{ "Event": { "published": true, "date": "2026-07-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-17", "timestamp": 1784332982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e0c625bc-297c-4444-844a-0b8c8655e469", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9c500f-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312372, "uuid": "72568e95-ed5a-43ae-a449-99dedf107d9a", "comment": "Malware payload (Mirai)", "value": "4909ad56a3631e8436517aac767c3e38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312372, "uuid": "447894a0-399e-4084-b113-949407883d43", "comment": "Malware payload (Mirai)", "value": "000424ce3dbad15ea2801a478db41a2dd4a18465336d7286e7b114cb29f3c120", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312372, "uuid": "69178674-8c85-4d7e-b490-b51e886fa9f4", "comment": "Malware payload (Mirai)", "value": "000414b1cebfd7763d10edf1b493f2f1b865112b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312372, "uuid": "fe0844bd-dc25-42cc-b4e6-7dba59ddc96a", "comment": "Malware payload (Mirai)", "value": "f1ad6a2478e02a14d70d6f35cc8a98ad17a28c771063934c61160eb2d3a15df50d33c949afa1c25e8f8e5106032217f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312372, "uuid": "0eb4621d-4d0b-40c1-aba0-e587d607b5ca", "value": "T10AB30946A9429F12D5C631FAFBAE414933136FB8E3FA7101D9205F6423C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312372, "uuid": "7c017344-271a-4ed5-80cf-1bebbf764b19", "value": "3072:Os+WRqVNgOtnPfGK6EeS9zci2waSl7xVHhNpr7fL0/0kamMq+f:Os+pX1PeK6EeSdc/waSl7xVbpr7C0WdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312372, "uuid": "9d186392-06d1-4ca1-af96-971ab1f21684", "value": 112680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312372, "uuid": "3fe2276e-6a89-4773-aabf-457035e5053e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312372, "uuid": "1b7714b9-cfaa-4672-b469-7069d11c05d6", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba8f2ba-8219-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784317950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317950, "uuid": "dd86cd93-839a-40bd-b223-fa7b8a121b1e", "comment": "Malware payload", "value": "eceb54126e3add5e2f843fd61854cd0d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317950, "uuid": "44efb130-635b-4c66-9676-4547ae1ab9ef", "comment": "Malware payload", "value": "001b403b3ea621d471674805ebb6a5782d6506652e0477f6bc1d6b5c62c53372", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317950, "uuid": "f2915725-9a53-4241-ac91-44a69b0c0ba1", "comment": "Malware payload", "value": "afb8155797a876ab8e9aef1dcefb15dbe5477e1b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317950, "uuid": "c2e1e77d-d6e7-4950-9c08-bb0151e879d3", "comment": "Malware payload", "value": "c4f6976f29532d1e114105a340ec4fd06bad23abb60cd951deb8567e1102b6e250ba42f5df94babcb04a37accf3551d5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317950, "uuid": "ff023619-985f-40b1-85ae-df6a8aa52071", "value": "T1CCE6334825C121FEDAB3003CADA29690E8E274760B72C9E757B8C7726F5B6E15D3E107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317950, "uuid": "693b260a-779b-4376-8e76-2b0d83e179ec", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317950, "uuid": "68782639-ae6f-4ac8-9d20-c1e85107846f", "value": "393216:8Sh5EW6QPc0hiHLrIkGwQ2tAb7RKrXMCHWUjX9cuI3/PGTAI:vT3PNiHLsN+Abt2XMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317950, "uuid": "11c9d39b-0b8b-48f8-b644-e5a85391b33c", "value": 14255956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317950, "uuid": "11ed0bf9-7855-4f11-bc60-638ffd1a6fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317950, "uuid": "1d3e8951-68c1-4bd3-bd28-e7990cbcffd9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc7ab02-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784311676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311676, "uuid": "3712ae9b-ab82-408f-a8a6-77cfeb04dee5", "comment": "Malware payload", "value": "141b70024fd6cb2b6fec4c0d2d37622b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311676, "uuid": "c530314f-19d2-4729-b9a4-939dd3a6876a", "comment": "Malware payload", "value": "002285d2ef0ec7e6ede744fe739022507ac89da3feffd2a231ac0c31eb5204b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311676, "uuid": "63be9ca8-ad5e-444e-84d5-899d6d45cc49", "comment": "Malware payload", "value": "27a6b15ce77efe3ceec91793ac3d9ab8c544b46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311676, "uuid": "fbcba173-aed3-4d48-ae5b-d42cd047091c", "comment": "Malware payload", "value": "bf87c256d1fe3831132a6598a8e89a2c157dd2833e44aec08317021a8f732d3bf288fdd232357a49edee1366fca29561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "Stage2", "colour": "#B66196", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311676, "uuid": "bec6e5f3-91cb-42ba-a715-5827570ca2f2", "value": "T183A33803A2D481FDD58AC378C78B5936E7E2B4CA0936F39E1BD40D607A63B645F2A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311676, "uuid": "0af274d9-5bfb-4612-ad9e-bbfe52a78fd9", "value": "ff3a6433f70fee894efb5cbb88e2d101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311676, "uuid": "d52d5a0e-d5f9-45c8-bcf9-01895b8ec7ce", "value": "1536:PM7vtr/Uq+QtYX0LnWH3+4Xl7ObogVEPQYl2T0mj33:UTtr/H+QtYX0Wu4X1KCPQYnmj33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311676, "uuid": "9375a554-2ab8-44fa-a425-0e9a18132bb1", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311676, "uuid": "a08595ab-8817-4eb3-93bc-00f27c77587a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311676, "uuid": "b62aeecd-bd2e-4a5b-a0c2-6a2679025ee1", "value": "upd3c8ff0e8e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0056d15-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "f88e1675-c11c-4934-9363-792766af7c9c", "comment": "Malware payload (Mirai)", "value": "d227d8ba6a0f2fae671e15aed5d00053", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "fa67fab7-6ab1-40ae-b18f-7eeb14152ee4", "comment": "Malware payload (Mirai)", "value": "0117a84401e692d9024c8b11a385f4c156808e0788edf80c87ed58c92555889d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "79e25ea5-13ab-4666-8c04-b4c2b531ba84", "comment": "Malware payload (Mirai)", "value": "cdb55d2ef8a6722731a8ebcfe10066d5ff0bb9d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "18a46a6d-6875-45cb-aced-26beada59824", "comment": "Malware payload (Mirai)", "value": "12d7dc918400d4e90d39142288aa11f6657fb67390199ac43b58bf24a4633e66fd40bfe991af1a745e1933d96ed58b91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "94d11764-e811-48b2-98b9-6efff4d7b488", "value": "T15CF33AC7F800CEFDF84BE77A48530909B530B7A250921B3762577D6BEC3A199056BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "17d3067a-44f0-48e7-960d-a63d2d9ab992", "value": "3072:ypd9BNTb/Ke7HpIiCN+08fl/ggQV4jbiGLqAsLy9fWGOF:SZjIiC00wtggXLky9+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311381, "uuid": "cb5fd963-b178-4fed-941a-e8007ce195c6", "value": 164684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311381, "uuid": "c0a65454-b832-4fd7-acff-44da8560ec1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "5c2d1323-978e-49dd-badb-9166acd78bea", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c14670-821c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784319628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319628, "uuid": "70767f97-1189-49f9-8f79-1a61419c213f", "comment": "Malware payload", "value": "ee0c1b903f83c1d27486986653a289e8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319628, "uuid": "93a2936f-a82c-4e0b-bf71-92caf6241ca8", "comment": "Malware payload", "value": "012207c24a7bd9b6f7776bbd383297d2edd881cbf4855db2a64ec48e0070f525", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319628, "uuid": "edcccd10-8c08-4c21-813c-3e093ffd990c", "comment": "Malware payload", "value": "571129a6d021f1fb5b8016dea6020a5dd7449712", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319628, "uuid": "8fff27ec-5b9d-4fbc-95a4-513d97af18c1", "comment": "Malware payload", "value": "4f1595ab2aea3fd876b802ecb9ecafc52bcea9a505308af96f159a03cea0bcd746551ab8b22ebe3ffa4b326e8c36b9aa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319628, "uuid": "b24d8e40-0189-49df-bfa4-fe120c808875", "value": "T11DA633EE78CE6BB1C04BC370948B9E2E7D053FD0B9664D0279D939306E70A5A72B5349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319628, "uuid": "08a5d24c-369b-446a-93be-b9b352094e15", "value": "196608:Cutu9jqVKqJDB+rSVs8JQ8U/lTa7SD4w521Z5K4F2oXhDRYBk:wdiXQrYs8ptB1Z5BgcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784319628, "uuid": "fc2cd5d7-833c-40f6-8149-f843a0cfd45f", "value": 9965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784319628, "uuid": "a59336d2-272a-4ad6-98e9-f2b17ab31e22", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319628, "uuid": "14cbd995-8f18-4202-baab-9cfd026700b8", "value": "appinstall.88tt000.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e431982-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311727, "uuid": "1577b3ce-aa0f-4cb8-a0ef-21c009f27235", "comment": "Malware payload (Mirai)", "value": "6eda860916fb414ff02d0ff2c29f5889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311727, "uuid": "7b91133f-081f-411f-a7b2-64db4a64e144", "comment": "Malware payload (Mirai)", "value": "01685a6202631b02d320dbdeb7cf7933d7a5f29f21e37617937ade34980033be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311727, "uuid": "1fd43640-6a45-47fd-8b40-5151efb47f47", "comment": "Malware payload (Mirai)", "value": "005da9ac5a1163cd4c60435863411189737d1b51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311727, "uuid": "702b9ad4-fd29-4ace-9987-c43ba166cac2", "comment": "Malware payload (Mirai)", "value": "ee588026abae0d5a41532c9eb097c082a66005015bf86f3f19de6f6b05fdd79ca5e9c446c7428622404495bd8c98b468", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311727, "uuid": "b860ef3d-cd7e-458e-a8e6-136cc240a612", "value": "T165043C4AAE756BFBD06FCE30152E830715DD644FA2F6A73DA278CC4C399A20859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311727, "uuid": "43c5b049-e255-4510-aa2a-b381cd5e1493", "value": "3072:khm5j7Zq2UZdkPXCRc7SGXpLAqbXfFArwlasuAi1DR:WKj1qDZdkPXYc7SGZLzfFArwlaaYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311727, "uuid": "68ea88c0-410a-488e-86ca-2319d3d108d0", "value": 183196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311727, "uuid": "4a47d497-523f-4ef0-9331-1bf8c7698dad", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311727, "uuid": "c93f228c-8e7a-4625-8a20-69adb37d58ed", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fed130-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325168, "uuid": "44ae4cc6-1706-4c8c-9a87-b8cb6e59f35b", "comment": "Malware payload (Mirai)", "value": "cd4d6a959a795ed8b87d17430f5e63b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325168, "uuid": "c001f1e3-659b-4cba-ae5a-d2085b8d571e", "comment": "Malware payload (Mirai)", "value": "0259340035368c13d77f618b4a40586456dd8fff255a39cd2eae2b548e373ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325168, "uuid": "634bfbb1-1708-4cd6-b8e4-9d55d9637fe3", "comment": "Malware payload (Mirai)", "value": "e9f91f99a40478455bc2915362bf0c059244e0e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325168, "uuid": "b3722afc-e9b5-4544-9853-053d511d50ee", "comment": "Malware payload (Mirai)", "value": "3a02b6f46885e9132e159576fe74971cb45178263344398aa39c815aacd29b1dfc93f7ca9a29d9475643be22015e6baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325168, "uuid": "b748ac2f-ee06-45cd-888b-d8d6d551a4af", "value": "T14D536BC4AA47D8F6FD5601705177EB378632F53A1128EA87C7A9ED32BC52900EA2735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325168, "uuid": "9cd56e38-e865-4ee2-a337-00c1eb001694", "value": "1536:mwxYLBG2V8aKvyq9zJGYJqq2sQYjgSmeA7qX8eCFiTGEU18F2WarYXxE:mwxK02V8aKJuQ28mRs8x8Trc8fE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325168, "uuid": "4e62ad52-52e7-45b6-99cd-0547a3b917e2", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325168, "uuid": "ad17733b-904f-4ca9-b921-d7cad6b181a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325168, "uuid": "436ef1c0-22ef-4f8a-bfe2-db5718fa589a", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddcdb1b-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272347, "uuid": "5ffc039d-c133-4fb5-a3fe-2a6a064c357c", "comment": "Malware payload (Mirai)", "value": "bc60c98dad8146e300d0eee945981252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272347, "uuid": "091b94b0-2bbc-4a4c-925f-0a0247de7b46", "comment": "Malware payload (Mirai)", "value": "02d0010e21052983e4042ef43e4919c04b76aba14e97428630246934e87f0bd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272347, "uuid": "3510f423-7852-43ea-a0b6-39cc1fd9920d", "comment": "Malware payload (Mirai)", "value": "903b6ab3978a3416494db4ae4dc169c3a0ebc4de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272347, "uuid": "09f823b6-b85b-4028-b8d0-b7b73216b7fb", "comment": "Malware payload (Mirai)", "value": "d8ae0b09b0f368e3e8e4aa3dee6d5a157fe6f953e8ea9c6d28b59b08c4e5fba9f2e405e5e949f260d223f5f279f4d86b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272347, "uuid": "7127b658-fb1e-4941-9d47-e83c6fd4b393", "value": "T11E937CC1E643E4F0E9620670003BB7528E76F97655F8DB86DBA53D33AC23A119A0B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272347, "uuid": "45c723af-3fc8-4c09-89d7-088c902f2c42", "value": "1536:272r2VMdfteNCQGIl+kgElalEBGabnFJy6dy+M+6oZxmrfh6B:g26WsNCQzn7BG4yerMHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272347, "uuid": "b775d8ec-aed3-478e-839f-fbeb995791aa", "value": 91280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272347, "uuid": "c82e1a8a-6ef0-4916-98b2-1f211cf8adc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272347, "uuid": "87c4b8d8-615b-46e4-a4ed-411e19b1072c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e1b712-81d9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1784290537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290537, "uuid": "1d7f4c8d-7454-4c6c-9db7-3c2c5cffbbf8", "comment": "Malware payload (Socks5Systemz)", "value": "fb52fc8f7d15f42196cae4fb09702471", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290537, "uuid": "d5179073-004c-4dde-8053-b45222dc90c3", "comment": "Malware payload (Socks5Systemz)", "value": "03658cb74f160a7434b136c0f773bbc21be049d004d5676a1aa940e3c71b45c1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290537, "uuid": "87a99933-5711-43ec-9ed0-372db79dbbea", "comment": "Malware payload (Socks5Systemz)", "value": "18992a9373c41a2422ef7a00751f39ce2f07956d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290537, "uuid": "eaef3725-6ba1-465e-81c9-1f4965f9f24d", "comment": "Malware payload (Socks5Systemz)", "value": "c1dc9e8e3f9a5ac45dcbc0c56094b6e8b6fdcb765ecdfbbceb42d547eb09e47c14c9303ca0fc56d7d1032b13f7472a94", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290537, "uuid": "47274919-94ea-40f7-a43a-c4c4c0daf87a", "value": "T1F8083331B2636994D61FA3BFE424AFC94534BDD1731B95AB637CBFB249B068210B1843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290537, "uuid": "bdcfefec-3441-468a-882f-6594535335f3", "value": "1572864:C1MKvOnTIeYX4zmt6q+9eFVvpsKzMplvWwSiaIpfQAFM3SrjmkVd85mt5:UvOnseYoztqDVqKYOwOIeAFM3SX5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290537, "uuid": "b0b5a93d-27e5-4e51-89a7-c970f9412d2e", "value": 77143040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290537, "uuid": "97b11f42-229a-46a7-92ab-2d6b7fe2b2da", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290537, "uuid": "18d4be96-3bc3-4b11-93f5-da5ee9141acb", "value": "golegoo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a02aa8-8208-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784310749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310749, "uuid": "e2947122-dbcb-46a5-b0f9-81e1308690d2", "comment": "Malware payload", "value": "e14df27a8af844cdcc0490f3916ed1c8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310749, "uuid": "34558f19-9571-412d-828a-b0df1ce22cd4", "comment": "Malware payload", "value": "044af84bca3f2aab65659a940f204b80d6adf877ed69a21cb8f00ae20dd2bfe9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310749, "uuid": "0ec51f5f-89cb-49a5-88ed-20fac5611540", "comment": "Malware payload", "value": "4bd8c3be8991290965234d7705cd8796de9cd010", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310749, "uuid": "35fd1155-5ab4-4d84-a159-33b6caac2730", "comment": "Malware payload", "value": "51fd6eb7f985f42118905b9463237b8829a26daf414a344cb4442eb66f81cfb146999d536174b346c398a67828069aa9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310749, "uuid": "5bc34aa0-f099-44eb-90e6-faf40c6e373a", "value": "T153E633546AE002AFF573903DDF9247C5E578742A0B32CD8B077D8A952E5B0A09C3EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310749, "uuid": "13c4c388-f8f3-4c47-9282-6fc3cb5c1fd2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310749, "uuid": "a3e97471-241e-4d16-9ccc-08c4cd6f43d9", "value": "393216:rr2cKe99Orz4hZVb2RP88WGc+XMCHWUjXDcuI3/PGTAI:rr2cbfO0Vbi08c+XMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310749, "uuid": "4c7efee3-919e-4894-b0e8-5da7f73e27ca", "value": 14324001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310749, "uuid": "d3ef3367-d029-4ab0-b48a-7f6e5134acbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310749, "uuid": "bee1e006-4336-456d-b8b5-7c3f600fe18c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080222c1-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271988, "uuid": "f249b3a0-43c1-4107-8704-492e2e355b25", "comment": "Malware payload (Mirai)", "value": "946b76ba81a7aacee231f7aedc5f8a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271988, "uuid": "6097932c-fc1a-4d41-8d8f-8a4076a1f5bb", "comment": "Malware payload (Mirai)", "value": "0575680bcf95f0554363273207c0a442370508868405a1ca78a589b12bc13810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271988, "uuid": "5f86452e-2359-473c-a10e-d0499c317caf", "comment": "Malware payload (Mirai)", "value": "734c3cfa44727d1c799f1403578e9eeca4831e44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271988, "uuid": "8ea2ff4d-c062-4adf-aba2-b01218d3f827", "comment": "Malware payload (Mirai)", "value": "c6ccba794113f1726835c3de64adb5322eace9572d836777c8136297363ec917fda789ebfdaa9d8f1d9413ad01407ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271988, "uuid": "da46adf9-532d-47cf-a3ba-bcd41886495a", "value": "T17D832A97F400EDBDF80AD77B4453090AB271A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271988, "uuid": "e2c1afd9-4134-40ae-8258-ffeaa2975bfe", "value": "1536:quKG91E4xgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTnxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271988, "uuid": "62f4c867-15ac-43fd-98b3-2f9fc336fa61", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271988, "uuid": "7a9d8bec-8ed6-4044-bac5-5d6a06e4d20a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271988, "uuid": "08c1214d-23a2-41eb-b81d-4e712250d898", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c11f2c4-81b3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784274276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274276, "uuid": "90e0e641-51e3-469f-80d5-c05e76ead725", "comment": "Malware payload (Mirai)", "value": "ca931d10d2dbebbb32bdfa20ca8cbeea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274276, "uuid": "bff593b8-b5e1-421c-b7d7-37c59528065c", "comment": "Malware payload (Mirai)", "value": "063c06d1a6fe9bf8f5ec4cbb45aff53f3fd1bfcfd29ab13891225f7962783a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274276, "uuid": "bd483f66-cb34-47ca-aa39-0b5d5cf95199", "comment": "Malware payload (Mirai)", "value": "c1191a9d94bf03b9a86c02175bc39ff988f8fd99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274276, "uuid": "7615e32a-68e3-4536-9ac0-442941270959", "comment": "Malware payload (Mirai)", "value": "31eab21458193691fe2ad5a3ac675a9729ce4a49b46f31c5eaee160641ced88999d971ec1762c9c578ffdb312068f499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274276, "uuid": "70dc2db4-12be-42ef-907d-cbc61c7210d1", "value": "T1B2D32A46A9425E12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274276, "uuid": "76e105a2-c405-48f7-b8ea-271b7505dd41", "value": "3072:7+P2y1xiqVpO4nnHfGxKaE935sBka9YC8E8wVkcsfn610SGj+HC:fy1hznHexKaEp5Gka9YC8Efkcsa0HSHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274276, "uuid": "a8132664-214c-44a2-a291-02719707cea4", "value": 135532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274276, "uuid": "10d59865-76ed-4c51-b5a2-fb14b63420ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274276, "uuid": "df7e77c9-8111-48cf-8689-5de845f7ff9c", "value": "nerv.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b54e23-81d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784288521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288521, "uuid": "f4fe5ff3-a553-42a5-9889-34a24a9a924b", "comment": "Malware payload", "value": "fa2e8eff722d179d181d1301e9f94320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288521, "uuid": "9557b55c-0ffb-4681-82c4-649cbda40903", "comment": "Malware payload", "value": "0693fdeac01da536645684bf7c29271fb3422e7b471e458b0017461b1679d96b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288521, "uuid": "8d95321a-2ec7-406d-afa6-941917039c18", "comment": "Malware payload", "value": "5f109fa1321ea1fa5764251550c7c7cdb796c2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288521, "uuid": "2696b861-c3a2-4711-a2c8-4ef2079a2bf4", "comment": "Malware payload", "value": "6918b54c0c1ca0b261f5423667253a228de41529c560e0ff98359fa4e4b2016b3d53b36dcd5cf9eac09787a4c1b978f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288521, "uuid": "cf27335e-37e8-4abe-a25e-2372b2ab4e71", "value": "T13F74F178E69C9520CCBF96F73314613E9C78B167E6618919CCBCF7B173228F08609A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288521, "uuid": "a56e5cd3-480c-4451-813d-f7bc1c230407", "value": "1536:CPkjsnj2MmbaTHguTSTPiKPtqJCvxHceYuJVH4M5QdKAM/SBZlQtsVyTnPyamNKF:CMejKAT8nYciKA3Q6AyauKRUk6Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288521, "uuid": "2bfdfc5f-e04d-4ca5-a5b5-7818a61beca2", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288521, "uuid": "3e94e2ca-1a5a-40ee-a861-95336851299b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288521, "uuid": "667b26ab-4a40-44c0-8016-7ce470ff99e8", "value": "0693fdeac01da536645684bf7c29271fb3422e7b471e458b0017461b1679d96b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5abcb0-820e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784313309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313309, "uuid": "d6056a2e-e870-4a93-9ac7-bcf2914ab6a0", "comment": "Malware payload (Vidar)", "value": "0a9a59c9e53e6d9f218fc6c307016b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313309, "uuid": "8574d4dc-fdca-4f9b-958c-7d49cb22b206", "comment": "Malware payload (Vidar)", "value": "06ba715b44892af143c4336c189c28b5d95f446d3d07ca7ce7a6ab2a0601168b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313309, "uuid": "28795805-7c7e-4c94-a29b-47f29ae54dae", "comment": "Malware payload (Vidar)", "value": "904eed155444a8ba021d2f6b1c1bb6c89cb739e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313309, "uuid": "19c79d4c-50e0-4ad0-b4a4-42ccf2d94ab8", "comment": "Malware payload (Vidar)", "value": "fb61852882c21e6498a998ea22f18a885c10963666150382221a202ebf0c1f61903b899570b98d8bf249768aa7344697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313309, "uuid": "76d9064a-bd2b-4f68-971e-d2f17af3bd73", "value": "T15AF58C17ADD189F6C0A9A235C9B68246B734BC081B323BE72E90BA783F727D05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313309, "uuid": "87c9bd60-bf9c-4638-a899-884035fa44ec", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313309, "uuid": "716ce22d-05d6-464f-b13b-bc1f957137bb", "value": "49152:xULBFFB49EefSouzoIez6d09NGPOgfsGI/chGsbyVNOX8q2Ckm:xOwvedPzkB/cUVYNsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313309, "uuid": "cbdae289-a7dd-4c0b-bea3-1f8db9024793", "value": 3631960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313309, "uuid": "a57c05d9-ab41-4990-8b67-d8e34cf15f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313309, "uuid": "64fefc62-2269-483b-89a8-54dacb8c208b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd94306-8175-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247891, "uuid": "a4b09e59-7c49-4809-99da-7e1e97f63d92", "comment": "Malware payload (Mirai)", "value": "8133fd8007a0f2054b2e209dd3141552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247891, "uuid": "ad54ee5d-368d-4194-a40c-143058d5913e", "comment": "Malware payload (Mirai)", "value": "07a3507588c075ffe32b516d435cfd27a9080d9fda8ba20b441a04cc13a8c103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247891, "uuid": "8895bf72-08ed-4348-83a4-37ba779ce5de", "comment": "Malware payload (Mirai)", "value": "b606904eec49c87df820532c767ee2847dabba75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247891, "uuid": "bf84f44a-487d-4c99-bcb6-78f0da82dbf7", "comment": "Malware payload (Mirai)", "value": "651eb4ac16a2ef9bbd4f3fcfd82957f9422d28aec325ba7222327facbbfc807e16375df24132fc895a0f5576367bdda0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247891, "uuid": "5f4f10a2-7dc6-458d-91a2-9c5eb09a6312", "value": "T14133F23883DD7166D8194C33D3BA87819A81D0F823D96B1F2414C39C25D6ECFAE6C99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247891, "uuid": "80edfcdf-8558-482c-8584-5ff7b409ff9e", "value": "768:jFn0wBQ8q8DkOWEXJ8kZL1QQ0uHrsH3LNVkFaFBxMq2U2Wd4+gcMWO8h13U03wfD:jF0DIbVJl1QQtLsH35VUaFUqVic30fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247891, "uuid": "1dea2fd5-506b-48ac-9c3e-b6231112021a", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247891, "uuid": "ecb81195-182a-4d71-9985-db5f0f84df89", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247891, "uuid": "e7457af7-577b-4deb-b89f-80a21b8ab2a3", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a925df19-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267104, "uuid": "b19653c3-593b-4e6e-8929-c8f51b1d91f6", "comment": "Malware payload (Mirai)", "value": "24a10e9ce3df309893050074cd2a27e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267104, "uuid": "b51b92ee-e0ed-4089-9e07-6210682a0bfc", "comment": "Malware payload (Mirai)", "value": "07f0386ad5859556dfdc5bab8476e108a66452445aad06396f50e43aec0d86c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267104, "uuid": "deb099b0-5440-4134-9513-543341af6ac8", "comment": "Malware payload (Mirai)", "value": "db168ec0397a5d3488bcafde899a556dcc12e032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267104, "uuid": "9613b940-6ccc-4771-9bdb-a53ad8ed1bf2", "comment": "Malware payload (Mirai)", "value": "e6c8febefafc1fe8926ebdc244645720ec5ce1589328905c636f399480b6fc0b7daea88ef468f1e80c30da11306a4a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267104, "uuid": "05aed15a-3545-4f94-9b7b-a1fe8cbb6445", "value": "T1E9A34AD7B401DDBDF84ADB7B40531906B131E3A20A831F36626BB967F9361981937F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267104, "uuid": "0d335600-1693-431c-b637-162ff2bb6ead", "value": "1536:9PMpxBl0//5Su3gtVfd4zsyYCkrr7o8zWA8T3OH6iC2J3m8Ry6KG7QIeW4N0XQ8g:n//H3gtVluCH7o8zWIP3mOyZe4N0X5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267104, "uuid": "c6ac4df2-678d-403d-b9e7-3ee870c27932", "value": 99704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267104, "uuid": "1aa31950-f9da-4bfa-828b-7fc52cec0354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267104, "uuid": "c4569f44-4ff4-4cbd-8e2f-ba6e050f1f42", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1b2684-81b3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784274275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274275, "uuid": "0254c901-3898-422e-960d-e0f1aa750fb1", "comment": "Malware payload (Mirai)", "value": "510d0bd1eef823d8ca4cd543f935349b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274275, "uuid": "e0025f42-08d6-4dfd-88da-6b75cbfd824a", "comment": "Malware payload (Mirai)", "value": "083ea4f6dbdced1ef8a105df60e6e45a3550bb52a4c476f7479c31405ab6a591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274275, "uuid": "929b8611-3fa7-461b-809f-36ac2b6b6d6e", "comment": "Malware payload (Mirai)", "value": "14102d5fbba6306d99e326f9327687e5aaa2425b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274275, "uuid": "232c99ea-0f6f-462f-b7fa-6ecac04c9308", "comment": "Malware payload (Mirai)", "value": "f65ec94588e07229468bd91a0a6f242fe0b44fa699ae16c229b7d3de0e13e168462703438b5519449062bc458af81b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274275, "uuid": "c484cbf9-aa5e-4f7c-b9f7-ba1a8eda3caf", "value": "T16F936CC1E693E8F5ED5605751033E33B4737F539102DDA97D7A9AA32BC62A00D1263AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274275, "uuid": "66b15eca-ce74-470e-bb44-bcf557338f1d", "value": "1536:rO6K/56NA3+5K8R6DgeDQvrMwheDH2eifofEITRBIeJUmzXe1CW+XpElUBjcW17c:y6K/56NA3+5K8R6DgeDQvrMwheDH2NgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274275, "uuid": "84723ab9-74bd-4ebe-abd5-bbba8fc1f708", "value": 91892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274275, "uuid": "19221471-1e3e-4bea-ac90-be0d3f3bb363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274275, "uuid": "9f6aecee-6501-44e4-b20a-d865833b33b2", "value": "nerv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ba2bd9-81f7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784303550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303550, "uuid": "2abee8be-c3ae-4962-ba1b-314652d9bb4d", "comment": "Malware payload", "value": "a3d09e9f3b3b236bbb8503f4cc5071a0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303550, "uuid": "386b2fa0-c389-46a7-b93e-2f030ce4db89", "comment": "Malware payload", "value": "085671dd2b9f5f4041dbf6a8d7e888f2209f691ac155b929d226305113b39f0f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303550, "uuid": "ce5f5d15-6cf7-4e8f-8a53-b1a67ec08ba7", "comment": "Malware payload", "value": "cefc2991d95076ececdf768d9b55ed4e6410da5f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303550, "uuid": "13b2dcf4-f5a4-400e-871a-1749ab8f94f4", "comment": "Malware payload", "value": "aa23080cf8afe9ea4e17c04c4b4ed90882e5d79c757fb5fe14179d378dc3761ecfbaecdc2320870dc387a8682c184b49", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303550, "uuid": "3aef23ce-b230-41a4-80df-9aaf4d1b2f0e", "value": "T184E6334967D004DEEDB3513EAEF24156E49934305B73C9CB9BACD2A09D631E08C3E6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303550, "uuid": "15cb9056-8b59-44c9-a7cf-b406acff88c7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303550, "uuid": "c194e03f-1053-4022-9858-56fd531b0ca2", "value": "393216:L86eYgRPbGTDXapUN8Pl6FJXMCHWUjXScuI3/PGTAI:L8ECUXXMb8XvH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784303550, "uuid": "10c6335b-26d2-470b-af1d-1d2ffff21118", "value": 14309414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784303550, "uuid": "7ac5b111-4109-4538-a562-868ca71a179b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303550, "uuid": "c29d1f4a-5959-48be-87e5-c4227f1f3b8f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3130d495-81a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267333, "uuid": "27f52a0f-33ba-4bd1-9050-44791943be7c", "comment": "Malware payload (Mirai)", "value": "1f811f1667ac62b752bc59a378aed442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267333, "uuid": "0a011f0b-dc97-46cd-a9b7-cdc167b7d191", "comment": "Malware payload (Mirai)", "value": "09591253a95411d60c2b0d5384924aa7cafbceec1467c951c6bbb1655d748f0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267333, "uuid": "6c6911d0-231c-42dc-a8a9-d524472e988e", "comment": "Malware payload (Mirai)", "value": "7e2d632d3c2a37d41a7a02595d8aabe595560cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267333, "uuid": "305bae42-7d5c-4cba-b99c-2633c97abfcd", "comment": "Malware payload (Mirai)", "value": "32bef2763197024db58f44f96ee5fb4a735015414cb1c77bb4983dd850b3d65e51a19d351b8fe948b69b82b1b9a75156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267333, "uuid": "72cd738a-a1c3-4973-bf58-bd69aa90d649", "value": "T151E3BE97F6472092C96302F407CB6BCD2E6362825F9BD9E7AD2F753B19360DB1402792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267333, "uuid": "6dd311e0-9031-4c39-9eb4-0c5c09c7b172", "value": "3072:jfpcpGAcRtyMNJYPpQZE9wXyQbaYOdHgu7Nq:jgGF7CIXfq7Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267333, "uuid": "6149fed4-6f7a-42b4-b40c-5a34b51e60ba", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267333, "uuid": "75f51a40-ffe9-4d1b-9661-91e86409a2aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267333, "uuid": "97cefa39-4729-4444-b385-7e1bf01a11c6", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086d738f-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311502, "uuid": "5941b172-a697-49d7-b977-3b87d68bc88a", "comment": "Malware payload (Mirai)", "value": "0f102079db6991f38e64bd3f081a555b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311502, "uuid": "e2a812df-349b-43c9-8a3c-edef0f9d5e33", "comment": "Malware payload (Mirai)", "value": "097f737a37c946fa82bc6959671cab02af4e5dd69f47face5e7e9f1293b2c95c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311502, "uuid": "5b0c0ae5-b3a9-493a-826a-e9489ac8f7d7", "comment": "Malware payload (Mirai)", "value": "3ac7de4f888fc8bc604a32d6ccbf0a1a505f3636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311502, "uuid": "013772d8-0dd1-44e7-ac77-42b538b03fa3", "comment": "Malware payload (Mirai)", "value": "db89fa87b643e804191bac8ff5ed20933f76aa038ee9d4933b59b09f8501e621f1dc1fdfd2daccf58af7563760c05616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311502, "uuid": "52ea1e88-c175-4000-984d-eed6250997ea", "value": "T1E1D30745EC819B11D4DA22BEFA5E028D335357BCE3EAB102AE145B2533CAA1F0F77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311502, "uuid": "e0c7feca-baba-4291-bf37-675b8887fedd", "value": "3072:EQyby2oLmpMguHcUmVUHalw7WXuH00sfC7FeBI3RA8nAEBYaEOW7PY5IsaYeFlQ8:7y3oLmpMguHcUmVUHalw7WXuH00sfCAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311502, "uuid": "5a8f7a0c-6d36-4ef3-9c55-3b68f06ada1d", "value": 132572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311502, "uuid": "66d05e54-80db-4776-a20e-4dec884009f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311502, "uuid": "46aae275-4f08-46d6-92d8-165921e234f0", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ec8f5e-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325131, "uuid": "65686119-9565-4cfe-b32f-ee3918ac62a4", "comment": "Malware payload (Mirai)", "value": "f9e81976cbf9b23b4346c7391e802e54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325131, "uuid": "45bc5918-d7ca-4448-898c-8c9a828aec37", "comment": "Malware