60c-120b-4ace-9402-c25ae0ae52f5", "value": "T1C3630AAD4F8DD8B0B46233C2651863463F2ED77354165AE0ABA79D5B604BF0406F2CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995128, "uuid": "e1795d93-4633-4e11-b9ec-6b3ce126e68d", "value": "1536:I9l/AoSSMUlmlJl6lPl8lwlYl2lFlLlulnljlClflzl/lolHl8l1ldlyldlklmlb:I9l/5MA6PWto0cKzBCl5e9JdsFojLOLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995128, "uuid": "8a498e0b-a025-47bc-8dc6-47c4a0bc87d5", "value": 72527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995128, "uuid": "04729dd4-5583-41f7-b83c-80e9b180e262", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995128, "uuid": "177a885e-c6a4-48e4-8b82-60a384743772", "value": "invoice-1645080830.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdf5363-e491-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766997213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997213, "uuid": "eb8057dc-d494-4aec-b025-10556524fbfa", "comment": "Malware payload (Mirai)", "value": "cec38ef748c774aab9046e948dffdafa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997213, "uuid": "f7b3ad8c-d4a1-417c-8224-3437bdeda536", "comment": "Malware payload (Mirai)", "value": "c9b3e2fdfcee08ab7a830a16b20ba4ff0c82fffeaab1b0e784be11a1ae8b2c64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997213, "uuid": "bedbc04c-ea59-4757-a853-5ffdf4019ce3", "comment": "Malware payload (Mirai)", "value": "eeb2ab98aca629105e22b52d4382dfe4992a2168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997213, "uuid": "a55f3353-38b9-488f-a353-231a794ae2ca", "comment": "Malware payload (Mirai)", "value": "e548c8d64088503771f81a741abf697473e98ad0a254d8d4f80e8aed302b88af6c9522970425ff45f55ddca95c63b426", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997213, "uuid": "3481c103-f949-40fd-90ea-c2eec5d12a87", "value": "T13E730952F8818E25C5D502BAF62D118D331227F9E3DF7212AE205F247BCA51B0E77E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997213, "uuid": "9278c380-bbb0-43c6-afcd-37487885f732", "value": "1536:SsnYm7Z0n6OZ5EUZmvdkCeWIOL4A7L0DWDb0K5MQuMUiChmNIEl35Y:+Q0nLTEcmaCRpslhmNIEl3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997213, "uuid": "f702cd86-3035-414a-9761-4173a4d94f79", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997213, "uuid": "d6abb72c-7a6f-48b3-a359-4e7146047ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997213, "uuid": "74c5c1c1-dd83-4f40-bb83-25eddea2ec01", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba09a024-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982466, "uuid": "bdae0849-8d0a-49f6-aa89-88507f32f8ad", "comment": "Malware payload (SalatStealer)", "value": "1ed00787099db57663c270fa010ea7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982466, "uuid": "10e5e88d-e6a0-4061-863d-029b0a9b9f6b", "comment": "Malware payload (SalatStealer)", "value": "c9d095060733f522e15cae159912b36f1b38b515864c86ce636d601f7b427136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982466, "uuid": "371c33c6-93c9-4354-ad5c-ad2a2982ba48", "comment": "Malware payload (SalatStealer)", "value": "9473307d718917682c57fb0c81a859bf32859b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982466, "uuid": "e69a376a-86ee-449c-add2-20ac2e3b674f", "comment": "Malware payload (SalatStealer)", "value": "b372fe1f160caa4119fb29155204c7bfa77129daa3b93eebec045af2665100115dfa5cf3b570abf4b22a0eac173b28e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982466, "uuid": "88aaa1b1-e09e-4964-b6ec-c9d3303a0b0c", "value": "T175C64A41FA8B54F6EA031832415BB23F63315D049B28DBD7EB547B2EFC77692193A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982466, "uuid": "83befaf1-671f-44ce-b746-76a41f4ede4f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982466, "uuid": "27ddc3b5-5534-4c34-81a6-7ce806b942ff", "value": "49152:oQBCriQVDcvBKAv35t8wan6kaLFV8CJ9CXPdD9pXjNPjo4AJ07ly+g/N1QkPzuzg:5ArvVFAxzFa5nlN66ziiXpHnmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982466, "uuid": "15037ca0-5ac1-4f2d-9d54-043bde9a4148", "value": 11655680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982466, "uuid": "74cb31a5-e02a-4806-9c88-9fcd3695c1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982466, "uuid": "02f55b2f-9a69-4fc8-9287-b93d62732a3b", "value": "c9d095060733f522e15cae159912b36f1b38b515864c86ce636d601f7b427136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c09689a-e457-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972403, "uuid": "47988a0a-6234-43d8-9fd8-c4be3fe8352c", "comment": "Malware payload (Mirai)", "value": "2def369f3b5ba8f921e69535335b0fe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972403, "uuid": "c0d374c2-e359-42d8-a278-ee4b44627346", "comment": "Malware payload (Mirai)", "value": "ca3312ba5477812735c1f5d485e66df6d1a5f7137107da071f74f0dbebb03ff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972403, "uuid": "df7d6331-f9d0-4115-b8ad-ee5751398f56", "comment": "Malware payload (Mirai)", "value": "204cf75dfc89c0ffeb72c7fc27ab8bc46ce05481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972403, "uuid": "6a694884-8624-44fa-b2b5-ba58a3a760ae", "comment": "Malware payload (Mirai)", "value": "911c909468a2f2fc16380c128542b79dc0b430eebd59926725904d1ab655ff421a152e5fd723928fc20dc3d6ec6260f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972403, "uuid": "133d90d1-77eb-4a9e-854e-2109537f8652", "value": "T148B31985B842AA12C6C2567BFF4F428D371657D8E3EE3203CD255F64378B95B0E3A252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972403, "uuid": "b0018b05-e38e-412a-b4fa-acb2572c166a", "value": "3072:elwQPMGZtePviUdn+jXUIV1f660DeSnz4:elvPM4taviUd+jXUIV1f66/O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972403, "uuid": "a1a5efc2-f083-4fc2-b884-edcf0b964bff", "value": 115928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972403, "uuid": "61cb3178-04eb-49f2-8c20-6f6e481a3e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972403, "uuid": "d191f9e1-9a45-455d-9afb-a7b3f338b08c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37831ae-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766988522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988522, "uuid": "d2fca7c0-2746-4c40-8340-b75a7ae401b1", "comment": "Malware payload (RondoDox)", "value": "b681f4a8cb10fd51519b784dc13feb13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988522, "uuid": "c7a5eec9-d76a-4e0a-a892-3550968a10a7", "comment": "Malware payload (RondoDox)", "value": "ca49ef1c9c2848ca62eccbd8b987206b8b003922f17afba1da34710938fb9bf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988522, "uuid": "8ddc44d7-29ac-43cc-8829-14e7f7b11085", "comment": "Malware payload (RondoDox)", "value": "442dfd3006f22d8b1459d6e3bb1bbbc388f0ebe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988522, "uuid": "42864557-913b-4c40-b667-f77fdab429c6", "comment": "Malware payload (RondoDox)", "value": "b44a001e51b441e054e7beb25e2a71e13a3caef7978d70544ea24519386b40f395acd97b8b6808281ef15af759337f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988522, "uuid": "7deea3f9-e438-40ab-a115-f2fa44d6dc7f", "value": "T13FD34B26B9BE191BC9C0507751E34736E5F2734960B84A0E3D731E8CFF616A0227B7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988522, "uuid": "a1fa0b8b-369b-4b53-b3d2-a157ab7055b6", "value": "3072:jatostPzuP1IeF7iUjnsoxf3D1T6i71G19RbfMAfbocINt3eqPStMr8:jatost0gFBfk3OaSer8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988522, "uuid": "78fbd8c1-f8bc-43a9-8905-338675f5e37f", "value": 131936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988522, "uuid": "1fece09d-fe8f-47f6-90d3-7446ddb9e3a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988522, "uuid": "e7596be3-6743-4681-89f2-15864ebe1e4b", "value": "rondo.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d83d10b-e480-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766989961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989961, "uuid": "dc7f291f-2a3d-4aca-bfae-189eda6b53d0", "comment": "Malware payload", "value": "7f478c97d71b76bfcc02f43593203e9f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989961, "uuid": "93d85c2b-60ed-453c-a2c5-b0bbec5bc5d3", "comment": "Malware payload", "value": "cb3b71fefddf07f969d862ffe8bacd3761ec690f47a277ab90dec5f075b2bf72", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989961, "uuid": "f9c7214d-d9e6-4933-9e91-dcf478b1575b", "comment": "Malware payload", "value": "e9d0688acdb0d67db72b0b0902f212eefd65096b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989961, "uuid": "3f42ee1c-d50f-4ae3-ab6a-265363cf9f99", "comment": "Malware payload", "value": "0eab5078ae7f348c24dbe70b38ad236078ea18b1aca6ac02dc3ed1aff78e9f368fabe06d7e01166cf1d42fbce7a337a5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989961, "uuid": "cdb9a7e9-7311-49f8-bc9f-fcf87d0f919b", "value": "T180E1C596BCF32408A41B905DCBBFA25870595057874ACD9CFECC71A8DF0D2A89622FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989961, "uuid": "bc9d7e10-b50b-4cda-99c5-335fcbe048cf", "value": "192:OZfmIE/CTK/ebj0llHYoHsfOBro2Tc/ObKSmy:Om/2kYoHsfO2/kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989961, "uuid": "bd451d92-0196-4bc7-9d6a-0dcc80fe5ef2", "value": 7372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989961, "uuid": "de92a6de-c4df-4ff9-9d0b-2c729230164d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989961, "uuid": "52d8f5eb-c3d4-415e-bc9c-3dfe9aa7282b", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d43060b-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026468, "uuid": "e8023696-a6d3-46b4-8e28-9c9461cd50bb", "comment": "Malware payload (Mirai)", "value": "78d2d8eb9798e3f363b20858048ad759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026468, "uuid": "c6c4306c-b47d-4ef3-831a-014c08168d8b", "comment": "Malware payload (Mirai)", "value": "cbd5b401b81b801c168de2a75bb341e7bf7f8fc45fae092c50816f7e3090d1a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026468, "uuid": "bc983cde-47f5-442d-bbdd-c31d636d765e", "comment": "Malware payload (Mirai)", "value": "e1f511daee66f269bee09b281e29ad5ea5947aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026468, "uuid": "c3a6ecdf-4b60-431e-9026-46093379c20f", "comment": "Malware payload (Mirai)", "value": "9ddf10ecf710ba5fd22a2f901a457ee8ee14eaa98b89601a99b7fc396895d8c5a5e807dfd816849e648d89c2ad849f63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026468, "uuid": "635f1b57-6001-4dda-bd71-a818da9cede5", "value": "T18673026192B252619F51E9BBBC918FF7FEB30B09144339AF65BB7928D82007853D31D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026468, "uuid": "e9a9ba66-8807-49bd-bca1-6f267f62ed42", "value": "1536:QYXeh666gi8Y7q1quo7WvuIcJRsw+/oR0RQLM:QMeht6Wu9NSRRQLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026468, "uuid": "3061b9d4-5762-44db-acc4-7e194e9f21f2", "value": 74180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026468, "uuid": "02451ef3-2c0d-4109-97ab-72e97c2d1c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026468, "uuid": "51afb6a5-a975-4f7f-af23-9dd247dc6640", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bf6e9c-e46e-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1766982484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982484, "uuid": "834bff3c-93c5-4930-a5a0-a4b696f7b383", "comment": "Malware payload (SalatStealer)", "value": "55a60cadd03ca9ad1ee5d3e95d928779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982484, "uuid": "a92ce50d-694b-4b7d-87c3-2a5b3ff776bf", "comment": "Malware payload (SalatStealer)", "value": "cbdc8d58ca1c5f5febb47acff1cddda0a24351d698da123c53d5a230c7f160e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982484, "uuid": "01d170e8-a60c-4036-84cf-b316321acf35", "comment": "Malware payload (SalatStealer)", "value": "c9e1c001de46867ed44a149a6fb2e42493f89801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766982484, "uuid": "71b547cf-bdc8-42e8-ac8e-eeaef9f93601", "comment": "Malware payload (SalatStealer)", "value": "6e0ace7360cb44a268c4d284b5209a72307bfdc84a6ec8c1d7a7d01fdf274bb9623f2d7a5ecfdc39ff4b657e6d70b2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982484, "uuid": "7da1c93b-d733-45b3-af5d-36d1a77e3484", "value": "T1C7C67D40FA8B58F5E9035C72509BA23F23305E048B38CBD7EB447E6AFC7769118B6659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982484, "uuid": "93bc899f-7393-4564-aff9-2660ddb5a8f5", "value": "49152:w6U1QqHmR+Zqzwj88fSd6vUA0sOxq3HymLpiyR4OLNE6eVsW/47mElkZtkCY7fzY:rmQMs6jDY/acPr7ab7bqoXdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766982484, "uuid": "951594a3-3a90-47cf-b981-028a33931906", "value": 12094464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766982484, "uuid": "f0dca0e5-4a15-44a8-b027-f46d69f893a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766982484, "uuid": "020afdf8-d8b4-4593-9b7b-fd06f861416a", "value": "cbdc8d58ca1c5f5febb47acff1cddda0a24351d698da123c53d5a230c7f160e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c4deb6-e4ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767044791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044791, "uuid": "c76a6972-a024-47f8-bcf9-0bcd1a9bfe83", "comment": "Malware payload", "value": "5dbb21cc585edf60b1db4b724cedac50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044791, "uuid": "ca6fa693-d3e2-4704-909c-346d701b6eaf", "comment": "Malware payload", "value": "cc602ccf1bccf62233fc5f6450ea3e3dedfa9d8113cc02488f089df7db92f4d8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044791, "uuid": "8d9b4c9a-6feb-406f-89fb-5f8226ce3038", "comment": "Malware payload", "value": "258a3f6cd2fee08c003e22bcd4aa77bfd5a7842e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767044791, "uuid": "82346571-0a38-4911-a267-0635c438a219", "comment": "Malware payload", "value": "7042c734ddb4e125bad3c4ca06d0b3b7dcf907d30d765ae0b68d1be3c3086adca6736c3b0712ca5ef65fe1ad68454953", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044791, "uuid": "27db4e9a-8770-4099-b3bb-2c7cc4337973", "value": "T1F2A412C2EF815A6FE43C913A99437B3FA61C7D11135A8EFB3384697D69326E12433624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044791, "uuid": "282887c3-4a28-46eb-925a-4661acae6fab", "value": "6c64757899c8d8b11582865a7239611e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044791, "uuid": "fc956393-6171-4b6c-8021-ae70a73efa48", "value": "12288:g2vZepOcQAJEvmGxmNNiIciQEIa/hxqTD:gCZepsAwmGx4NiIq6/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767044791, "uuid": "240bae4a-5c45-4d1b-966d-3ce14a9355a7", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767044791, "uuid": "455dd48f-849d-4f6b-bfa9-654a70846a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767044791, "uuid": "dba7eebb-a6cc-45a0-a985-3c092afcfaff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a564474f-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766995316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995316, "uuid": "19e14184-d320-45bb-9ced-2af57a558862", "comment": "Malware payload", "value": "7ef3f34e886188f82bf76fb54861cc75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995316, "uuid": "9f9a9763-16be-458c-abdb-3064b376fbf2", "comment": "Malware payload", "value": "cc74a2087de31427aa8f8a96ca5f4709b1ad28583b22819f99f284572f3e6d69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995316, "uuid": "978a2a1d-1254-4f6d-a116-553ff93e739b", "comment": "Malware payload", "value": "bae504edad3b74876543f03fdb84f2170e19dcfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995316, "uuid": "1851611f-18bf-4ed7-a792-d96ee971e561", "comment": "Malware payload", "value": "a3c1fa202bfbf13164eb78d20b3352c74d5cc1357870fffc1a4f96ffc83ca31d3f450b8310ab4a219c25151a3fd83307", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995316, "uuid": "4fc36394-cfa4-4b96-b70e-6b02b279357b", "value": "T1CA630B4B5DE1686F932A99360E4D780596C70B74C2C039717930BA69F2BBECD2EB81D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995316, "uuid": "fe223a2d-8b42-4f82-9e3a-67958c0159e7", "value": "1536:I9l/AoSSMAqIYK2wmpTt8rnYjFEM0hlgFnVJMVBzV3mWCEq1bqGBa0aNU7vUCusq:I9l/5MK5IusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995316, "uuid": "71878eba-e10a-4aef-9d3b-46234ef9a293", "value": 68676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995316, "uuid": "fcea697a-4477-466c-ab6c-cd7416a6123d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995316, "uuid": "60c380f3-b4b3-40a1-945e-e40b68224e38", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ad4157-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995458, "uuid": "edfeef6a-5214-4638-accc-d7dc899c2a9d", "comment": "Malware payload (XWorm)", "value": "e2dcef32a4652b97868ba8717a473d58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995458, "uuid": "d72b0362-9024-42a7-b6cd-44157d96d859", "comment": "Malware payload (XWorm)", "value": "cc9100590c9fe32b3759d605646d1c5a6d6aac7e46217991ffd5666003794f39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995458, "uuid": "8221da32-7168-428a-83db-eb317c5cbba0", "comment": "Malware payload (XWorm)", "value": "f013a641841e544284b4bc28cfa122f4ef7fff24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995458, "uuid": "37272d5b-b4da-4021-bcef-4a44f9cb1235", "comment": "Malware payload (XWorm)", "value": "3cd280641ef26d1a9c62ebe560c30f89500c4fc980f96183ec85ef1a43efafd7817f218cdf6018dca507833a4898f18c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995458, "uuid": "b7731e4b-04f3-4261-8d5b-925bc7fccec6", "value": "T141730A0F9A356BE4F9C880EC89E1F9B2F8637A364B9AD7C460B4640FC1ED765E5C5204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995458, "uuid": "3636d278-8594-45ef-b3da-51f9cac57ce6", "value": "768:I8w/h62/jWs6oS+xISN0vwL8/spJneKS0xIFjDqLcfDJN0symuAoYS0Og3Ar3Dwm:I9l/AoSSMjdusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995458, "uuid": "00549343-5a82-4e82-9663-a48eb6a3a0d0", "value": 74425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995458, "uuid": "3ff7b717-a260-4e49-befb-b81182541058", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995458, "uuid": "57aebe0c-e8e5-4402-b5e1-957641f457c0", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bfb75c-e4f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767040067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040067, "uuid": "f7eab09d-1140-408e-9952-2b05ff6a8569", "comment": "Malware payload", "value": "c7dc5b6c2d80001f4e47054f7e8aac86", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040067, "uuid": "0f75e465-7b0c-4b3e-b1a0-f4f351924239", "comment": "Malware payload", "value": "cc93e74a6499f7fec985826fd5eafb142cf3542b99326c00371ac5b5b62e4328", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040067, "uuid": "a659d73d-2859-4f8e-ae5e-dd596122fde5", "comment": "Malware payload", "value": "381faebfa4e8e22afda6c3306f7fc3d965af8ec6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767040067, "uuid": "8d18a839-af00-4c32-bede-73b841af4378", "comment": "Malware payload", "value": "4245deb1b66c90b15b32a202bfcb4e4165a1ea891ff501a9d4f24fac10e38cc520b3e3669738c1fb07e9bdabd5c61d7d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "siberguvenlik", "colour": "#AD780F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040067, "uuid": "2bd0bfa7-8998-44b1-9172-a01bf4c39a78", "value": "T16F572387F784986AE1F643F60471976162CB2C664783CAC32E24323C59F3DD06F599EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040067, "uuid": "2e16b3e2-aa96-4de2-8ab5-e8d4d937708e", "value": "393216:3zRy2Z+I79U7Uf588nAe4kX4uwmPqUQ1FveOmw3gMohpPn2q5p:0m9UIFnAe1oVm5QLH+MQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767040067, "uuid": "33df4975-ce02-40ed-9557-b9802135c33c", "value": 27074797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767040067, "uuid": "084e0a25-abcd-44f4-a237-43a2db2cbffc", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767040067, "uuid": "a09e7999-bf7d-4ce8-a12e-d240c5752794", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b41cb2-e456-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972198, "uuid": "e19f61ae-581a-4c47-87af-2ab258fb3d8a", "comment": "Malware payload (Mirai)", "value": "054784786192b7389e07bde1d2f9b506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972198, "uuid": "0eb48585-2cff-4009-935e-3822965445a5", "comment": "Malware payload (Mirai)", "value": "cc9e75ca151a3a60dbe8d71d9cad4449dbc1c50771a50e8f5cd01a2c40562ff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972198, "uuid": "9bf7d95b-947b-448a-8688-c0e5aa9e82be", "comment": "Malware payload (Mirai)", "value": "b1e4b781293a487a27373f7ce591634e7436f068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972198, "uuid": "755292fb-785b-4f78-bec7-d115e07026a0", "comment": "Malware payload (Mirai)", "value": "bd072ffe779ba6ddff08d0e8066dbc5ae606068cbcb502609dbcbeb3986ba04bc0d39cd3f68905e8ff9c73323e093168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972198, "uuid": "d69506ba-8005-4866-b3bd-6557af0901fc", "value": "T155737DC6E643E4F5ED0A09305173FB334A72E5751039EE83D7A9EA36B856A01E50B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972198, "uuid": "e4bea6fc-43a1-46b9-88fa-3421191e1fda", "value": "1536:uSHwc+vIp1QfPGLRFVaRJl50dLxa/J9ZPKgdAbytAX93Uawxvuf5h7pwFvSz/Rc:uSR0Ip1Q3AFsRnG9xa/J/PO5X93PwRu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972198, "uuid": "842b38d2-e325-45ac-b3d2-410a828327d6", "value": 80000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972198, "uuid": "26db1479-3f93-45d0-bf26-0146a84cff2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972198, "uuid": "fa79534b-b8e4-4ac4-b0d3-339d5bbbae88", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f404a79d-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966672, "uuid": "dba526fc-6db9-47d6-b738-45154f6f83d4", "comment": "Malware payload (Mirai)", "value": "6af11eabc25723144e9f7d8c68a16d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966672, "uuid": "63007c0c-4595-42dc-ae30-44aa9b5e140e", "comment": "Malware payload (Mirai)", "value": "cca83671698e923a292d69b27fde66a054e2e138d7db47219fe6c4f0764b8484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966672, "uuid": "41081984-6ae2-4aa5-8ee3-51197d87c01f", "comment": "Malware payload (Mirai)", "value": "a4eb394b7dba5f0c4829660d58b44e41280ed7ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966672, "uuid": "932298a3-bf64-4cff-904f-5ff74959764c", "comment": "Malware payload (Mirai)", "value": "135dabc5b2907927b456b3e13699c692579503b79260a1322d0a25ec1677f56e1e7e78bb19e6b65ee421ab0347737740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966672, "uuid": "314ba3ca-188b-403c-a9ea-c6e7d25eba36", "value": "T133334C02F686D9F4D85705B0553AB33A8B31DD3A80B5C2AAEF189D36DD27D22531B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966672, "uuid": "05a743cf-75b2-4a5d-b729-7da088be5ff0", "value": "768:fpuBmq3PD3JWRTahi4hoN290C8mCcwF/qao8aY7fL7w5l1C0c7+QctICgB:fpuBmOJWEi/N292ca6Lgd37+vttg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966672, "uuid": "e0da6f91-7698-4016-b912-80204c2ae68d", "value": 54500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966672, "uuid": "34cc51cc-8274-403b-b41c-a021bcd78e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966672, "uuid": "4494ae3c-bf86-4313-9139-3e45234f21db", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2e5e9c-e4da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028612, "uuid": "7b285ab9-0637-450a-ae95-264123487951", "comment": "Malware payload (Mirai)", "value": "4d9c9a8796b46f054bd8c33f70d694fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028612, "uuid": "6761cb67-c95b-49ff-907f-3edc28281847", "comment": "Malware payload (Mirai)", "value": "cd06bdafc520fbc88c50b23d84891c49679c28ede0585dbc533cdcee9a616dab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028612, "uuid": "d672e6af-79f8-473e-a54e-24be20d30cfe", "comment": "Malware payload (Mirai)", "value": "17dcf99d51dc04cd89fe5586e2fe7443be7b3f81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028612, "uuid": "1dc5e2d8-c40e-4824-adae-b0cabc8fb3d5", "comment": "Malware payload (Mirai)", "value": "06a179df10c17dc685973635b8de9c362c1f8bf3ac90c1c7674f41aec5d27199c7a8c3bc1fe9ba217f8f6ab04c51ec6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028612, "uuid": "9dac8db7-d4c0-4e58-8c7d-c84222f24dce", "value": "T1C753025380FE856DCFBF903A023FA1EE6119E535C25582D71EB436768885EA0392DB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028612, "uuid": "be03b5e9-ec34-448f-990c-025e5ec1a83b", "value": "1536:3K/NCAB6P/mahX0SpoDQCfbfnqhVau9eGnouy8GyN:34NCAM2cpyQ8fqjau5outp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028612, "uuid": "1798f3c0-0f12-4cee-a231-4671f9c74ae9", "value": 64596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028612, "uuid": "7faa8a50-dfee-4543-9c9e-3e9e2dabd05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028612, "uuid": "1f86a89f-0a83-4e02-b111-a93b4591de9c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020870d9-e4eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035845, "uuid": "98216c68-a8cc-41eb-a0e4-037fc563a919", "comment": "Malware payload (Mirai)", "value": "ff6f07d0a1947de1cb79049c806ef250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035845, "uuid": "99aaf448-ae3e-4981-a16e-449b25f1e654", "comment": "Malware payload (Mirai)", "value": "cd76ec47568102c823705ef88935024922fbb344a9947de96a83a7a30a65f72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035845, "uuid": "3b0b146e-1fde-4209-9ed9-7e7637fc6354", "comment": "Malware payload (Mirai)", "value": "c800bd2e33ffd5c4dff5bfc8de8b6477f59fe9ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035845, "uuid": "208dd763-c6af-4187-88e7-e6cc1e81f76b", "comment": "Malware payload (Mirai)", "value": "f1793dc94ce97d29cabe127e9fb2c5d2197c78316f97fa32019c8963438afe1af31e60ce6a308e234d20f7b562d180f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035845, "uuid": "25c5e332-0130-49ba-b55f-4b41aa3a6e62", "value": "T126045A02730C0D47D2632EF0263F27E087AFD9A625E4FA45755F9A8A8271D371589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035845, "uuid": "9ba0cb6c-db23-4272-bf2d-3d21dfaf6021", "value": "3072:xrLU8a959Ox4o5g5AyDS4Cf+R6hh12ZjT:xrgzox9g5AyW/faZjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035845, "uuid": "7837c3af-359e-4fc6-b41f-ce659eacf1ee", "value": 187836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035845, "uuid": "005e7281-290f-4fe6-af89-066acef5bf26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035845, "uuid": "097a0157-d602-4c53-a8c8-36b1797a1bdf", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5cd124-e4e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767031886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031886, "uuid": "ba87d104-0f64-4ca0-8034-1e8e90d5a40e", "comment": "Malware payload (Mirai)", "value": "e4c8d96feace9dc79ff6ba5d55b96b4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031886, "uuid": "f6c756a2-0eed-4f07-a24b-4a854879a02b", "comment": "Malware payload (Mirai)", "value": "cdb28a4be3b21a5aeab0ab07aa203af27b6921053768bf4ad9e9799c0d8e7a4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031886, "uuid": "9af06ac5-71a3-4a40-846a-93c1a515b6c8", "comment": "Malware payload (Mirai)", "value": "0c85d2d450901e93a012ed3e3dda555c7104cbc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031886, "uuid": "08729e5b-f1fe-4114-8414-c973f2b2c618", "comment": "Malware payload (Mirai)", "value": "632daa11c15e74f9c62c6bf849de1cafaa1c3ff911963763754b01ca3059bc97e048f15a476583cdadef7c34e2d00e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031886, "uuid": "42fd9866-77dc-4526-b39c-5153bdbbe392", "value": "T109233AC49943D8F0EE1E55706533F7369BF2F4392178E983D3A5AA36B892B01E60718D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031886, "uuid": "58a78f06-4146-42d8-bcfd-e0bb8c748401", "value": "768:rxW6D+gM27jTcnXMx0yIUVZJpWeKpAo98wqn9ra21kd/YdCLu2Dke:rI6D+gx7jTcnX6IU7SeHoTqn5zkdAQut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031886, "uuid": "f1ec1cc7-53d4-4fc5-89c9-5f2a9f196e3d", "value": 45712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031886, "uuid": "b2033f7d-9f03-4053-bc5c-7bb8a87e4191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031886, "uuid": "0baee45c-4806-4295-bb04-3e0cd633adb5", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf2f58b-e495-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766999114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999114, "uuid": "998ba988-98ff-4e0b-b970-224282325903", "comment": "Malware payload", "value": "60f5838e680c04f6508c934b51596b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999114, "uuid": "bc923c0a-0666-424d-b7d9-f70c6978cff2", "comment": "Malware payload", "value": "cdb9ad1ea1b841ee0832dc88c1193370e55651ff805595561b0a9ad9929a1dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999114, "uuid": "f5f72d0c-8d10-4a6e-8da2-30d8a3539562", "comment": "Malware payload", "value": "b9161e507bb84d78d72372bee04a9be292f8646c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766999114, "uuid": "829400b7-3bc6-4902-b811-5cb5f66c8f7e", "comment": "Malware payload", "value": "3b5b4e6cd8d468873ca4c912a84be88c7a5fc974ff813e661312e9adde942fac20ddafd1e46728669e56b5c61aa4eb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999114, "uuid": "97e453de-c247-4eba-8b43-9e5e42977897", "value": "T17007735F464313BDA4A205B60AB6895BBCEBA9D23311ECE34C3A051A03D94F5C6FE5CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999114, "uuid": "3652d4da-0862-44ef-96d9-5f9d40685ce4", "value": "8bed73ecf67b565907f2b961fc4ac2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999114, "uuid": "073365eb-24be-45e6-ae50-3a8625d74112", "value": "49152:TpSeV3w6fEAmrkjSNZI0U8Pfo8OoqEKVZNxWEpBRg67OSQFCg1PBRLXl82LiEq+E:d3F8Pfo8OoqEKVZNxtpSYS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766999114, "uuid": "ef7e9b74-030f-4eb3-b0e6-c11c8da524e9", "value": 17503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766999114, "uuid": "7cabe6c6-2d5d-4c93-a2b7-8798e2360006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766999114, "uuid": "4be79d1a-b99b-462f-8e81-9a96e7d512ab", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9d52ce-e44f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969180, "uuid": "5f93457d-a08b-49c6-869c-2936c2345af8", "comment": "Malware payload (Mirai)", "value": "abcbe1d28ebab7b2a8c0f324ad82afc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969180, "uuid": "a95b59c7-1339-4f95-8ef1-f589a62a3c18", "comment": "Malware payload (Mirai)", "value": "cdd961e1e2f9f042404c40cd4e6b84d5b5e15a25db9452f9680533de4ce61b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969180, "uuid": "8a262fdf-8e47-4f88-b812-ba3b47219d71", "comment": "Malware payload (Mirai)", "value": "aa9d3cdc31d05a01ce392134b15ef880ef67b565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969180, "uuid": "f3c09018-7300-4c7b-af77-488b96cccf97", "comment": "Malware payload (Mirai)", "value": "d0ba739e88d1aa9f0858f9861e6b69c1e45a4c7af9a72799a35cb9b9069bf3bf5888f928805bdc0653c74dc7225893a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969180, "uuid": "460a56f8-96e9-46d5-8681-0489c0cde44f", "value": "T11783AE73D566AD98C15946F4B8B0CEB51763E10082832FFB6999C6B95043EACF60E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969180, "uuid": "55cded89-d6b6-4994-9bfa-ae68408f3565", "value": "1536:saJwt7XiOAUdFl+M+mrtGGZ8uKE87I8nPClD9n3EAuZ7RvK3:s6giRUh9rII8BEunPElUAuZtK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969180, "uuid": "f7ef5a89-7911-4dfd-9b62-075047acf4f7", "value": 83116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969180, "uuid": "e105257a-d516-48cc-870f-ac2f6833a9fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969180, "uuid": "e06d9da0-1805-44c8-8c6f-99b1cb9d0050", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29e060e-e449-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766966670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966670, "uuid": "bf962e45-ca94-4ce9-8811-2ed9f8ad1ba2", "comment": "Malware payload (Mirai)", "value": "3db809c08eaf6e0a6dd7ec6b62f78534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966670, "uuid": "1727f6e1-db2b-41f3-b559-fdb608674f12", "comment": "Malware payload (Mirai)", "value": "ce16cd2561e145b15fa859b0405c7fc89ff70a1972dc2a63489f0e10d9af2f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966670, "uuid": "92d4862d-5134-42f6-9a52-3991eba52368", "comment": "Malware payload (Mirai)", "value": "5984a0bdcc06a309867540c337adf05d338e3b46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766966670, "uuid": "a53c9a5f-9250-421f-bc8d-3ffa5f710235", "comment": "Malware payload (Mirai)", "value": "6d88d2bf84da9726338e0cb221aab511614a1e2044a038c1bda0ad68756cba99a591ad16e7cf6543ce166bc42c73a94e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966670, "uuid": "4558d527-ac92-470e-bc55-fa551ea55a8a", "value": "T16C530282CBD98153F1DE0974A95EE04D0A1D443F3ECDDE63CBD0A1B3809AA2D3B55A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966670, "uuid": "f9ec789d-efca-483e-a0e2-fd9d6db48a5e", "value": "1536:cIfqUf6PbQDwB+bb5GH2r4taEXIo1rhLGKe+O0xZGI6Zqyr26tNtBF5QTSxnouyU:ZfDfebQDwBKkH04xJzzpOSZVo/rDpQTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766966670, "uuid": "b50af54f-d2ea-4d70-bff0-f1bd87765524", "value": 64880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766966670, "uuid": "846d65af-f0a2-429e-b94d-3265e9c05e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766966670, "uuid": "15fb72a7-a89d-4f3b-9785-8f34f200d8fb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f44e1f-e4d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767025976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025976, "uuid": "2caf78a9-1c2b-4cf5-b719-98f0e3a51a75", "comment": "Malware payload (Mirai)", "value": "c025bd216b0a2cd47f474d885730c244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025976, "uuid": "baa4f48e-2903-406d-87f5-b53466364aec", "comment": "Malware