payload (Mirai)", "value": "09bc9c01ebacecc8874d54ae3c4bd22f924d5ab80fbaa4cbb8481065f34dc2a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325131, "uuid": "32af97a1-192e-4214-b931-decef3982869", "comment": "Malware payload (Mirai)", "value": "8ef056e28283e5c46efd4197ff88d13347846c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325131, "uuid": "257534bb-deba-41e9-af69-36ab755f56dd", "comment": "Malware payload (Mirai)", "value": "97e5261db20dc84f67f8290b271e3d508e1dea61c2e5c876656f14f45e7dd367088c52e33985179caa0638377086a600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325131, "uuid": "8ddcd1af-d5a0-4b24-b46e-0720a72a1e34", "value": "T125E2F26017FC6087C60E0276A7AAA6CEF573A4211FD6C79A7DBA1B10FC011F04FB6562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325131, "uuid": "37efb2ef-6eb3-4d4a-93d5-666e4acb4245", "value": "768:4frGFEyCF8Y6bZoHTwhTw8X/dpENDukRecmr1+aZiHlS+:JFETx6iE9tdkH0dZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325131, "uuid": "896b08e7-834a-413c-8549-11cd01764bea", "value": 33920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325131, "uuid": "51e6f014-dc7d-4f53-af8a-3aa60cee0be0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325131, "uuid": "702847c8-e248-456e-b3f3-343caec84788", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b75589-81a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268625, "uuid": "f5e23770-1f49-47a1-96b0-d212283db486", "comment": "Malware payload (Mirai)", "value": "ba557ad8deaeb3f8386b75b3efaead60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268625, "uuid": "5050f73c-88cd-4cfb-9054-7247a20066f8", "comment": "Malware payload (Mirai)", "value": "0a0fa0193a7de4d2640626a8347b2f46930663ecff98c8feef62d8d51d08708c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268625, "uuid": "13a8d99a-5cc4-4c59-a666-1726b92fefbb", "comment": "Malware payload (Mirai)", "value": "a7e2662fb1481a2e8be41177e7cecf5ad75acf25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268625, "uuid": "e74bedbe-b9b3-4791-ae6f-471b4bd42c71", "comment": "Malware payload (Mirai)", "value": "40684346fb0e2e628f980f2a47d7f209ae7e86c9f4c39dad25ca84fb996e04f996227fa474f059f3d9f56233743bc3cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268625, "uuid": "1a8324d3-40f2-461e-896c-5818ce901672", "value": "T1E6D3F8067F610FFBD8AECC3B06B81744258C552A2AFA7B767970D81CB68B14B4DD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268625, "uuid": "3cfa7b4e-8fa5-4665-afc9-16b2ce661228", "value": "1536:jjE2JOCFg8dsXxOdTye4DAQQINOZbhD1Obc5wHJYN4hiwD2VsFp:jjE2JO1h9mbhD1ObXq9wDfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268625, "uuid": "9e02eeda-2dcd-4908-867d-a4f5de5a6cfe", "value": 134860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268625, "uuid": "32a93321-1a3e-4ba2-9bd7-544189e27a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268625, "uuid": "b063f6fc-336a-4460-ab7f-5c4092e2326d", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b3770b-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325181, "uuid": "f07f1850-d336-431d-8608-6d88c0b5b156", "comment": "Malware payload (Mirai)", "value": "8c07a7a9c14080c22c106bbb79ccc4cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325181, "uuid": "233d9b79-7d67-4be4-a2c8-08ef83db3775", "comment": "Malware payload (Mirai)", "value": "0cd562a0c54b35e0bca87de7be6e2b55e9d80dc00b71b2cdae9483855d9ba529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325181, "uuid": "c3181222-2c7e-49b7-9b25-ffb58dffc36b", "comment": "Malware payload (Mirai)", "value": "a49df0b1eef079ec13d9a74fc4659cd5cf7e2181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325181, "uuid": "da1fe5fc-9525-447d-87da-f2af02da5a0f", "comment": "Malware payload (Mirai)", "value": "b1abdb932e07ac6c2d395ff35664179effa1040cccd4e1dad1a4a012c72b3bca9d41380f5071e6b6ff034bec8e4f80d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325181, "uuid": "2892c774-d178-46f1-a78a-3e388099bae3", "value": "T162732991BD815713C6D112BBFB5E028E372663A8D2EE72079D226F2137C785B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325181, "uuid": "66a91f31-fc4b-4f5c-a848-8676355f4f54", "value": "1536:IKBJMji8058nDeG5LpraIY7W10fVBdvws/KE:IKBqF5Lp1qWyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325181, "uuid": "fc24d0d6-b2ba-40f7-aa81-be617af14026", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325181, "uuid": "c7a128a6-6d94-440f-89a3-aec988499e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325181, "uuid": "80b28976-d763-46aa-a5da-fe8267e6c106", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b608cd5-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312366, "uuid": "eb5faf18-062d-4de5-a48f-9dcdd8fef75b", "comment": "Malware payload (Mirai)", "value": "26eb0ae8b1430fe1ce374507536616f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312366, "uuid": "2e1f8700-0b92-4883-b89d-bc21e4fc82dc", "comment": "Malware payload (Mirai)", "value": "0cd89d056a47649d5db885122c6fa4963956fedecabaa1b4ad8d58bcc8527eac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312366, "uuid": "31c9ff42-aa67-40b5-85e3-1f9859018861", "comment": "Malware payload (Mirai)", "value": "d86cf8231ba5d68b92228896df2488cde901bcec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312366, "uuid": "d9c2a724-ada8-47c6-abf4-1f64afe0d6cc", "comment": "Malware payload (Mirai)", "value": "0dde24d402f0b9d0bc535293175fa3b829272e873754622651134977a36242dfe70bd779f3dbe30620888d0361432393", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312366, "uuid": "20c489b5-aebe-42cd-9b4f-6ee6d79caea6", "value": "T19F93E842BD429F13C5C621FAFBAF059C3B166B79D6EB3202D921BF9023868D70D67251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312366, "uuid": "0f54da68-0fcf-4701-8cbd-72e0444bbe9f", "value": "1536:AVWF+5w6vhbcHjrConz7qz2icOqZwRv5a/V7tI6DZZBjNteM5/da:AV4JZjrConz7qy7ux5IV7tJTda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312366, "uuid": "8f64bcd7-e843-43f1-892b-4b57adfa3bc4", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312366, "uuid": "4e1998f6-3e7c-40aa-8ae3-6e17460d8ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312366, "uuid": "638037cb-3ee4-4a9a-85bd-046f64857154", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd1634-81d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784290330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290330, "uuid": "8b3bcadb-cc5d-46f4-8077-6f3274b72c46", "comment": "Malware payload", "value": "5d7c24f05c4a7d57d0f92824ac42c448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290330, "uuid": "da2f1b63-90cd-4b0a-a398-75e546720e71", "comment": "Malware payload", "value": "0d00dcc777435cb0f17207ab832acdb1079998715bdda4df70233d4e8c98fb7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290330, "uuid": "f8d36f13-19d7-4fbd-817f-aabe9751174e", "comment": "Malware payload", "value": "8b441230d78137cb57fc966c85a7438083c8b1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290330, "uuid": "cdbfe1ad-b2bb-4d3d-86b1-06aacb643902", "comment": "Malware payload", "value": "5445bcbc86b7456501ea6eceb2e7a33360004104a364f66bfd21268a64a9ea184f3a8cbf209d81d620f0b34667746d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290330, "uuid": "3a8fbd0a-a3a7-46f5-9b83-fece45da817d", "value": "T1EAF733BF72A4D51BE21DC23B82A39F54603BB0B51737CADBD69112699A071C0AE3F354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290330, "uuid": "429c9ad1-cd3b-4547-9088-7de04afcfb3f", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290330, "uuid": "2d0dda15-307e-4eff-bd27-8eeff482d18a", "value": "1572864:iXqgR72V+4HE0es6AD/uMhUjCduT/anGBlsuijJpHVFz3DLtlTZ:L472Vq0nry+MRTw0lsuijJpHZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290330, "uuid": "b2633987-38ba-454a-a50c-07028da6f803", "value": 70927646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290330, "uuid": "2b8b03a2-8dd1-4c33-8282-584b1e3e1c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290330, "uuid": "ee21aa7f-79ec-4f9a-968b-007c60e5e7a6", "value": "7z-Zip_WrAr_Ratio_26.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ddac4f-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311491, "uuid": "24246494-50c5-47e0-8081-67887f5e849d", "comment": "Malware payload (Mirai)", "value": "86da4f26f8e190dd6ac172cb39e13f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311491, "uuid": "0d9a12ba-447c-4ddc-a7ad-cbbb05cdbfba", "comment": "Malware payload (Mirai)", "value": "0d20a070ac26d76e3479939a47d1b849d13689d71040a54b30494d2091f6a55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311491, "uuid": "282d2a17-f5b9-44a8-ab35-b2bdf53425f0", "comment": "Malware payload (Mirai)", "value": "85cfce8518033baedeed0219e9a6ea5d7f2f6e6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311491, "uuid": "fb88136b-a7fc-4ed6-bde5-ccfd471e6949", "comment": "Malware payload (Mirai)", "value": "55fedef0bf1d7c6b9cf8b0556f41d1711f5c3eec728878b896702481629d4e72c74eaa43bc1dcaa82abd0fdc2d05d07c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311491, "uuid": "9a7d901b-20b4-4f28-9463-e2f92d6bf014", "value": "T1AEE32901771C0E47D2A32EF43A3B27E083EFDA9121E4FA44255F9A8A5275E335589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311491, "uuid": "c1ca2dd0-4130-4441-9499-6a038858ee46", "value": "1536:6sP5rWX6atLVzqn84HhJaxZ8xqy+3F5AeXFxhHUDNnvAlAWhBZnfdoAaEqPXkMf+:T9WhZqnjHh8xZrysBxBU2loVkcgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311491, "uuid": "91703dd7-2598-43a1-902b-05cb8e4a6865", "value": 146752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311491, "uuid": "b86a4138-1e6b-4526-9611-45c8de442cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311491, "uuid": "c1e1f534-2b2b-4e99-bdb7-7c37fd9083a3", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c5d000-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312380, "uuid": "12029be6-1cb9-4040-aabb-6f83fb3a49a2", "comment": "Malware payload (Mirai)", "value": "148bca073b9a66a4992fab62a844804c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312380, "uuid": "9eab9b03-e668-424a-ae35-3bbb301ce5c6", "comment": "Malware payload (Mirai)", "value": "0d6753429698391d462c65107d98a366e5cdd776354941631051bed643932b68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312380, "uuid": "169ea5cc-85bb-41ea-a961-45874dd06865", "comment": "Malware payload (Mirai)", "value": "611f3e5082fb58bbc4162e106be48181f3157eac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312380, "uuid": "c7472e16-1f9d-4365-ba3c-e3915e27dc08", "comment": "Malware payload (Mirai)", "value": "53cb56fff0ad628bb5fa61b78629e0a13fe1127590656b5764efa1fe957788088e4531dc14807e33c2edcdedce955e3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312380, "uuid": "f0c1ce00-7542-4a64-8b20-cd68250cb896", "value": "T1DAC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312380, "uuid": "93e2a15e-2cc2-412e-a7e5-56a0a862feb0", "value": "1536:j4w4zW/h4SZsqEznYswsiDSAPz/O4jaXbzjZjKfPNXm/iRK0UgSSW2:0xW/rZsqcYh/HjarzjL+XW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312380, "uuid": "b395be76-3d9f-4e1b-867d-5c9363218029", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312380, "uuid": "a7ad94a1-ca16-49fd-83f7-e829b6a35b0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312380, "uuid": "c253a447-c8f4-47bd-99ff-5a25b794875e", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842eb65f-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311280, "uuid": "80a35678-8b67-4ca3-b3de-f12e69101f8b", "comment": "Malware payload (Mirai)", "value": "9794cbec2150f6ec022e4e5f75fd36bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311280, "uuid": "4273604b-f8b9-48d4-9c23-eb517f26965e", "comment": "Malware payload (Mirai)", "value": "0ec51822bd86d10b04d4bc28e92b8d718d82b19d244154fa9d4d03264b1d8495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311280, "uuid": "38732c1e-ad9b-4460-84b7-9b1ee5c23804", "comment": "Malware payload (Mirai)", "value": "301bcbac352d72b183698e16b85a24ab93b3f769", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311280, "uuid": "bbb702c8-b0ff-4af1-becf-774e22caa6b3", "comment": "Malware payload (Mirai)", "value": "329085fe9cef5073244d8a68a284dcbbf31fd5cdc95530175d3958db8932c00b7ecd27ec4016bb7a7cd35d07e4ea237a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311280, "uuid": "9292420f-1af4-42e7-8239-b9e06bf2a1a1", "value": "T10D935B22F9391D2BC4D4A43661F34752F2F2478A25E88A1F7D720D8EBF3559036532B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311280, "uuid": "f3dd2bc7-56e5-4891-8b71-0e4a16615c22", "value": "1536:xEuQx/GutpaTxPew6YCGPJYKFYTFETJ6tQ6Qo958AcWovJGtrJ+h:GuOXx2LoPRjsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311280, "uuid": "1dcb0b9e-04cc-40b4-b96f-8aa80037841a", "value": 92552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311280, "uuid": "0292c53c-3c97-4455-8114-7f17fa2f0f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311280, "uuid": "7eb3efa8-56a6-4fb8-8dff-876bff2b9ab0", "value": "byroom.