payload (Mirai)", "value": "cf90e5d83936f0e27167880f0c3c498f5165a7e62e648c2176525e43247996d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025976, "uuid": "5aff7800-cd2d-482e-9d31-4a3516a9ef3c", "comment": "Malware payload (Mirai)", "value": "683d855d7026587f3b5ac6f6332acd115e239d0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767025976, "uuid": "8b5b9049-bd1a-468c-aefa-64cd9988ab8c", "comment": "Malware payload (Mirai)", "value": "de8ddf0f00e4663ab10ccc655835d6b75a9fa7d70aefaa2533f97cb5cb1be0e4ca3e8e9f2df82e8aa097da5984cb6e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025976, "uuid": "d57aa624-5f2b-4d9d-8ef5-51140b623b83", "value": "T105D36CA82E4E3DE2D3C7E37DCD084E21713B74B4C66152F2791243EED28ADAA95F0951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025976, "uuid": "a883d281-d0ee-4295-ad65-1d5e57955544", "value": "1536:ytMchkQhulYgtUeSrBGmNcmeingtegE21xX3xAk87rNR+Opkx5lceJzVE:y8KBeOE8gtegEWxCVv+S65WeJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767025976, "uuid": "ce67ef93-c227-4d22-82ba-82ee76cd89e6", "value": 132952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767025976, "uuid": "8ef57e73-e99f-4db0-9e26-06b74d6d3fda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767025976, "uuid": "d3c31cf6-9132-404c-99cd-a8e73211f8d3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452ab039-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986565, "uuid": "52b7ee4c-b53a-401f-9818-3826cb6eb48f", "comment": "Malware payload (Mirai)", "value": "3e0d0ea8ec8b9681ef713514e759824f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986565, "uuid": "9e1abdfc-a07b-4051-b96b-2e9eb947377e", "comment": "Malware payload (Mirai)", "value": "cfd22ca9c22fc2d811d19aacdc36c1957673ad9d364cb69c6120418c12ed58d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986565, "uuid": "efb746d3-c7e1-4110-8dfd-35edcc42c2b7", "comment": "Malware payload (Mirai)", "value": "96bfd3526ed649aa138a3b1d7367e18cba57d782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986565, "uuid": "132282a9-7273-4863-b185-ab8c2887162d", "comment": "Malware payload (Mirai)", "value": "fcd642d10cc0fdccb204c93d35494459a48d94c50bdaa3fa01bf252cebc267e126536202c2ce32022a6922255c12a232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986565, "uuid": "6a913227-4c1a-40de-bec9-52dd3333b6a5", "value": "T18E43292175392B27D0E1A47D21FB4B48B2B16ACF26D8C64E7D720E9FFF119406942DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986565, "uuid": "b27ff6ed-444b-41b9-8153-85727002a6fc", "value": "1536:uzHAdtQESpLK+EOMfyslJISSIlcfDUsFlVm542C1m3r:cQtsm+EO2sfDDFT/1m3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986565, "uuid": "0c1ade28-55de-40b3-837e-76804c5d3939", "value": 59280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986565, "uuid": "3f6e47c9-52b1-4da7-a62a-439997c872ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986565, "uuid": "b18da106-7d04-46a3-a963-16b5b08f05f8", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aabe73-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028341, "uuid": "98eb1994-cb1f-4c95-8262-c49ebcaac5cf", "comment": "Malware payload (Mirai)", "value": "df900d0769c0ac9c33bc01d7e175b3e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028341, "uuid": "40e249b9-3fd1-4223-a36c-f61742f2fa7e", "comment": "Malware payload (Mirai)", "value": "d0134731054af3635d249081a26e3bc9bbe8c5644256f8b81f9d4df26fb9d2ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028341, "uuid": "1e88dba1-5ac8-4aa5-bbb5-738d12a71950", "comment": "Malware payload (Mirai)", "value": "60f75ce5b43d8c88a9fc2ab2f0483fc53bf5a85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028341, "uuid": "a89d01af-6bae-4afc-9b8c-16df12fa61fe", "comment": "Malware payload (Mirai)", "value": "897fcae2881e9e4ce199c96b6e614ce42fd2d9b27cb38389c59b796394c515d0a548b1dd4acbab53706447e7fabe42ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028341, "uuid": "5677bcbb-c59a-45ad-9a79-9faada5eca68", "value": "T16C53F11AEAFB400DE5A68214855DF49AFCD0F19EB003B5EA6F8D60174196678AE30FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028341, "uuid": "107bf469-02de-4c6c-8c46-d2d345587908", "value": "1536:J46Kon4VuCMJd6irgGIf9w4X79DrvcdVubK2R3qh6nouy8Hym:JrJqu3d6irgjf9w4LdjUGKWaAoutV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028341, "uuid": "14719870-eee0-4e45-bae3-3168d52818d5", "value": 61980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028341, "uuid": "0427d34f-715a-4714-a590-a3e042b293e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028341, "uuid": "664a71b4-6cd5-49ec-b15f-3dc583ec8336", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72278152-e478-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766986641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986641, "uuid": "39b756b6-3bc8-452c-96b5-1f5d22c235c9", "comment": "Malware payload (Mirai)", "value": "64a972a57ddc3299892438ef2ea65b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986641, "uuid": "8b9c6f21-a370-4c5e-89fa-eb925d31e3b5", "comment": "Malware payload (Mirai)", "value": "d0a16b76aa527c88972354ccece18635a24963be9f26ae0535e0441389b7124a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986641, "uuid": "e23431a8-44d6-439b-96eb-b9db1390d31c", "comment": "Malware payload (Mirai)", "value": "bd2943b007b692762e7a0918554346436c85cbfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766986641, "uuid": "379672c7-1903-4c9b-966a-474ca58c7fb7", "comment": "Malware payload (Mirai)", "value": "316ca408c7d7a6c4213980710b420f1faeb4da306b6bc2686a91476fa774c627d996c5e4147431a23b28f3f2d41ba52f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986641, "uuid": "f3817036-5c4f-40be-9b41-eb7ccc98caad", "value": "T16053F891B8426A39C2D1577BEDAF548E3314A7D8D1DB3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986641, "uuid": "3c4ae309-f332-4442-855f-55682a42679c", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766986641, "uuid": "1aba2d0d-e2f1-459a-a9f7-21584b3c9343", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766986641, "uuid": "eb7651c7-a725-4678-a70d-dbddc8e957fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766986641, "uuid": "5772b3b1-e477-4124-b8dd-a2e654524f52", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a765146-e4b5-11f0-a129-42010a9c0007", "comment": "Malware payload (TrickMo)", "timestamp": 1767012800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012800, "uuid": "ac266577-208e-42d4-bea2-7979f3e1abc6", "comment": "Malware payload (TrickMo)", "value": "70ba1a18381bff82b2300b9e5fbc8ea1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012800, "uuid": "fc34d066-4338-41b1-a08c-a176da20603e", "comment": "Malware payload (TrickMo)", "value": "d0d4ef735a8bf076d81a6f3651d6bcfd8c69285049add2e6b6bee1276a99c37c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012800, "uuid": "c5ffce0c-527f-40f0-83b5-f5d39a0479be", "comment": "Malware payload (TrickMo)", "value": "604563ad3f1cae195dcce4f5a9cb3aa1b8ae053a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767012800, "uuid": "119b5bd1-3a9f-4a86-a978-2ac1e03bd8d4", "comment": "Malware payload (TrickMo)", "value": "9e3135fc5e88f2c155dd14302161a92eae80e3cb50e8f0921cf978a49a7e90b75d3a4efd5cac92e2db21d0569850a7aa", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "TrickMo", "colour": "#F66813", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012800, "uuid": "4662bdf6-5e51-4cd0-bea8-9ffa2ce6940f", "value": "T1BB962243FBA8E99EC4F7C2324AB541755146AD168B43E2476D28736C38BBDE08B46FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012800, "uuid": "8f7828b6-594f-4bd6-a29d-9bff9d1ca946", "value": "196608:44DVbgrGs6kWfMEA36B/uDBzf4KQZ1qXsv:zDVbg+Eo/uDZ4T88v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767012800, "uuid": "582587c3-eda7-4703-88c0-9466007b3835", "value": 8676736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767012800, "uuid": "425f3405-89bf-4897-995d-32fe1b14cb21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767012800, "uuid": "f6625a5e-9122-4f85-a8ad-799738386547", "value": "d0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a740cc1-e4dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029658, "uuid": "617db73d-7177-4781-8d47-5392e6986500", "comment": "Malware payload (Mirai)", "value": "afa4d6513acfe1caa86b468bc41de1f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029658, "uuid": "974c2b9c-fc54-48c9-a955-e52349677253", "comment": "Malware payload (Mirai)", "value": "d0ec4bef4499e6a17051325367959d174650e804e8d3f3c81421f8bc734dff6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029658, "uuid": "9bda152d-01fb-4440-b5fd-fac7318c6b33", "comment": "Malware payload (Mirai)", "value": "24650cc7ae555f7ed714da0810c460cefdfff21d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029658, "uuid": "42e27cd4-64b9-4758-985d-dd618c7cecd4", "comment": "Malware payload (Mirai)", "value": "df44115d16ba7bb7ed38d39f00eacbb66a68b52f2b71f1ce67763170a80b4b661489ee1ee78ba298d2f8499901f6172a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029658, "uuid": "2a6a171f-0af5-4ed0-8ffd-51e1d335fd8b", "value": "T13AD30659F8819F21D4D622BEFA4F529D332357F8E3EA7203DD181B2436C691B0E7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029658, "uuid": "eb131b7b-4013-427a-a562-54e5d6365c6e", "value": "3072:N38DrtOAPHmSebGRQSQ8EXa/MUPKc20oaqapCFTJEMAXfSdi7in531:10rtOAvmSebslQdXCnLBoaqapCFT2Mas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029658, "uuid": "aefae68f-27e1-4190-9f0f-b4a8ac83ae2e", "value": 140780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029658, "uuid": "3aa2103e-485b-493e-82d3-547ec676b579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029658, "uuid": "b7e5db5e-2ba2-47a4-bd16-1380c6734b10", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878a59da-e4bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015453, "uuid": "7bca2f5b-f6d9-475f-b309-d86c7778bd4b", "comment": "Malware payload (Mirai)", "value": "17dce4340df6f52d0bd8f5618b20bd89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015453, "uuid": "0f7c1a6e-b63f-4a3a-b2ad-f3bbc160815c", "comment": "Malware payload (Mirai)", "value": "d142b68534fd9fcf9003da515a7fc2a02afa65d3f058f89cd6793079bfafa6ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015453, "uuid": "a882d557-263d-49c3-ab6b-3abe18b66812", "comment": "Malware payload (Mirai)", "value": "6cd10843e2f331037f7c0dd0e420dafdd979bb2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015453, "uuid": "2494b90b-8027-4ab3-a5f6-cd2b287a45cb", "comment": "Malware payload (Mirai)", "value": "b597f3cc1617dde1d5350af71954b9eedfa1d80a899143c698f264a740b27719755446d11c038591fcdfd485b48d3bf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015453, "uuid": "d6300b08-6760-4e0c-a861-520867544faa", "value": "T1EB73D749BBA14EFBD85FDD3345B94B4925DC824322A83B7A3974D818F24A14F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015453, "uuid": "9478f403-4a65-46cc-ad02-62729762a0ab", "value": "1536:LCTAXxCVt5rU9KY8wGotUotUot6YHgCJzXADsZmyU0FVZwfKLoZT2bVRx:LCkxCZrAGotUotUot6vspEKYT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015453, "uuid": "239b7b48-ea84-44d3-8b2b-41c325bf56fb", "value": 