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7ca423-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312368, "uuid": "2dd94ffa-3391-462c-8dfd-92646846a194", "comment": "Malware payload (Mirai)", "value": "e1abdabe629f15b33924ab4ce3506d54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312368, "uuid": "1fb31b2f-db71-4cfe-a265-ec40fd644537", "comment": "Malware payload (Mirai)", "value": "0f2a8fc776f448afd6808ce451ffbafacd52c4fcfa97383ca316fcc0b530a7c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312368, "uuid": "cdd49f5e-af46-4c26-a678-88ffcc43fbec", "comment": "Malware payload (Mirai)", "value": "f50f7487c5ff143652a80966b7d40b6ff9f80011", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312368, "uuid": "ebeec183-4d69-401f-b79f-05cbd106005a", "comment": "Malware payload (Mirai)", "value": "dcdb217536b64a0e35999fdf4e071a5b45c1eab9aabb24bf1594b10afd348247e0b3cb83f57ba8443c71a5e3eec08d9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312368, "uuid": "c00aa5d9-a800-4c16-8421-29f030f32d2a", "value": "T1E083D942BE429F13C1C221F6FBAF055D37266B69D6EB7242E9217FA023824DB0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312368, "uuid": "57a7c7e7-43a5-4343-a4cd-289031c41fd3", "value": "1536:lmfruQUBxc3TjrConlQqKZkynmtdaeU07UcAdUA8Sgp5EQtXJgra:lmfdLjrConlQqKqEVeH7lAdfQdGra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312368, "uuid": "9084f97f-43ee-42e2-8fb1-ea98fd46f18d", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312368, "uuid": "e9a3032a-45cb-4f33-b64e-02efd104bde0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312368, "uuid": "4d410c2f-4f9a-41af-a1e6-b6fcbb690534", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0717c6f0-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271986, "uuid": "3a985273-cfd0-434d-b005-d550e0b9a117", "comment": "Malware payload (Mirai)", "value": "503d3b6ac31f9a45053a99d21f7d59b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271986, "uuid": "01ae2972-0bb3-4c9b-9864-352789d724a0", "comment": "Malware payload (Mirai)", "value": "0f65737f38d026f82e3fc438821d623faeee156a10fa8e2b4054102b81d03b14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271986, "uuid": "a1c5644c-cd5a-42a9-9621-b8ceade64267", "comment": "Malware payload (Mirai)", "value": "b8837967c99e04262067991fa70a9d025dbb6658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271986, "uuid": "ffb36254-0710-4427-b586-e10578466a27", "comment": "Malware payload (Mirai)", "value": "ef175c8e7e105a02b901282b4830e07ffda72cb1b068ce0b1a4ee32df47f44d8167f135217e5c0690a7b75d695d2b1b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271986, "uuid": "063dc2ae-112f-45b0-a4f7-d240d0078f28", "value": "T1DA03F17FEEE4987AC9ED4EF55254073B7D60358023C6871013620CDBBB2A52F769E064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271986, "uuid": "1e314301-ab59-4e2f-957b-ea9f9e18dec0", "value": "768:2VyIwYjG0JFlRDl7YqgEZRB+ORP2H78Q4+CkcmHph/Ww:2VyYjXJNDlEba+DbX4+C9mHHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271986, "uuid": "55c9bf82-dd28-4243-a08e-a8f29c526408", "value": 38120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271986, "uuid": "f3636e99-8996-4d9f-8895-2220fc11e235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271986, "uuid": "3d4631ac-db87-4f03-bb94-26d27e0e1910", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509f8440-81e4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784295303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784295303, "uuid": "a5d98dd4-b491-4423-aec9-1872fb265e0d", "comment": "Malware payload", "value": "9f356c4205fe11142ccadd76072499a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784295303, "uuid": "32a0cbde-863f-43e6-9bda-dfa40ddde171", "comment": "Malware payload", "value": "0f7e41e170db9ae541dbceab9b91453537f94dbaee97a9c2a2f0cf896e72d8f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784295303, "uuid": "46d90ca1-23c0-4c0d-b080-bce8a3a19865", "comment": "Malware payload", "value": "a0a7e32bc385148de4f3669e0df2c6eee5ca99d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784295303, "uuid": "1f62b754-65c7-4b1a-aaad-4e41fa30005c", "comment": "Malware payload", "value": "a54c706eff918acd1aec7086749baad34c442ac6879bf52cb36c732534cea57596ff71c03edf1fe9a52b21c566ad805c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784295303, "uuid": "bbe4dabe-b68f-4103-9611-cc05baa47fb9", "value": "T195C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324952AC3D8B3C719C11F9CC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784295303, "uuid": "01d63e14-80ff-4f36-933d-0b3aa214bc50", "value": "768:Ge8vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:Ge8l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784295303, "uuid": "c88e52e9-8803-4d9c-9706-a645afcb2b7b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784295303, "uuid": "cf83da4a-ceb4-4f7d-82a6-fc610e4a89a0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784295303, "uuid": "42d1ab14-ca40-42ad-8f9a-d26cb4d90467", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbf63df-822e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784327131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327131, "uuid": "1176dc9a-faea-4138-9283-9883b3ee303a", "comment": "Malware payload", "value": "59195a5f2cb1795af9d0779b70415995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327131, "uuid": "d872d8d1-ca2d-4471-8755-f8259b5c8124", "comment": "Malware payload", "value": "10df86d8a7a3f56d2df33217da626c30e2e6005762f4427ef76c2815b40d8ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327131, "uuid": "4f413d0e-192b-43c5-aa8f-f5d2a2a3f606", "comment": "Malware payload", "value": "a6d6e58fce9d6fe60a2364e06ff3598fadc649cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327131, "uuid": "dd1dbdff-6e69-4495-b215-77003442c10a", "comment": "Malware payload", "value": "d8105c3b791e0d1d53c1ec1550ea7e3b2552abf7ae84d5aa94d959484d05a8ba959282f8b452801dd794eb09bdf57368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327131, "uuid": "24cea261-1122-4955-857f-a3332a50f893", "value": "T17527CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327131, "uuid": "2da47939-ea2f-4f4e-b3db-3806c7b47caa", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ2:cqYUQuVDt0TZE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784327131, "uuid": "4ff374c8-89b8-4d93-862f-93699d8e41ca", "value": 21397504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784327131, "uuid": "a3d2943c-827c-4a8e-96c3-bbd36109bd70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327131, "uuid": "46b82e7f-c554-409d-9b35-fa9f1e31bb87", "value": "10df86d8a7a3f56d2df33217da626c30e2e6005762f4427ef76c2815b40d8ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b728068f-8218-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784317808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317808, "uuid": "e0d53f52-cb02-4bf9-9307-a289ab290c7e", "comment": "Malware payload (Mirai)", "value": "d0363f867f96521d584d01766ffddf74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317808, "uuid": "23facf58-94c0-4938-ac22-d3ccfa7f6347", "comment": "Malware payload (Mirai)", "value": "11df549edef8f53b0ccc3581df0b24d8b0eddf06a18c9269659f5781665aea95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317808, "uuid": "b3d9fcbb-982e-4bea-a922-cc96687e4dba", "comment": "Malware payload (Mirai)", "value": "4591db2a03106a138a981272da9bb41b9c48f51c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317808, "uuid": "058cdfba-fa92-4b68-b28f-03bd09e02cfe", "comment": "Malware payload (Mirai)", "value": "e4dbba7cb8a4307cf8bd9e57ac774ef63bfe9731708c388725f5e81bbd34f8782f138f37faac12a61c44ec4f4e60ce99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317808, "uuid": "46445bf7-514a-49c9-a570-d40eeec1a8e9", "value": "T1228312BF1E52E085EAC784F5B986AF033B5778BC2B4D2605AD908C0F191EC53C3AC566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317808, "uuid": "ec8262b1-1fc9-439d-bcc1-53ce3d21e5c7", "value": "1536:xyaU00SH91oJPHIcW8A0ZFGRWMG7nFmci3kL+lyyJPRme8e4peQhvr6:3r0SHzwIn8VEWt7nvi0SlVJP18e4P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317808, "uuid": "0644ff1f-c9b0-4a56-b544-e88177180c67", "value": 82452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317808, "uuid": "e594c823-828f-4585-a462-80d2f6583c16", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317808, "uuid": "d2517f21-9da7-45b0-ad4e-de3063485301", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68ef6bc-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784325136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325136, "uuid": "bafbc1df-6bc0-45ef-9eec-680f412827dd", "comment": "Malware payload", "value": "513be1a7c9332cc40846272ee1fe0484", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325136, "uuid": "c8d9f7dc-c129-4e9f-b299-11e31dab1451", "comment": "Malware payload", "value": "122997a0a57155bc2bb99d3b8d0330d70e353e2625da1b57c262926c2d7ac1c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325136, "uuid": "32645028-bbec-4c0b-9246-50a85aad2099", "comment": "Malware payload", "value": "998878ef9509e0f1646957ca82c9947039f12f85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325136, "uuid": "be39b5b2-4ca8-41de-be66-492579332966", "comment": "Malware payload", "value": "1fa2a8c19e2cda34a670de1ac63fa463f75bc65798e1876589f46fd976374bfa338c0cfc45dda1ec0cd69c244b72c6b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325136, "uuid": "ce482fd1-7653-4163-9f5d-7ad515018357", "value": "T1893184E611620D3D6E91D95B767E882531D6F98668CB7F0CE9EC7DF8048EE0970006D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325136, "uuid": "7a23bbeb-1801-455a-bbfd-500a4227fc7c", "value": "24:Iv3pHt3pzKOLpANI1Xksp6KlNpJpmzUJp+6rpsYp1pKdsp8tt:SX399LRXJQUNrwzOUO2Y/UGitt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325136, "uuid": "d34e69d7-c6d8-4b76-9f9a-52f592b16779", "value": 1530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325136, "uuid": "0e1a5840-dacb-4e9a-9af7-eaf24d5aff89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325136, "uuid": "ae949053-3c94-4731-ad77-25471c2dfcb6", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b35a658-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784291482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291482, "uuid": "7bfefaff-2f1f-435d-8f0d-0d78d5fc5dd4", "comment": "Malware payload (RemusStealer)", "value": "133ba7d743d7fb9598f180c24741afa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291482, "uuid": "7983e3c6-3b23-4aab-b6b1-2c7c930d931f", "comment": "Malware payload (RemusStealer)", "value": "13e04612e4ef8382114ad8a314130d99e691c6b13a1872e0b000c586ba778d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291482, "uuid": "8443c479-c402-4e27-b930-0c0b9cb2c9a1", "comment": "Malware payload (RemusStealer)", "value": "f0783c8785c692e619adf51b1cfcc53f4ef9b20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291482, "uuid": "a909bc00-8fea-49f5-99fa-a66504242480", "comment": "Malware payload (RemusStealer)", "value": "f3418327371244d90033dcf852a2332b290b810e3e37297719466172eb5c02f303f89af44e786e545e3b5dcf4d13e013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291482, "uuid": "b596850b-7f8c-40d9-a47a-a74f75e991d8", "value": "T14AC53917BDA048E5C09EE33289A74656BB35BC490B3233E72EA0BA782F727D05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291482, "uuid": "3bc21bfc-7c78-4bac-adea-2212f7c02fea", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291482, "uuid": "3bb582b5-7cb3-4984-9893-fee7d51dc6c7", "value": "24576:bD7SjYuvh+dYtepW/sj7p+cFZQ0AwvXHafKL50zzAoBele5r9DXmm5B7MtV+Wh:bD729vYYgpKsjd7nmwvXJGD9ZF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291482, "uuid": "48afbe51-a7bb-4b72-b1ed-931cc9e92dc4", "value": 2698072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291482, "uuid": "5b019631-e831-4bce-86f3-4c7c0dbd43ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291482, "uuid": "210dd385-7542-44fe-800e-e7b0f70625f2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4388804b-81af-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784272517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272517, "uuid": "9a151802-3c0b-4e8b-9807-50afc8b6c530", "comment": "Malware payload (WannaCry)", "value": "dc83e552698e328f1de64813e93cdc54", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272517, "uuid": "45a32d83-b915-40ba-9ed1-e29d408e1d42", "comment": "Malware payload (WannaCry)", "value": "14706a68a3642c892ef6def953a7f407d6f7ca63258ac46a8ac4eef63635bb51", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272517, "uuid": "360c4ec5-651c-4d7b-a1ce-fa29b2a65719", "comment": "Malware payload (WannaCry)", "value": "ae482266b836d13af6f7e8af5e0c7fcf7b22d7cb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272517, "uuid": "1242d0da-e979-4eba-9155-6830aa1978fb", "comment": "Malware payload (WannaCry)", "value": "b4507e072bd55b9e242f733cbf6ce35c2744c72caaab0f7f6d04eaf52add66468fe655f3fd533c5940778b5862c0a37d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272517, "uuid": "78e9aa53-e1d6-4c39-ad37-cf9dd7f3890e", "value": "T1A736124333948635F0561B7098B38BA81633BCA1AB3B5AEF225476AD0E73BC95D70735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272517, "uuid": "ba063e99-4713-43d5-ad44-68ec9040751b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272517, "uuid": "808fe6c0-3f73-471d-b369-a3497e2057d9", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593:DyDqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272517, "uuid": "09e3c027-b6d2-4608-bf57-82a192be3e0c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272517, "uuid": "3339f123-29c4-4058-a167-6e4c2f54f746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272517, "uuid": "7e34c67e-40df-48ac-8b25-6ca7bbf9ab11", "value": "14706a68a3642c892ef6def953a7f407d6f7ca63258ac46a8ac4eef63635bb51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a8b9a9-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784291556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291556, "uuid": "907385df-c4f9-47cb-81dd-f75a32c892c5", "comment": "Malware payload", "value": "e7d81827c98525ec15ed458d001d493d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "res-explicittweak-cc", "colour": "#353159", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291556, "uuid": "c9d0bdf2-f97e-4f97-b239-1faa23ce1d97", "comment": "Malware payload", "value": "14ac0c55100d957d1b198583461b2605e6e72c2538039b54c538dc7e356ddce3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "res-explicittweak-cc", "colour": "#353159", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291556, "uuid": "10797ddd-d9b5-41fe-b393-e6eed8ba419b", "comment": "Malware payload", "value": "08ccb8ec5a8befc6bcaaa6c96cbadd4422ab08ae", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "res-explicittweak-cc", "colour": "#353159", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291556, "uuid": "5156761f-a313-4a3e-a461-d826f0c964c6", "comment": "Malware payload", "value": "af8bcc2e0b3036da25b06b1f9ce84ee3bafca49ea2092c3ecb215e7575ed4042815f27b7719276a1cc8e2313b16d32d1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "res-explicittweak-cc", "colour": "#353159", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291556, "uuid": "18b67e74-8d8a-432a-902e-ff7d71f03177", "value": "T135073355EA691F80DC8D263C98CF0B537768AB0E152BA74F8360E26F7DF75F0A912502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291556, "uuid": "a111fc7c-0c8b-409f-a5c7-64c79fb40ada", "value": "393216:puz0CfiOIJR8BWBJJ0X2R59aZ3/pZEnp1SVQ5EO6o2DGXb8:puzzyJjJ9Ta5/nkm+BL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291556, "uuid": "5ae3d4d4-a6e5-487a-8ac8-b58a64501117", "value": 17588896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291556, "uuid": "a935c575-ef50-4c59-a19f-12f2777bf0d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291556, "uuid": "7b50a22d-b1a1-4023-be27-b93ae7dc6567", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b52b19-822a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325275, "uuid": "1e95364c-2754-459a-b3dd-dd3388062093", "comment": "Malware payload (Mirai)", "value": "65656f07c0f65700edf03e80440e2e0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325275, "uuid": "b550f9f4-dd68-4676-b2a5-1e1010b073a9", "comment": "Malware payload (Mirai)", "value": "14fa5ee8b61e61e14784e810e287348e89fd16bc62ad6763b891971fa0b8e5bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325275, "uuid": "da8425d4-fee4-4b9f-91ea-45effa59edaa", "comment": "Malware payload (Mirai)", "value": "b16fda3fe9c5c2e111e497e2948df53ee6c17c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325275, "uuid": "bbabbeb7-940b-48d9-930e-a6be2d043993", "comment": "Malware payload (Mirai)", "value": "3c5d1bebad160072c8d7beb15f1e9f8bad9bc486181eb5a993c1f24d787ea52e32bb92b7e499c4fb3e578638ef1b5bba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325275, "uuid": "3eaa7798-ab1b-4128-94c5-3d8fabf5e336", "value": "T131E2D0B05A1E2B28C629667A8E6D4F062F7784F1C0DF323359E2D2F83E8444D53E45D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325275, "uuid": "0b6629fa-3976-435e-8825-c494086cb087", "value": "768:A7WxJPxjsAlKa4KbnJO4IARUBm5ZtPC0s3Uozfc:ASxTIAcadTpRumxPEzfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325275, "uuid": "9af16a05-01a6-4e20-b7d5-7f9e25f1eec7", "value": 33928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325275, "uuid": "1cc3cb61-fecb-4e62-834b-10cb1dfa5d8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325275, "uuid": "896c7190-1fbd-4674-980f-651d0485ea58", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf2c0b8-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271996, "uuid": "80d9cab4-556a-4f47-a324-627e911dfd2d", "comment": "Malware payload (Mirai)", "value": "0f62ed5ce741b0bb77fffacddd988782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271996, "uuid": "c48c7326-80f7-41db-a8a0-35a89fc1911b", "comment": "Malware payload (Mirai)", "value": "150dceef03fb01f2ba64c69b1ba63ac4892c632a93741c053addd4813756c423", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271996, "uuid": "b8f2a145-341b-46c6-b68c-4320bf497485", "comment": "Malware payload (Mirai)", "value": "9a854004ba61c086048488ec6358197e87057aed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271996, "uuid": "06588014-8a09-400d-8dbd-c3da1bb2df1d", "comment": "Malware payload (Mirai)", "value": "56543dc0a8495b6c82525a87d1744558488ac7814fa0812ae64b065bb7ecd71b4e7fcccfba397df4b62acb2715935029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271996, "uuid": "87d3d4cb-fdd6-4c18-ad04-48f96e6e019d", "value": "T15403F1D4429158FADA28E832DCBC45157E372BFC30BFB0246BD4086D89A72947DD56C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271996, "uuid": "e83fd48e-7c51-4641-975a-8490a825a923", "value": "768:uhbUpgfK/Aw2owYdampEogqoaefKdSeMCJy1Jk+YvptisIqluuM3u8LP9q3UEL+z:uxUpgy4XowcEqoaw+KsiTwuug0Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271996, "uuid": "af6065e0-4d1b-40ad-8e1e-a52584699aec", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271996, "uuid": "83b3fd9a-daa7-4984-bd24-5ad8f326f141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271996, "uuid": "1062985a-dd5d-456b-81eb-873f255c2374", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db102f55-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272342, "uuid": "33c8a740-6d75-4c96-bac2-3a9093f61b6f", "comment": "Malware payload (Mirai)", "value": "d0e3ae62582d96678c4a6e307f623106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272342, "uuid": "15d4dfa1-d3f5-42bd-8732-24af0e0999a4", "comment": "Malware payload (Mirai)", "value": "156b0606b4d4cbbc29803a237c3b1aeea5faa0c6aee7e7512be0575954eebb1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272342, "uuid": "15fb9f1c-ff32-4bf8-8b2b-45d58cd86568", "comment": "Malware payload (Mirai)", "value": "12564881d6d192bd5ee6abc0c90367bde89044d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272342, "uuid": "610ea60b-5aba-477d-aa50-a943b962ee87", "comment": "Malware payload (Mirai)", "value": "de5d47d7e5f620f44af94cb0c912f9f3e2a0ceda56400c2003e21c98d648d4fee20b77f34abc5977aca07d0b30b99821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272342, "uuid": "50359913-c27b-4aeb-9553-8cbbe63b719c", "value": "T16BA31855BC829A16C6C11677FA1EB28D77267398E3EE7117CE249F2133CB51B0E2B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272342, "uuid": "9f1a8ec1-7311-45db-8ab6-c4bf3eb4fd2c", "value": "1536:GZHlz2byhssWaBElr4fJEOQlrjzdIU7tocD0yxw9taufR8mT0RFgiUOWV:AGOs1aB/grS9tauZl0RW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272342, "uuid": "5bad6115-a644-4d8e-a086-5c20f0782b58", "value": 105336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272342, "uuid": "f4d6b42d-3ae3-414d-ad0d-0427f8fabb49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272342, "uuid": "e4758d1c-8ca8-4a2e-a4f6-5ac4369bf520", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab6bc9c-822c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784326512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784326512, "uuid": "bc71a110-1fc0-49e8-bdee-dee1557b7a3e", "comment": "Malware payload (WannaCry)", "value": "53b75c21bfc49c21d1e3998cf2acd14a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784326512, "uuid": "159089d1-86c3-427d-ba76-912a7c95c547", "comment": "Malware payload (WannaCry)", "value": "1574e58fb3f049dd10d6923ca6b36bc440160cfdf57407328191ada99d3e1a89", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784326512, "uuid": "d92b96e4-693c-4083-9871-22a5992e100a", "comment": "Malware payload (WannaCry)", "value": "189661f059be5bc53c2f0a3af5d8bec1540adff3", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784326512, "uuid": "c7b83a4c-3415-4188-b903-98cc3b3899e4", "comment": "Malware payload (WannaCry)", "value": "efcc84be06381ad02a195e363f146310afec87c86fa9bd8796f48143854c1a2691ef80446e9b11c586478487b2214b6f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784326512, "uuid": "9f1a931f-b23c-4e29-8dcc-e0f0596b53ae", "value": "T10636CF01D1E51A60D6F20EF626BADB10937ABE46D95BA66E1221410F0C73F1CCDE6F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784326512, "uuid": "198a86a4-a90e-4349-9a0b-0d58b79e5bd6", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784326512, "uuid": "4739bc29-d333-4000-bcd8-aa01335faba1", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9uAVp2H:DXDqPe1Cxcxk3ZAEUa0c4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784326512, "uuid": "e63845c4-8f4d-4a44-a72c-6b0fc82b229f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784326512, "uuid": "4f4d7d89-fac1-4efb-9d6d-4df692885193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784326512, "uuid": "ca9a1fc8-a205-4885-847b-ba35928ae38a", "value": "1574e58fb3f049dd10d6923ca6b36bc440160cfdf57407328191ada99d3e1a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5405a6-81d9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784290460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290460, "uuid": "fbb923bf-cdab-4705-bedf-01117e5af493", "comment": "Malware payload (Gh0stRAT)", "value": "2fdbdd2a5033c7cfcbad4660bdc7368b", "object_relation": "md5", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290460, "uuid": "953daf4b-45fc-444a-8edf-f9fc0e0afeee", "comment": "Malware payload (Gh0stRAT)", "value": "17a545806806ef7fdc6c5bdc8f9009e3b11ecc18e83690550625ff106d03dc3a", "object_relation": "sha256", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290460, "uuid": "eb003714-2c28-4a5d-a07d-bfe2366b2325", "comment": "Malware payload (Gh0stRAT)", "value": "946ea4c902d477972f5c0e778a2c11f27ba02ada", "object_relation": "sha1", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290460, "uuid": "1eafb8f0-cb5c-427e-94b4-850795c83bad", "comment": "Malware payload (Gh0stRAT)", "value": "ad64d9990cab39d945db218ccfb528b9797b390a66f30559e68f011569b471f08d72ecadc618ccac2911f743a8aac960", "object_relation": "sha3-384", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290460, "uuid": "38af21e4-7c40-41bb-a5fe-883bd83b064c", "value": "T1A6472320759DC132F66F01B19629EA2BE17D7DE20B7004EBA3E4F95A6A314C25335F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290460, "uuid": "6faa028d-3db2-4c13-8753-6f7c3306eb09", "value": "393216:XLy8209zr7t8LrO2rqSb180uMG2mw5wahR1Tq+Y/5Dz7P+6+WpYrsamhCQKTsNog:XnHnSG2rB1hl5waf1G+T6+WpYrx0gJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290460, "uuid": "c1cfe429-a84a-4698-963c-0c8516ea0a0c", "value": 27016192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290460, "uuid": "f1066c06-4362-4ab7-9714-6a705e52287e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290460, "uuid": "f3b739da-a3c2-4797-b58f-657bc6b0a12a", "value": "fluaycaq_gugefy_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7be5e-81b6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1784275826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275826, "uuid": "ef02d8b1-785e-46d9-b665-980d3a62e962", "comment": "Malware payload (HijackLoader)", "value": "0a839b1215f4e37eefecaf8edfd9025c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275826, "uuid": "0794a9b1-a145-4126-a3de-4642877c9d19", "comment": "Malware payload (HijackLoader)", "value": "18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275826, "uuid": "76783a72-0b91-4418-b9a2-e4916ea2b6c0", "comment": "Malware payload (HijackLoader)", "value": "bb69bd993349f8db1b55cedb38ec87bd609b693e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275826, "uuid": "3a9463f1-f714-45a1-ba27-82a0545969bc", "comment": "Malware payload (HijackLoader)", "value": "7c721fbaf87d24e0b87e13cf641bf9c9cbfe6b2651ff7517371f7a1366bc11bdf904a8adf5343eef5c90c46a81cb3025", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275826, "uuid": "cfef9a1b-fd9d-465f-a72c-b5851619b21c", "value": "T19A66330777D220B6FC32563724058020AE3E786C5FF5952A1EF5C2AD9F39684CFB2696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275826, "uuid": "40e90814-4714-4d62-8b11-47b118dd8723", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275826, "uuid": "4c31f510-e329-498a-bcac-7ff7a976bcfc", "value": "98304:jJoRb3aK2ayBzvcDSbgp1+8WES51qPzXQi3kjA8oyIG4hcDzGTkvIs04Lx+4d:jEadBzuSbgK8WtG3kjpxSSzGT+9Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784275826, "uuid": "af457ec0-475c-4eaa-995a-a7f862be2de5", "value": 6526748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784275826, "uuid": "2517711d-a55f-4a08-b5c9-7ca06d4b00d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275826, "uuid": "54eb0422-5df9-44ec-a479-03f1fc47eedd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efc6d15-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784311218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311218, "uuid": "3ac312d0-f4f9-4208-81b5-ba963c29cba3", "comment": "Malware payload (Vidar)", "value": "30b526fde02d685214583614e3306a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311218, "uuid": "7394203d-f35f-46de-bd7d-7d23b7ef78cf", "comment": "Malware payload (Vidar)", "value": "197fd6b37fcc192e9ef6a0f2bff179a9cf2939e3b6226ec8eff11e7a07dbc9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311218, "uuid": "b29a7eee-3d24-46ce-b766-a4cd0b5e03d3", "comment": "Malware payload (Vidar)", "value": "c27a2aa63b6786636733760477b5bb6aced72c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311218, "uuid": "fc252fbc-f928-4535-8398-f60d8db1ca72", "comment": "Malware payload (Vidar)", "value": "a9def47ece1fe73609f6de9333e3f0d11d9c04a30ef137bee1690ac6a119a2e784736457586d75a403ec3c16b4887122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311218, "uuid": "ef259af9-605a-4442-9b07-29d753d404ee", "value": "T17BD59D0BBDE004E9D49A97328DB641967B76BC580F3123C32E54B3782E76BE09D39B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311218, "uuid": "dad1aa50-d585-4a8d-af76-ca287e5341a1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311218, "uuid": "db7d7d0c-b8b8-4ad4-8c67-0e3247ce0e4c", "value": "49152:3dlCiIrrafNi/llaW49zHqwyHDeHNGqu+6eCTwnzlaTut+MIRSGwCCgc7:3dWUmRGtGqu+6ehzlaTuMSbCCL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311218, "uuid": "ca96e76d-1cbe-4c33-bb77-51a15406ca90", "value": 2964816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311218, "uuid": "c3d1cb79-1d8d-424f-8f2d-34a614d26507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311218, "uuid": "8ec000b6-491f-4519-ba20-84ebb046ddb1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c23bba-818a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784256891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256891, "uuid": "1b09e674-720b-4b8e-8584-a698e044c46e", "comment": "Malware payload (Mirai)", "value": "5a8ee48edc7c5be6c4865f9d93f5299e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256891, "uuid": "0d146574-e3fc-4e5d-9c41-7d3b1e799ac8", "comment": "Malware payload (Mirai)", "value": "199370e9ef009d12fee9b3c4ad682dd95d2809d3081396a839d4316b9107b1ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256891, "uuid": "bcfae76d-3b32-4b1b-a485-461c86836a3f", "comment": "Malware payload (Mirai)", "value": "e379bf782b511e45e0c3db01cc8c9e9b3554dcad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256891, "uuid": "8d17d5e6-e9d4-43e6-99c1-d3f512555c4a", "comment": "Malware payload (Mirai)", "value": "8f827d88aaa3d471a2b70a3890ada148ffda22cdb4088ccb9c13f19f5a533a242344a786fcd13a344d8e04c003e351c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256891, "uuid": "17e8a6e7-4622-447e-b670-e8db0826c0f6", "value": "T149D30906BF610FFBD86BDD3706B90705249C542A2AFA7B7579B4C818F64B24B4DD3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256891, "uuid": "b9af86bc-c891-4a6f-bbbb-9c31654e541e", "value": "1536:UzEs5II1IsNc3hOJptF/pw+cXDVu0odRIDyfQukHKmHNBhHwA2Vwx:UzEs5IXxI1/BCFDyfelwA7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784256891, "uuid": "06cddd20-187d-4a67-ad75-c5871a7462b4", "value": 130764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784256891, "uuid": "1a274a62-2b83-408e-8943-faaa5016bc1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256891, "uuid": "97360afe-af2d-43b6-b4e2-57625eff7293", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13389abf-81a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784269430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269430, "uuid": "ce6e4192-1512-4740-88f9-91cf0d52c13b", "comment": "Malware payload", "value": "c83136eda8ec7238a41817468fe0984f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269430, "uuid": "aead8ccc-4c61-445c-82d3-2db06e86850c", "comment": "Malware payload", "value": "199bc377d9b1ba98c38a3846ac274774e892e2e04c995f45a23d043ccf54cd5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269430, "uuid": "e2cc77cf-d8b4-4b57-815a-16a22c629467", "comment": "Malware payload", "value": "a5998c2c4f844ec9d2be92019edd14ccfe45bf2c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269430, "uuid": "28fc4299-1482-40c7-983b-6ce4f2d684be", "comment": "Malware payload", "value": "57b7237d1bb740993c22a4b1f35bb4741b01a1425d9814bfa389850f304be838fbcde31b325ef078b8351ca9f2e4a32a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269430, "uuid": "e5cf1df4-cdf6-4315-9833-2fcdc01a8e88", "value": "T1ABC27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324D42AC3D8A3CB19C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269430, "uuid": "d06a8cae-ccda-4929-a0e2-bed902a259b5", "value": "768:V8vCB+25j6es8RVw9FYpMSUpi+20qUpi+20YQX:V8l25JV2d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784269430, "uuid": "556b6715-2f01-49c5-a7c8-dc9db62eb672", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784269430, "uuid": "928d1a50-26e4-49b9-951b-3cf8d768cb11", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269430, "uuid": "56a72f02-19b4-46f8-98e1-26dfd3b90b4f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc94338-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784291431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291431, "uuid": "bc58f567-2b33-415e-be62-7d67caf9406b", "comment": "Malware payload", "value": "65fcb6e1e3f89681851f826e4f18ccef", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291431, "uuid": "aa21fac1-da2e-4d14-ab54-0c2cf2985188", "comment": "Malware payload", "value": "1b91e801991a68db6edc479d506823ef830ee41e38938440622260a657d75204", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291431, "uuid": "a6ff6f8b-dbcd-4e73-99fb-c31fac8c5a5a", "comment": "Malware payload", "value": "f60fe281bfb9e3c384960e08ce9f00ca3dcb25b3", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291431, "uuid": "15cf2e42-efd2-4962-bc20-01ac7707cedc", "comment": "Malware payload", "value": "862ebb004eeaf2a8591fcb83000c1c7460f5238d23384841f515a9acc7c1c190fbcf94c7a5eeabb1f332c844aa6ace75", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291431, "uuid": "88593681-3d9e-4d71-ab18-845b0ddfe3b1", "value": "T15F1733983AF50126CA735834A12E2838D59227FCCCC19D8EBD9E23DEF6F448D45979B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291431, "uuid": "fc71177d-086d-4e60-9f4b-7d8d760c99e5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291431, "uuid": "efe0fdab-9317-4d21-870a-02e59107e72a", "value": "393216:3bMDzRR5F5MYAWX/PhQX09p1qf/DL+fHGIj0GwlSdqNnl:LMDuYpPeX4pJHGmESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291431, "uuid": "a361e796-d319-4d1f-a0c3-b962d9147754", "value": 