77404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015453, "uuid": "f0ae91b0-5131-4691-b0d9-11dcdf93a490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015453, "uuid": "ecf39f35-b8fc-4f71-bd16-96ab13be211a", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca06adf-e44a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967062, "uuid": "6ac9eb0a-ffae-4489-8e4f-503921bea54d", "comment": "Malware payload (Mirai)", "value": "bc19c9856678e7e6966b0df1d52199da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967062, "uuid": "2c968159-60e9-4ddb-a6e5-971db7a59a40", "comment": "Malware payload (Mirai)", "value": "d173c4fd4f654fe218e9842359ea05041bef462e58a373cce3366c9e77d8b07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967062, "uuid": "bfc8e18e-1241-48ba-8d7a-67b20dae3a5b", "comment": "Malware payload (Mirai)", "value": "0b19c54cc5810bf1471a854feeda45ce9b515975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967062, "uuid": "cdc7880c-c303-4f5f-a7db-085e3ad3c40d", "comment": "Malware payload (Mirai)", "value": "fe20e79d901efe5413e4bd3fe4ac8cc172b671f2ebf7caadc2cf63e2c8cfbf2a2d51bb82eba3e7785f1c348be5a2999f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967062, "uuid": "81223839-34f9-4550-8ce7-156b6e861948", "value": "T1B9933A95B8819613C6D562BBFF5E42CC332613A8D2EE7203DD25AF25378B81B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967062, "uuid": "f78947ce-c32f-4363-a2d4-096891caf33e", "value": "1536:3da96zsrshmMVGqhpysxB1KsSms9FhmCTBuotgFU8vhuZ7RAg:3dc6vGqhpysQsSms9FhmoYhuZWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967062, "uuid": "0a49b391-0c51-4e45-b531-011cfc328de5", "value": 95408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967062, "uuid": "241b5911-9615-4ce9-9eb3-4e3a670f9b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967062, "uuid": "9de142de-1822-490d-8209-92e8df21a4e7", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46430d6c-e4d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027799, "uuid": "f4246732-9b80-4fe4-bcda-c56a847e37d9", "comment": "Malware payload (Mirai)", "value": "3dbe4f703a39a85fc8c7345b88004ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027799, "uuid": "879e62ec-13f3-4c09-861a-4ee3785b3d03", "comment": "Malware payload (Mirai)", "value": "d180d4ed8b8fe3735ecf5dddd8d64f00a9b78aa552d9fdeadf2419a3636f1fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027799, "uuid": "6b96db24-bdd2-485e-ab90-d6738f15acb2", "comment": "Malware payload (Mirai)", "value": "3800a8639aa7bcbf7bc658a2cc6b35fe8a0c5d01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027799, "uuid": "e171d5f1-822f-4160-b5fc-9d08beb03fed", "comment": "Malware payload (Mirai)", "value": "0f2609f03bfe026473f147243803b2a36434ca7b25a49c8bcf537d36739beb6fbb005f6f2eb02f120b7202a520c4838e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027799, "uuid": "e2f2cdc6-a79f-46bb-99f3-58a64f6af5ae", "value": "T12743D509BF608FBBD89FCD3745A94F4534CC861722A83B697974E418F25B14F49E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027799, "uuid": "2997204d-2723-43a6-ba98-60f6e5441475", "value": "1536:26YUrt6xpn5iKb3q6Tu4CTTxPRk6kJJu+7R:26vrt635R+dRwJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027799, "uuid": "190a1545-ba9c-4112-bc67-d24fe1aa383a", "value": 57920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027799, "uuid": "0cd8b094-e6d4-45a3-b3d3-7b82f4b0ab64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027799, "uuid": "fc42183d-efa0-42a0-80a6-fff3ce1d52c2", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae0839d-e46d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766981823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981823, "uuid": "f0f6b617-1d09-483a-9d84-6703eda77058", "comment": "Malware payload (Mirai)", "value": "8cdfab19438aa47bb131e11331562887", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981823, "uuid": "13af4dbf-06a4-4012-b60c-02de3d3e9b6f", "comment": "Malware payload (Mirai)", "value": "d24550d81a60538699aeda2af33f46a0dc84481b9584660d07dbb3c14916d790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981823, "uuid": "2087e941-1456-44e0-a207-ea6b92ebef2d", "comment": "Malware payload (Mirai)", "value": "81ff680bbc1b6575f0431e11681cd47a7176e30f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766981823, "uuid": "d52ea076-0a61-41c1-a2ee-5bab5b5e40b1", "comment": "Malware payload (Mirai)", "value": "4a4ac3ac13da52d84d07f3e8e82be682bba9ac4e58f762a1c3ab11492ce586f1eb23075e277fbecc2932d0807c742cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981823, "uuid": "c7370357-cad0-4f5d-bf4f-a69bf141777b", "value": "T1FFA39E23C8766E54E16489B9F4B0CF7C9B13E61084871FAA95A7C3BA9443ECDF4493B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981823, "uuid": "34bf8133-07e3-4f74-8b36-cd8c9280994e", "value": "1536:8B9kvrJMYuD+71KI+7tkMvqJnwVBuZKQUYp2xw5C0NCi+RofnziOE:g98rJoK1c7uEqhwKgQmxw5RICfnziO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766981823, "uuid": "e90c469c-59dc-4102-bd1b-15b5c3677073", "value": 99760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766981823, "uuid": "45cd747d-049f-4f8a-b6a1-10f078b00120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766981823, "uuid": "62ed195c-ebd6-41ea-a8dc-3f5dc5cace95", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f459ae5-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995118, "uuid": "42643a18-92ee-454a-acb4-4c982da1064e", "comment": "Malware payload (XWorm)", "value": "4f7045b59d2b8cc06ef30afaa0b50ef1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995118, "uuid": "9a595708-5b89-4926-ba01-e5c09d99b1cb", "comment": "Malware payload (XWorm)", "value": "d2e0c451fe10e11608c62a814ca5cb8116b759d1389c7b51096b54c1420e8459", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995118, "uuid": "3daf3271-1e14-4d06-97f6-41c21e5ac2c0", "comment": "Malware payload (XWorm)", "value": "3c5a73c098591c7945e37444e13e83a3b9d3f5f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995118, "uuid": "14d3c855-a209-4376-baea-ade6161f28cc", "comment": "Malware payload (XWorm)", "value": "67d93262f840f09bbcffaeec44b9f659b4c82628c35ffb30f8629c00a4001bfbdc2240fb06f9507ea389b0173c49deb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995118, "uuid": "567df424-1ebe-4a55-bff5-5e0229976662", "value": "T131730A28AB37F0BA55D27BE6CE91510F82FD51167245E4E8ED8AF4117E8FE332121A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995118, "uuid": "6d6bc75a-c628-49ca-bad0-57dc6ff6e6dd", "value": "1536:I9l/AoSSM5OcOrOtO8ObOwOiOCO+OdOxOiOCOAOgOzOfO9OWO9OMOoOFOaOtOoOM:I9l/5MhzusriT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995118, "uuid": "d724fcc6-ba12-46a8-a7c8-a50fa1f03e8c", "value": 73468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995118, "uuid": "9315f3c6-160a-4e16-ae3b-065277ca176c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995118, "uuid": "e9e78b85-4b0c-4ebb-901a-9e7e51e1cce8", "value": "invoice-1645080830.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3e9670-e480-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766989963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989963, "uuid": "8fdbe839-8945-418b-859b-119e32f4c497", "comment": "Malware payload (Mirai)", "value": "c2a98e42fbf8471d6e99c23cb4493781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989963, "uuid": "93b10ddf-96e9-40aa-84ec-aa20824a6725", "comment": "Malware payload (Mirai)", "value": "d2f975f91e7dd0c2a1ebbfe95b2be35c72f59f63917255fcf7df58c97b4897d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989963, "uuid": "d8e4f35e-edb8-40b6-9afd-63827f0ee07a", "comment": "Malware payload (Mirai)", "value": "3ffbc638fe6864f82444dd06cae5c04da13c7b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766989963, "uuid": "48c53af3-f35b-4c1a-aff8-1d0ea61cdc4b", "comment": "Malware payload (Mirai)", "value": "b628930f750438c5ee4a486aa01f46f632b780972c2662a31cf186792a266baa6f309ce3e572720ed6d262dac94eb133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989963, "uuid": "3de3095d-7109-42fd-aed1-ea8a9dc45086", "value": "T13B835BA290581D69F254CF7278A04ABD9733657117423EBE20B6E8D14003DEAF27F76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989963, "uuid": "c3c07bb5-5d37-43c6-911b-11b9f80380c5", "value": "1536:Rdk+MhaRQ4Sufs0cqAbCISTOG7gL6xUcn5yMd0pKCX2oYZICQ8VRBVx:3eQRQ4Sufs0c/uIAkTc5yY0AW9RCQKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766989963, "uuid": "514d261f-4382-446d-ad0c-ea6b3237b030", "value": 83324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766989963, "uuid": "f69b921a-b191-43da-bf6a-8807924c0982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766989963, "uuid": "afd3274c-018f-43ed-9701-3ec38a9f60b7", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263b6f2-e456-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766972199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972199, "uuid": "7ec56ea8-b30d-449f-8ebf-dfbd3667b283", "comment": "Malware payload (Mirai)", "value": "5b10197c2359b07caa0fc513525ae771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972199, "uuid": "f0ebbfcc-5df5-4a6e-8007-3c69a61faf33", "comment": "Malware payload (Mirai)", "value": "d3396ce2855e3c7abe23b8cd006f5d62b3b56b2811a38df59ba50659c8200b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972199, "uuid": "7d4f78e7-3f8c-4670-b1cd-27cf5de6036d", "comment": "Malware payload (Mirai)", "value": "3b743351fb89014b289e87ba5984163e85a8dd40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766972199, "uuid": "d83e31a6-f7d9-491e-85f0-bdf7d59c6afc", "comment": "Malware payload (Mirai)", "value": "97d510f7251f3db09848a2eaad13b230d7bc199b8bcff3ea747f47e406d01156f2ee5f412f1738897961706f554b8de6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972199, "uuid": "6cee1dd8-49ea-4fe2-84f3-696816096499", "value": "T1B8933B85B8819A13C6D5667BFB5E42CC332653A8D3EE3203DD256F15378B81B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972199, "uuid": "5d9a21d7-ea1c-4a39-80eb-a676e2de7369", "value": "1536:Cxu0nz+tOLT2SV2RCWAauCF5DO2mEUs6vjcyDYTcYw9H6cluZ7R7N:CxJnZ2RCWRzqPEUs6vjcrBwRtuZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766972199, "uuid": "603fd5a2-f5e6-4f32-b77b-0cf2a7c93640", "value": 91312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766972199, "uuid": "e8446738-4195-4673-bbb4-9996f9e68a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766972199, "uuid": "eaece7d5-eb8f-496f-8b17-4080a9605e3d", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4e5825-e4d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767026465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026465, "uuid": "a97517af-da95-489a-bbe9-55319ee04bf2", "comment": "Malware payload (Mirai)", "value": "9814490c0f065548986af2521012a780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026465, "uuid": "c94d6474-3677-417e-bc7e-158567eb94d6", "comment": "Malware payload (Mirai)", "value": "d384fb7a8904a4a9cbe9f1bf627eea7dc8a3871958eb53727a31d3d8ee956858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026465, "uuid": "bd896390-dff5-4054-ad28-b6fe7f7b854d", "comment": "Malware payload (Mirai)", "value": "bf3ac8fc89f54f3cb8465d02aef02473febfc11e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767026465, "uuid": "1a2366c9-c888-4332-acca-89f9fff8c0a8", "comment": "Malware payload (Mirai)", "value": "efb8404dfed7aa7f3450673746ae6af27af4c0f7b657348d5eb55783a48d6a2dacd8211d77ca3fd43e3313466fc7d695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026465, "uuid": "56dfb19f-e514-4af9-9641-bae1584c6203", "value": "T1F1635B227A7E6D1BC4C4B47E25F74320B5B2570A36A8CA2E7D731E4DFF14660210BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026465, "uuid": "dc3e25ec-326e-4136-b88c-ae9f5b609733", "value": "1536:K4mSt+p1z2rpSwytO0ZeDw40oRHsIzlgZfIBAKaKUe+chs:v3wCpc/MwnIBUKUe+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767026465, "uuid": "a8f83c9b-b111-4437-a9f5-911dea9ee353", "value": 68504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767026465, "uuid": "2cec22d4-6f5a-4634-a90b-a695935fa2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767026465, "uuid": "57a305d9-d654-4be1-bc9d-8fade3a8764d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c0bae-e48c-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995248, "uuid": "1745a85d-a7cd-4dfb-9530-0646ae653600", "comment": "Malware payload (XWorm)", "value": "730f8115ba9b1b99592cf60ad2bf5d00", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995248, "uuid": "bc444566-a3cf-461f-be2c-105ecad54024", "comment": "Malware payload (XWorm)", "value": "d4815c0469a229cfc4ad90789dcfb7493f4cd4f8ebc9b5aa03b19785bda04a2e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995248, "uuid": "89381bc8-020c-47c6-bf97-2d005d9edb77", "comment": "Malware payload (XWorm)", "value": "a45b8327b7c26f3cf7bc7769ebd1a010b1ea255f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995248, "uuid": "26b21129-3b86-4724-82eb-fe75d3f4ac44", "comment": "Malware payload (XWorm)", "value": "1b6493279e0841d71f24f1f592b8b089fe4eadf4094357c455289937038e13b487b32a8db09c5e6ae4505b193fe62333", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995248, "uuid": "adf82736-d26f-4f63-8c27-898ce53d1c99", "value": "T162635CB492C6D4A341EFF4A1ABC6943194F97A14A5F253C11FD0784EBA407EF7BA04B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995248, "uuid": "31de3a6b-8b4c-4f3b-89cc-f35b320c95fa", "value": "1536:I9l/AoSSMSVf66mJTK816qkdVTjerZoI9GNQwgdCh20YV8JY8WQLPdRGsdRn1jfe:I9l/5MSVf66mJTK816qkdVTjerZoI9Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995248, "uuid": "b1174984-8aaf-4b90-bda5-dd91fbf14bbf", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995248, "uuid": "3c441585-257b-4f96-94e6-3179978e806d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995248, "uuid": "8a52581b-7bd8-4338-85c1-2e911060cd90", "value": "invoice-1645080830.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c222bc04-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031442, "uuid": "e2f98e93-c827-4921-bef4-577f14b1fa5e", "comment": "Malware payload", "value": "32ffa649108ddae75081cfcf16354480", "object_relation": "md5", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031442, "uuid": "0c76eab0-669c-4dd3-9a35-e61260bcfcac", "comment": "Malware payload", "value": "d48f7b4695cabbea723e9a71610174df744491d7a0301f056596a461d43926a3", "object_relation": "sha256", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031442, "uuid": "aa5aae2d-50b9-42fb-91c0-c149d033f9c3", "comment": "Malware payload", "value": "a65f6ff6b3152eec8e17a707322b1bbe541c0ba4", "object_relation": "sha1", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031442, "uuid": "730f33c0-2033-4a55-aa70-68f8e8184155", "comment": "Malware payload", "value": "4270b0bdde333892acd87fc27efec6fb6656fbe51ee16cea9820782cd708389db7c6a60ed5ae755619482b0f8f55e5b3", "object_relation": "sha3-384", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031442, "uuid": "ca4ca66d-6bad-4ddc-ab16-663c745103a7", "value": "T11971304B31E1727487034379427F6199312E856B260E6D18FCFEC2857F29B294FE62DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031442, "uuid": "3e6da144-5f82-4424-bc76-7b4c67b3117a", "value": "96:kUSwgCoWGNmyzrIvfiO0NNakZ8BYiRDLTyhiVP:l/cN250NNazBYi1/yhiVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031442, "uuid": "9733c636-de50-48b4-8c90-b29ac72e4a38", "value": 3797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031442, "uuid": "1f177ee0-6b68-4b48-aada-b149321daf6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031442, "uuid": "f0b22011-954c-4b26-bf95-318c1fa7ac13", "value": "sm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cf4d33-e4bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767015722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015722, "uuid": "909302bd-0789-4cd3-b8e3-a7edd8fd44a9", "comment": "Malware payload (Mirai)", "value": "3b10daecc04e78544f9cf1857d8284c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015722, "uuid": "3593c506-6152-464e-a802-b7d5706d2a11", "comment": "Malware payload (Mirai)", "value": "d4c58097d7477626b733f80ba2a2ebbb6885f9ca872b4b7d3d3824591bc61d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015722, "uuid": "835d81ef-a7e5-4154-bf08-d667d8d86dd4", "comment": "Malware payload (Mirai)", "value": "af9d173f20b0d0c461e740a561324482a259d92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767015722, "uuid": "c5cc0996-e89f-404e-a99b-00d6f7b869f7", "comment": "Malware payload (Mirai)", "value": "59815c129ee7605e04d996fc692009799e898856c56e9d319b198d73a6c596e224b9083654d18349cde33131685c30d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015722, "uuid": "e21eab71-58a4-4c8c-ada6-a7f5121901dc", "value": "T10793E80A6F259F6DF76CC63587B78E31A74833963BE0D645D16CEA004E6034D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015722, "uuid": "38859733-0850-4844-af1a-d9a496013756", "value": "1536:MEF5WSSmdJFbvc0JRLUYXfdMl+gOO57aCcCCicCCCOwmaTw6snB3TAbVR4uIP:fWfmdJFbcYXfdMl+gOO5FzTEB3TAgui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767015722, "uuid": "1fa88a9b-8ca3-49d8-bf20-121ea6ff0639", "value": 94976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767015722, "uuid": "1c742f01-4ec7-4499-a0ed-49748856c837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767015722, "uuid": "ed3b9e78-62cb-409f-9c46-612d7a226359", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dc4e2c-e491-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997470, "uuid": "49bf872f-e81a-44ca-a7e9-41eba6ab8753", "comment": "Malware payload", "value": "c0c330345b5d43525c8d86302708ff32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997470, "uuid": "3537ef82-3fb5-4d0f-853a-e2a4334044bf", "comment": "Malware payload", "value": "d52c8f228648acf0a42f78f887e5cc15bc5f37ac587345b0050ddf44c5e26a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997470, "uuid": "a6113d72-2579-4689-9fa2-a117e1ccfe1f", "comment": "Malware payload", "value": "d3c1e9bbc8a39d2ea9cb67ab297e9a03351f40df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997470, "uuid": "b455fb8d-3806-4c26-a731-58410f49972b", "comment": "Malware payload", "value": "3286bc435c7eec8e62fce5bf06e650309c0b44d169c271d756468af05f5c574673d4ef0933809ec1a69697e90233b3da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997470, "uuid": "51fd3dc2-e23b-402a-8490-848df6d43fdb", "value": "T1E425D087F1C4E912E9424EB03B21F570DEED6CD95C1EC597ABE93E8F38781194A63112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997470, "uuid": "37041161-b891-4103-95c3-ff03e822adf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997470, "uuid": "8238e86b-c706-47ff-9499-aee874a6efa5", "value": "24576:WALWx6bxO1zN0SlsDrN0EzyZiXGngG98:WAyxErjrNzzPi19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997470, "uuid": "291c1b5f-87f0-4fb7-a736-105cad27702f", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997470, "uuid": "b6f3383f-9856-47fb-9242-f02fe582abff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997470, "uuid": "7caf2708-144c-496f-8ee9-967f1d4dd64e", "value": "PO-01176220994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74508e1d-e44d-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1766968176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968176, "uuid": "8e51183c-5cb3-4b19-a5da-fee07942ed64", "comment": "Malware payload (LummaStealer)", "value": "f306d38499a2be7e11c5e535c7245991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968176, "uuid": "6064dac0-c463-4804-84e6-9ef08b252787", "comment": "Malware payload (LummaStealer)", "value": "d5e97280554d307bc8d2b20da13becfdd51057878737754ea725d11bee86e087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968176, "uuid": "fc42eaa9-75b9-46b2-ab3b-4e6655f0e6cb", "comment": "Malware payload (LummaStealer)", "value": "39e432f4c47877f66a9d110480ada0acbd236ef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766968176, "uuid": "9f514477-f199-4693-8173-256084de04f0", "comment": "Malware payload (LummaStealer)", "value": "f6dbae00aa380b36b88f686e314218ee38f01c62d45a1488a8810cfb5f7398e7f42a1f9162dbc55761abf4ddc64bf399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968176, "uuid": "b56caf42-b17b-45ff-8a8a-6c8da4d249d1", "value": "T1ADE30A2776E4A0BAD4B513784AF6829356317CA05F7682BF32C0B7BD1E326C1A531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968176, "uuid": "1a297aa8-5515-4d94-b82d-e91381d5ff8f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968176, "uuid": "cf52a0ff-88c0-490e-9bc7-3d2d87920777", "value": "1536:Mrae78zjORCDGwfdCSog01313Ms5gvhJh5tjEM2kTSZh:UahKyd2n31l5UbTSZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766968176, "uuid": "4ad7539a-c025-440b-a636-bb4464311b6a", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766968176, "uuid": "1fcc3cd3-f2b0-46c4-ac8d-dd5b70ab3e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766968176, "uuid": "9649b477-c7d4-4f5d-be43-64b4b57eec8b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ba709c-e450-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766969554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969554, "uuid": "c2d5d89f-10a2-41dc-8df5-7952fb771fb6", "comment": "Malware payload (Mirai)", "value": "39da42952d3b55420a9bcbd012a6bb8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969554, "uuid": "282706ce-79bb-43c1-8a6a-5897a8f8aa2d", "comment": "Malware payload (Mirai)", "value": "d61316480decf36b7fcd03bc43768026bf08cd64d492535c748f5f094e503b62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969554, "uuid": "c85089de-ffbe-4bd5-847c-61b5e156023d", "comment": "Malware payload (Mirai)", "value": "911040f437b8d904b7b4351f1d87c665dd565723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766969554, "uuid": "f72e2490-5b6b-490a-b01c-ae4d5a8b363c", "comment": "Malware payload (Mirai)", "value": "d04005df4cfa048a4054f094e9668d27817d2c3adc48f65dd3d1c7528e216fcabe522ff336f40a4826854fbebfaa2661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969554, "uuid": "f5b316a3-e0e1-46b1-81c1-14e8b48b86b6", "value": "T145C3F5327A701D1BC8DC533A61FB8721F672376AA0A8C71A7E930E596F3939475073A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969554, "uuid": "3a2bd11c-f82f-4f6d-8ea7-4ccdf9649521", "value": "1536:WLlNrZ6zlCrfyO0tWSOTZ3j+/1QsWv/tIJ1M6D8UrmYd37SHpPEbRjveoxz3IVha:WLlNclWyZj/1QROJ1MCmQmlEFvIVhbZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766969554, "uuid": "5593feed-dced-4463-a3af-0225f3c1c638", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766969554, "uuid": "985db277-50c6-47d6-b0d0-7320fd89445f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766969554, "uuid": "61b731d3-28d3-41d6-9289-d4e50e751067", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208a4dd4-e488-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1766993376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993376, "uuid": "be522c32-b2fb-4924-ac18-c9a389f635b2", "comment": "Malware payload (HijackLoader)", "value": "b73fae607a02a975ba3fb14f2ab61066", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993376, "uuid": "f45c2d20-d729-437c-870b-e2a20e063a4f", "comment": "Malware payload (HijackLoader)", "value": "d6963c17bc9dde332e827a313e697f9fdc6de7af58859b4c364c2fffa5b3f909", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993376, "uuid": "17d6f8df-6a26-4535-84b0-f00e382faebb", "comment": "Malware payload (HijackLoader)", "value": "ef488e7454e78af33fe0da57711e98aa10860c74", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766993376, "uuid": "4c5059c3-6117-4569-a17c-929cb08b2cc7", "comment": "Malware payload (HijackLoader)", "value": "2db1b603c98e3aefb853efdc143853ab090b1e86f5016e9af901fd01d7e682a822b825d46d8355d901ea6ed6c3833e30", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993376, "uuid": "54d305b6-2182-4b42-a293-2062f4edea89", "value": "T13251341224021B688D1AA065A5F2D2C79E4BD5DF3B90B5C53988542C3F09FA50BF7CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993376, "uuid": "75aadc45-3eed-4c6b-9884-f011d12e0f92", "value": "48:AeqE3S2D+7k0xrliGHM48wtcx3D7kpDgIS5pgiCC0eZsTtBFpyCyYXfawPm:Lq76ak4iGNu7ky3gGGZlDyYxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766993376, "uuid": "d315be7d-59b3-4a87-8558-4a3405ba16fb", "value": 2879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766993376, "uuid": "bef26651-e366-4382-bf91-8e5733bb797f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766993376, "uuid": "d861314c-9476-48fe-96f8-cdb641c088f9", "value": "d6963c17bc9dde332e827a313e697f9fdc6de7af58859b4c364c2fffa5b3f909.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc57089c-e47c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766988590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988590, "uuid": "de22989a-6681-4376-8d92-924125f21429", "comment": "Malware payload", "value": "9f816baeb33de7b1b69f3bf6a959c1db", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988590, "uuid": "4202217d-a494-4497-baec-e018c7b94e95", "comment": "Malware payload", "value": "d715c31183a5c242d27389d796d238045763614b983434a519b4fd4faeb15933", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988590, "uuid": "b8694158-b156-4ec8-afe0-81b012f70f03", "comment": "Malware payload", "value": "467d31faedc8f76c3c4fe65aea6dca869577afef", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766988590, "uuid": "67fdff11-e3d6-4f9f-b244-1b51a97fce0c", "comment": "Malware payload", "value": "409971656168ae9b7a60bb2890b137beed448d9621330ed8a213aa5be211973b3657241e739928f6873b29a7865f63cf", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988590, "uuid": "47cc759f-3ebf-47e3-bf53-1d4153db9243", "value": "T169B73331B1239965D51F63BFE86CAF8C40347DA2731B969BB3B87FA509B098251B1D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988590, "uuid": "b7b2f862-0386-445a-b234-2ce1e2c7a0eb", "value": "1572864:GHdVqLL9FqmypV5e4AF95blG8fdGeZSFs2b:AULqmypV+f5g8f0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766988590, "uuid": "88d57788-31da-46ae-a5af-8f5a0bb6a9f9", "value": 52474368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766988590, "uuid": "388ea1b0-6f3b-4512-9ef5-d9205d85c5e9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766988590, "uuid": "ede5da42-9503-45f5-ae2c-07a4203a0ec4", "value": "tsetup -5-0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bee5434-e4ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Braodo)", "timestamp": 1767023433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023433, "uuid": "5e44f348-4b09-47b3-8dc9-5aaa7abfb720", "comment": "Malware payload (Braodo)", "value": "c1f49cddc2676e8089a3cbfe29dfe31d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023433, "uuid": "2fb1328b-faeb-4143-9b3c-c458d956c00a", "comment": "Malware payload (Braodo)", "value": "d7232c7414a6a8be4d8b82a0d7374a789e3602e15dae503c2817a95e35f7d4d1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023433, "uuid": "6bb07b39-4d20-4b6e-a883-0b2857491cd6", "comment": "Malware payload (Braodo)", "value": "741cc7de817ce51f16f32555fc35db2df4118950", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767023433, "uuid": "41891340-99f8-4ce3-b77c-d9ee4562d59f", "comment": "Malware payload (Braodo)", "value": "68da226a360444737aafd5da521a0b83798e6fbc65a74a7dae294f38b09bce0c3e7306b276daa3a73abfa380ad86b13f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023433, "uuid": "6a7c38e9-d4c6-43f5-911b-ccf9e9cc7098", "value": "T148052291178DAF6E512010E8983ECD097A25ADE2123CE75057DCAEF5EBF3E05CC2A1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023433, "uuid": "c61a8b11-f64e-47d3-880f-80883fc297ed", "value": "12288:PuTO0tyZKb5fwdp9CT8ILDyvVRqZ4CD6Q6+zn2EBmkLjNEhGRueo2Cy5L:2TDTwBBKGvui4fznn9FSeFjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767023433, "uuid": "3df3e1f6-e8ba-440c-85da-380a8290d662", "value": 846265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767023433, "uuid": "d0d1f4eb-9ab2-46e6-8bf0-dc92b7492e16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767023433, "uuid": "1c3531fa-0fa5-4f90-8e2c-4dc3dcd38e79", "value": "Dental_XRay_Consultation_Request.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4a07cd-e492-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766997714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997714, "uuid": "8389376d-c3fe-4755-bbae-600b7b6aa172", "comment": "Malware payload", "value": "16fd17d3df385aacc4d48177f50c91bb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997714, "uuid": "ea9b38fe-61cb-485d-91d3-46bb858c1300", "comment": "Malware payload", "value": "d8da910073903545da9b75b115dad2532930c61def44491887b74dff97e74dad", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997714, "uuid": "393315a3-990e-47a0-8773-cca2f0125a80", "comment": "Malware payload", "value": "805ac6b0cdb8b3659777823484263062938eff87", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766997714, "uuid": "cf0ba891-6ec7-4b37-903c-6fc8cdbd59e9", "comment": "Malware payload", "value": "9d0793f7cf4ebebb2d7dd9fc9f75197bbf5ee75eae96f78bd727a52200f99da0be86bb019e529a6c913cd64d2e35d496", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997714, "uuid": "0919a5c7-0584-475a-8b94-3a6de17b06b0", "value": "T10AF00513516DA2CC11D446F311106DAC836D66DB36341D8D73F4CB8C5B8211866EEBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997714, "uuid": "80eae28c-b35b-4fde-9004-910359064c04", "value": "12:s80Qpc5InLgyaIS1PKC26wx0VaV45kJ00qotqZNnaXBXOVZ50H:xLw1PKC26mge4YntFkVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766997714, "uuid": "76d0c0c4-ba90-4051-ae99-dbc75a736561", "value": 507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766997714, "uuid": "85fee09d-9672-428a-bbe9-227e947c14c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766997714, "uuid": "ad3b5cf2-c55c-408a-88c3-9d85e9746321", "value": "pxznk9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e908d749-e4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767031508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031508, "uuid": "0d90e5bc-386a-447a-a56a-f521e5e1e3cb", "comment": "Malware payload", "value": "309bfcf44e680958a776a12c182d8860", "object_relation": "md5", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031508, "uuid": "6ce50d01-606f-4ffa-b967-38340537b47a", "comment": "Malware payload", "value": "d9462701910c9ba71332e4360496ceff0fc64847d4110f797fd58748e4644388", "object_relation": "sha256", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031508, "uuid": "0c87635c-9983-4ecf-b7f7-466c4f49abb9", "comment": "Malware payload", "value": "ffe503d28fc4bccd7131b59061def36bff81cfa3", "object_relation": "sha1", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767031508, "uuid": "d1bbd1bf-ec1f-4daa-bc7a-75e5deebefc7", "comment": "Malware payload", "value": "49d6799243f44676ddc1731933b9513e5b4d0220998690a79ad516ca56a816544a006eea44b13eb5d43d04f63b7302ef", "object_relation": "sha3-384", "Tag": [ { "name": "2bknb-com", "colour": "#304725", "exportable": true, "hide_tag": false }, { "name": "2vbkb-com", "colour": "#5548E8", "exportable": true, "hide_tag": false }, { "name": "Aotera", "colour": "#499F8C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ou5858-com", "colour": "#C27E1B", "exportable": true, "hide_tag": false }, { "name": "vrfdns-com", "colour": "#53E634", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031508, "uuid": "f275f2c0-ab26-4815-b075-7d20683266f0", "value": "T17346AF87B3C46E99C405CD3A6717FE319093AAA38A7690C59F96D70A4EF5B113F38B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031508, "uuid": "2a5bef6a-b765-4486-83ce-11c0b4361ea6", "value": "5046b85e2ab9a59b139a3602e5eee73a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031508, "uuid": "c0446dd1-7b42-4003-9a8c-0b721cdd4b0b", "value": "98304:tDQqpiYgxGCN0zHUeZUXSLjWMSPFWoP7b82dDrEjLJMTPJFO7fpDCvXBa1aYY+j2:RQqpFSNaH5U+oP7IkDrEjLIJ2wvXB5YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767031508, "uuid": "37b482d3-f7c5-4b2b-93e4-54f78ce8c962", "value": 5492736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767031508, "uuid": "e641ca46-389c-4fc8-b112-7d4ceef22456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767031508, "uuid": "5ab10937-50d4-482d-9ce7-d642b569e8a7", "value": "libfzclient-commonui-private-3-69-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5135f0d3-e4dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767029964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029964, "uuid": "83a5d44d-5aec-4eca-97a1-f6bea644d392", "comment": "Malware payload (Mirai)", "value": "65b7b01dd01c9a108a8127d39986b1ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029964, "uuid": "74c3698a-9fa1-4dc7-9554-b1df3e0a344b", "comment": "Malware payload (Mirai)", "value": "d977ebc3a49702a205b7ddd8480da227f79e9107a98435bc268156e2cb47fb93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029964, "uuid": "09656bec-e40c-4610-be45-6c91630df60c", "comment": "Malware payload (Mirai)", "value": "8d3dd2d25d53a517ee41ba4a01f8bbd82797fe24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767029964, "uuid": "806af563-ea16-470a-8276-54ffc36b6e14", "comment": "Malware payload (Mirai)", "value": "846c198532acb3b6b7045122c9f9212d72dd149917312d0a01021646cda116a99e5d99016587b29c8b96a4b6866d193a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029964, "uuid": "ebcc8c2c-1943-4f25-b0e1-fb0867774b9a", "value": "T19234E50AAB620EFBD8AFCD3306E91B4124CD641722A93BB57534D518F14E64F69E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029964, "uuid": "0ba011cb-5d96-4ea1-bb3e-5d2382d0c10c", "value": "3072:HAfk9Q7dc3Bth7GvQV0duGGb2/7gHu+MRxq9TLM8L7XU6hh1p1Ux:gP7dc3bh7CG0duta7gHu+KCT/Lx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767029964, "uuid": "2f27195e-3f7a-4509-afa0-7f5747707708", "value": 249788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767029964, "uuid": "90e42d5d-834a-4a23-b177-d63ee4621aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767029964, "uuid": "a3343913-cad9-476e-87ec-2145f6785bcd", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b11778f-e4d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767027511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027511, "uuid": "6b658c15-1cef-4413-9162-cecde1c6efae", "comment": "Malware payload (Mirai)", "value": "48c50a4d04eaa508b7d670b4cd2ea138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027511, "uuid": "ddb2c8b3-9fda-482f-aa18-94ff461fd9ca", "comment": "Malware payload (Mirai)", "value": "d9813183c8b170bf8efee1485e60592638319e96d7bca414b91a963839ab1381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027511, "uuid": "21d927b1-ffc5-40c0-9347-ac3cfacc0d59", "comment": "Malware payload (Mirai)", "value": "71552606723e3a6de7a4ff3d92c44bcbec21f3ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767027511, "uuid": "ef4f1508-e731-4330-bdf8-619ae759175b", "comment": "Malware payload (Mirai)", "value": "bbfc01144352037a07bfd16e8418b074c4d3d2d0989e859b952943c92bbfe017cc17386e320fb209199eba93cd4e5b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027511, "uuid": "c792d80f-b442-4a77-894b-6a83eed716c7", "value": "T1B3530845BC81DA16CAD862BBFA1E42CC332653E8E1DE7207DD116F157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027511, "uuid": "b81062bf-2d0d-435f-a06f-4e45d371dd36", "value": "1536:8kVN0DwPwKaLGEENuLwZRPSUPmjQVitu+7R:8kVN0Tz0C2+jmitu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767027511, "uuid": "2e4f04f8-0137-4ea5-ace6-408195342731", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767027511, "uuid": "44c6b350-5339-43f1-aaa1-65088c7e8bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767027511, "uuid": "8a5afd20-4b60-4652-9380-e1088708d505", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9376cd81-e44c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766967799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967799, "uuid": "78486a34-7adf-43d4-a4fd-185459ec53e7", "comment": "Malware payload (Mirai)", "value": "3e74b4e2d2f655aa0d214a8458922524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967799, "uuid": "01d37096-4e0a-424c-bdae-e6c1ab8cfab1", "comment": "Malware payload (Mirai)", "value": "d983a262a78c8194afb99fb8040f74a1b2fea6e9b21b78ec69d57e8203925b9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967799, "uuid": "7a8e7a9a-e375-4b97-a571-ab0460ab3456", "comment": "Malware payload (Mirai)", "value": "7ca7a10b8f5ab1a9ae2fc50c7da9d5a4ef6f2f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766967799, "uuid": "2fd9569a-8fd1-4979-9072-ecee37622912", "comment": "Malware payload (Mirai)", "value": "4eef28a4ff6d280e99b5a8f9e3d390e9ccd6176f224a4c55c8004f5359ebca83c3719d3e00dbc96140c8da151fe4a631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967799, "uuid": "932ea41b-7957-4ead-84fe-c20b979f1c27", "value": "T19CC3C5096FA14D7BD44FDC3702A94A0564DC912731A87B7E3B74E50CF68A68F0AE38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967799, "uuid": "3f4ccea0-ac0c-4bec-805c-30ab347fdba6", "value": "1536:TVisANfYRzVAi1KS/eDhk0tcNhYqZClRpZyndElFSkLOKLYo8nF8VR15u:TVi+7P1uQZCzcOoKL18nF65u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766967799, "uuid": "847a3565-44e8-4c21-9e6c-fd231f1cca26", "value": 118788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766967799, "uuid": "8f70f04e-715f-4bf7-b037-bbe2a3a89714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766967799, "uuid": "9ef1e8df-8f2e-484f-b77c-7e62fae56a60", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f6eba6-e4d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767028340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028340, "uuid": "4b2ccad0-2c17-468d-b53c-e98cf2f6dce8", "comment": "Malware payload (Mirai)", "value": "f5b798e37d2538627e02ecf62e8adbb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028340, "uuid": "6b89439f-432b-4f2d-90a1-cbc540e9c5c2", "comment": "Malware payload (Mirai)", "value": "da181e60057e3ac0f1cb07d1a7fad43748767ed1d13d7da4865c0092d4b8653c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028340, "uuid": "94c9b639-9962-41de-b131-6c65fe97a70b", "comment": "Malware payload (Mirai)", "value": "3d6b9a350801c12916f9c414c53e8b3f806b62ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767028340, "uuid": "3c524823-720e-48d0-90fc-4ec061ad96c9", "comment": "Malware payload (Mirai)", "value": "1aa7df359328e97f10d42250db261f907bc951f1acb8f5c47be3204da832362e9150bf27c72f13de3b1c644e1e10278e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028340, "uuid": "9aaa2850-9211-4328-b3cf-806b0555a724", "value": "T10173B406BB214FFBDC5FCD3B49B94B05248C550A21E97B367930E918F64B24F5AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028340, "uuid": "d610b208-ad12-45f6-8deb-18c66473156c", "value": "1536:rNy5DgmJe483AeUlB5hoqeJDKgbgFInvt9IfYuM7R:Jq/e4IAeUFCJ16YuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767028340, "uuid": "101b51b9-e3df-471d-a48f-9a202b6341d7", "value": 77500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767028340, "uuid": "6d64795d-c14a-459c-8198-311f9c62ae4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767028340, "uuid": "7382034c-8768-41af-bb81-80fa92eccae5", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa65105-e4b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767011351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011351, "uuid": "09f3cdd2-2b76-42f4-ba09-83f17142430a", "comment": "Malware payload (Mirai)", "value": "8c3393bde9ed63a55b2d374d92c58c12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011351, "uuid": "29d69919-e535-41b2-96ef-ce2e2e39841e", "comment": "Malware payload (Mirai)", "value": "da4cd629e63c7e95beaf19fd6ca8f56e1705dbea90e3480ee2364a98897d4b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011351, "uuid": "bc282d9c-bbaa-4e1e-9e01-f8ea704b4a7a", "comment": "Malware payload (Mirai)", "value": "4e3514ffe90016488d5cac58dfd83d21d49fcbc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767011351, "uuid": "8f5c3279-21f7-4607-8a29-bd65a55a372d", "comment": "Malware payload (Mirai)", "value": "afd37c8a8094ccb5ed90ef75ca531b2cef050095e377b6f68c31bc42416d8938868754a9be226d18b30e847bac93f19b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011351, "uuid": "89a35c22-dbf3-4bb1-83b6-0d17f67a3d44", "value": "T180D319033981CABFC497D1F44BEB95268D32F83E1935705A77A4BDA61F49DE02E1D260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011351, "uuid": "83b643fd-fdde-435b-8d49-13408df1521c", "value": "1536:+slMlJUZZKwRqjSoa6zzHDfhy+kNT+y+rxez4L+9UcBNOepFI33JSP:+tliFRqj9a0py9N2rxeznUcBN/YnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767011351, "uuid": "4b6a1616-4c7b-4e7a-bde7-3a03f4016d0d", "value": 136264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767011351, "uuid": "a4eda69b-55de-4257-aeed-e77880153e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767011351, "uuid": "d751d59b-94fa-48e5-8029-06bba4c7f1ad", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279f1eb9-e48d-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1766995535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995535, "uuid": "1df5ff11-cf82-4afe-b1e8-83299cce20d3", "comment": "Malware payload (XWorm)", "value": "1280da9c73b2bdbb96127dea5d3d9cf4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995535, "uuid": "740d9041-3f4b-4d00-a9b6-5b465fb0e227", "comment": "Malware payload (XWorm)", "value": "dabb47f3e48b202320b925834d9919b11e85da0605d374880b969a6cfaee1f59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995535, "uuid": "fdc32ccf-b6e6-4454-8669-79d0877da9e9", "comment": "Malware payload (XWorm)", "value": "2aa2f87e7f7a6e6a43dd89fbd78a774637044f89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766995535, "uuid": "82219d82-8c35-467f-b1ab-3f39dd073a6b", "comment": "Malware payload (XWorm)", "value": "e8e0f372e78d466db486e90160e0dcb45f939f628fb52afc483f48272e56150531b4101c1f6e3ee9069b517dae32f03c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995535, "uuid": "657077de-9d41-4117-8515-585f3f920757", "value": "T126631A4B659D99FD0A56F3F10E0C01DF1AA4239D323A98F8D363A6263D233C125759AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995535, "uuid": "13b807f4-f9c0-4f33-a731-9ea2de9e86f1", "value": "768:I8w/h62/jWs6oS+xISN0vr9Xonbsm4dkfScBYrwz2y8kTAlGB:I9l/AoSSMZzusrdkTS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766995535, "uuid": "a3c78e17-ed4a-4bc7-8b5a-60441a1e35e0", "value": 68725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766995535, "uuid": "f256aec9-c6e6-4e9d-95c9-2539bda77ae6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766995535, "uuid": "4cfcca4b-9c62-403b-998b-9dbd9daaa20e", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9e14bb-e4ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767035785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035785, "uuid": "37f3836c-15c4-4bf6-baf2-f442ba1de78c", "comment": "Malware payload (Mirai)", "value": "f699a5c553fe03aaa938aeff9c997059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035785, "uuid": "259a5dfd-d811-4af6-8427-b7df4fa1c0f3", "comment": "Malware payload (Mirai)", "value": "dac9074084017cdc1bc24ec20b12b34d5071e76bfac2958da00d46ade34397c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035785, "uuid": "8bb35835-e141-42ed-bff4-3fbe23da6de0", "comment": "Malware payload (Mirai)", "value": "317ccd2908c0ca9127bf7c812aa79354953ef54b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767035785, "uuid": "2b409a4c-4614-4e1f-964f-1d0a398d3b85", "comment": "Malware payload (Mirai)", "value": "3a5916998f219b85684023f65bd2a35e95fd2f61997e094c00df06afa6e95c173d1883ffddd71580831a2c19a3909da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035785, "uuid": "4e1af3af-5d71-4c53-be36-0b13455c9d91", "value": "T1E453029AA89203CCD810807508E77B4A9C1EEE74E59745E17E945FE92D31F25630FEB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035785, "uuid": "9ca86fb2-d4b4-4786-9f3a-e01a0d19d484", "value": "1536:4DIFfI9ATbCXReSd5C/LtBabRdl846uhz+uV5nouy8Hy6:4YeATbCX4CC/Hqdu46uhxnoutB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767035785, "uuid": "b3ea47ec-8015-468d-a0a5-bfd39fccbf03", "value": 64624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767035785, "uuid": "84ddcc7d-b95b-45f8-9379-c2102696b3be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767035785, "uuid": "6d63a2cd-a299-4603-97df-aea443849ab1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bda5cc-e459-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766973248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973248, "uuid": "7fb54013-7a4a-4179-875c-83ad0820922f", "comment": "Malware payload (Mirai)", "value": "6b1d0e0d8673b75c1db8f224a60bce78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973248, "uuid": "3673d628-a48e-4751-b4df-e1eca5b88758", "comment": "Malware payload (Mirai)", "value": "dbe28a7c702f245e81f496bf81d1b0df41db8f9cb6d7b9b96dd1834b7b0479f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973248, "uuid": "7d3bbc2c-187e-4320-8d5d-cefe9be124c4", "comment": "Malware payload (Mirai)", "value": "b333cc23fc38af16bde4100db5605e5f0b518ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766973248, "uuid": "877cb6da-c66f-4820-8dbc-28d5540fcb19", "comment": "Malware payload (Mirai)", "value": "a788c3c03a33725052974f0469f27006b3f1edc3c8a92f849106add024a3b15738594687f7eae3facf14ed1710638bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#