19359744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291431, "uuid": "45d88740-a3c5-45d4-b81e-a6653341fa7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291431, "uuid": "0cfe217b-3cd8-4853-abc5-65c0c4ed4610", "value": "Installer_v23_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ed0497-81d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784288837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288837, "uuid": "d14076a0-b0fd-4c57-ae0c-84926ca4b5fa", "comment": "Malware payload (Mirai)", "value": "55a6958158b1cf561eaf06abd74e4d73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288837, "uuid": "2177dce3-ab25-4ac5-8187-499b139af6c2", "comment": "Malware payload (Mirai)", "value": "1bccd207b1d0c56f8f2de3f336efaf940e4a74f9ca410ae21020acd18bdf135d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288837, "uuid": "522b74f3-d989-4754-99e9-59cf98618a27", "comment": "Malware payload (Mirai)", "value": "6b7ba7171a6572d78f9230ad5349b6fb12d6c387", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288837, "uuid": "23c3f93b-201d-4525-b086-e92099d5a26d", "comment": "Malware payload (Mirai)", "value": "75042ec9f4e79c49fcd7776e6ac964bb4a21acd22f37146d6a4c2905f111ba7e867fca25a054bfb1cfe322623a9ab5d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288837, "uuid": "9c5be07b-2e9a-4f68-95ad-ba3a8c4c6459", "value": "T141E42855F8809F61C6D539B6F75D82A873074B79D3EB72069A244B3037EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288837, "uuid": "ff8873c7-1bd0-460f-ab2e-0655a229ce32", "value": "12288:F4KXMBCRZbMTphn++aQY+yM9wfeukMaY/5AxnZDy8p0RK5:uKXMcMb++e+ykw2eKxZD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288837, "uuid": "c7a2afe1-4659-4280-a491-262438f2f88b", "value": 662388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288837, "uuid": "22e83866-9441-4bd2-a29d-adbe8e2c19a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288837, "uuid": "7ab40d7b-449c-43d3-b76e-47d727847cfa", "value": "volar.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65492311-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784249811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249811, "uuid": "4f90dec5-7509-4706-93e8-d514dfa4c7ab", "comment": "Malware payload (Mirai)", "value": "5cf8ce688029427988cfae77a437814e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249811, "uuid": "fa6d12f6-30d6-4391-8261-8260708ca333", "comment": "Malware payload (Mirai)", "value": "1c17118204be51503b5f6095c8ee14da3e4df8831b3fc973378e61d081a7120c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249811, "uuid": "629f1081-c29a-4f05-9e81-61709ba99053", "comment": "Malware payload (Mirai)", "value": "8841b7ba5fcef03b8440ade4f2a45224126e4ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249811, "uuid": "ce0e1b3c-b6ad-4558-8327-69f6f3efc339", "comment": "Malware payload (Mirai)", "value": "ee930620ac643545f1b0dba6694edd5e482b10c4d096c74e0697bd0c19a4d10c261f2524b1a91ab9fe90ebba2c9ef366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249811, "uuid": "aef7a590-8b11-40a5-b1b7-836bc70c969a", "value": "T1114302A3437770E4C444BC7E880F7E8D8578F92A9454CBDA8C10AA334E6F966A55C73B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249811, "uuid": "eefbb9b2-f026-46c9-8acd-ac096eca3b14", "value": "1536:yPmAjqQM4sZGF5leZ3T+JONFa/Xzwnouy8DMW:mmSM3G9i7NQb4outDMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249811, "uuid": "a38add45-b014-4feb-b2de-a1972b7107f9", "value": 60176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249811, "uuid": "7ae321c0-bf31-48a7-83b7-88b291c73106", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249811, "uuid": "0d425f62-d1a3-4267-9410-67aa7f0e4800", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b079e2-817e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784251387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251387, "uuid": "5af1945f-2e94-42ee-b3b3-fd3896fd2b56", "comment": "Malware payload", "value": "294cf4cf1d626539bb1d3fd198c65ba2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251387, "uuid": "dced5aa8-3f1b-4cde-b8de-4396095942e8", "comment": "Malware payload", "value": "1cb6602444e604e0dfe8cb7b5240fb0e90536c503823293a9e9c1f3954aae038", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251387, "uuid": "2acd0429-fcca-4c7e-be6c-ab06b0a0ff84", "comment": "Malware payload", "value": "d8d9a9c29b6f1249135489f5d6359e0a0a9bf561", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251387, "uuid": "45cd1ce3-23c9-434e-8ff0-4e7be45a37e2", "comment": "Malware payload", "value": "1be317689d46e16d97831a47dbf2b7006406ea0e95fd5f571e6e476335b05c996c7b0c03a0ead97b2375cc360c3eab47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251387, "uuid": "65656449-638e-4c91-82e9-d2955f00fc72", "value": "T174236D651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251387, "uuid": "899be65d-3629-4576-86eb-f181765a946c", "value": "768:wXRWNGxVlal9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:klx7cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784251387, "uuid": "58ea3690-8dd4-43c2-9355-e9ed0fbd9c1f", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784251387, "uuid": "41f214dc-3d77-4aaf-aab0-4f9f408ab311", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251387, "uuid": "c8a5baeb-7ec3-473f-b59b-8251f566c4d4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2331f4-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784329762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329762, "uuid": "eb0247f5-7fd5-4af7-8301-1d4a11f094b3", "comment": "Malware payload (Mirai)", "value": "6c145042af90426a45dfea751640e659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329762, "uuid": "e68a7fa6-487b-4195-946f-640a172e07f4", "comment": "Malware payload (Mirai)", "value": "1cc57bc4e2443925408d907347346a8389ea4c55132e288dc5596fa29702dc60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329762, "uuid": "b7b1f268-6193-4762-bde5-e5e4294e7b31", "comment": "Malware payload (Mirai)", "value": "d20330b7438fd03b5ad8bc9d29037b716e9da2fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329762, "uuid": "4871ce46-2fe7-415c-ab65-71c901749a1a", "comment": "Malware payload (Mirai)", "value": "6fc2de40cf08ef1e74ae1ea127b4ff5abb39740125ba9c19927c739bd661782035971c5cf4dc2dc909c4f2ec0db6a3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329762, "uuid": "d7024993-2833-43eb-9e7c-3921d1948878", "value": "T191210E66E2DDE932E73200F652CAFF4727858E903467FF0B8A914502ED2A6D0C133274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329762, "uuid": "0598d5c7-09a2-406c-874a-4f1ba23c840a", "value": "24:FlYbjMsWOJFHxgxEmceZGQleZ3eLt5AvB2wyGues9OXruQ63QKFNfvnw:fYbjoOL+coGQlo3eLt5AZKqssbHkQ6NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329762, "uuid": "5a16e308-95c5-4f93-9524-cb6f9f89371a", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329762, "uuid": "ef0b1cbc-bc8c-4afc-9394-48cf4602adf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329762, "uuid": "2fc468d5-13a1-4e64-b3d1-48b71a7ebf01", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c73dfba-81d1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784287028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287028, "uuid": "c75f5f74-5ed6-4dde-9701-f9b8ad7f9c70", "comment": "Malware payload (Prometei)", "value": "e25870a9f25870348e7aac72a85e59a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287028, "uuid": "580038cb-6ea7-4b16-8765-19ad907d76a5", "comment": "Malware payload (Prometei)", "value": "1ce51bed2251cc37379884efb75c518b76145ccbf100ecb1b6304bf6de7b94dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287028, "uuid": "d54a503b-1ba1-4d29-8823-98d06a3011e7", "comment": "Malware payload (Prometei)", "value": "30cc6f643c0deb0792a2370c6048a885badca3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287028, "uuid": "3cb312dc-7707-4128-8453-8895418d392d", "comment": "Malware payload (Prometei)", "value": "8fc7f0b76cd194fe7aa709c8e3bfc859c6f9673d2676b6b2ee954389880b95277582417566265894e6f6e34f18aa8556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287028, "uuid": "ab26fd1e-7f58-4725-a8d2-da2b9bfaa34e", "value": "T18B060873E59441E4C1EED174C625A213BEE0389B173423D77BD1A6E11B76FE4AAB8320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287028, "uuid": "9b54c01d-e398-4a1c-8c26-b5fd6caea4c6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQY:cqYUQuVDt0TZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784287028, "uuid": "ec127a65-b45b-458d-bf4b-6cf66025e2ff", "value": 3932160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784287028, "uuid": "7cf7d1ba-c6be-4bf3-9b34-e38a3e1a79e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287028, "uuid": "3f89a45c-a92d-4451-8421-c3a5bf439303", "value": "1ce51bed2251cc37379884efb75c518b76145ccbf100ecb1b6304bf6de7b94dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081890d1-81ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784271129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271129, "uuid": "7cf846c9-b217-48ee-8abb-a017384cfbb2", "comment": "Malware payload (Efimer)", "value": "a1a25d4a1496e0f1ac70080e02a6b34f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271129, "uuid": "1c55c251-ea05-462b-93e4-8e5011fadbd0", "comment": "Malware payload (Efimer)", "value": "1e90f2ae0a816694fab1e173978a516b528dd874827f479d665ba7d43aa35348", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271129, "uuid": "65f13227-bcdd-4506-ba9b-c771532087c5", "comment": "Malware payload (Efimer)", "value": "c6a8eeb6e52e1177e9bdba86662f373bb5d7ae56", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271129, "uuid": "a1e6f4dd-fd47-4069-bb2c-dd8e9b13abd9", "comment": "Malware payload (Efimer)", "value": "8bd6873fc39952788b9f76119120b9a8ba56f7e5a5d1483634b0495ebd331e72fd47cd1d5e4605dac1c4955b1217dade", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271129, "uuid": "a7f11dde-651a-4873-a27b-decf97af5e53", "value": "T129E6330DB6E411FEF673503DDCE2856AE959B0650B33C5DF87A482649E132E14E3EA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271129, "uuid": "67bc1c95-5b27-4138-8b1d-ee3b7e5cbd5f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271129, "uuid": "c199b904-9441-432e-be02-10ed1654fd21", "value": "393216:+Dd8LwrvH1TztzyX1fowcxP1lBlXMCHWUjXzcuI3/PGTAI:+h1vH1TIX1fowOlDXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271129, "uuid": "a8122da8-510a-473b-9c2a-a46a2f7578b7", "value": 14309831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271129, "uuid": "f13dd5b3-2233-4e96-903c-849ae3564fed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271129, "uuid": "3398e7ab-c034-4ca2-809d-7f1139ac002b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4937dc-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250386, "uuid": "ec079cf6-7ee1-486c-8610-57bbdaace15d", "comment": "Malware payload (Mirai)", "value": "923803733bbf5b720d67ce2b9c935cd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250386, "uuid": "0ce75110-b7cb-4355-b72b-a9866fd3a8f0", "comment": "Malware payload (Mirai)", "value": "1f04bb3edad6c3ba22205bed96a5085aefb0611ec48c6eb73b57cc365ab3a16d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250386, "uuid": "30adef5f-ca71-4f28-920c-de045d7b1148", "comment": "Malware payload (Mirai)", "value": "ab90d703128ff42f7949ed66e15bc5944aef677f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250386, "uuid": "ed25c0f0-ec2a-4d7f-8fa5-0444ef837aa0", "comment": "Malware payload (Mirai)", "value": "5b8e1f578b1f174ec383c8a7fe3b26aafd012b299654597dc748f48a265584d2507ee3028b7e847268e330ea4099489b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250386, "uuid": "ef05aa5c-324f-4d8f-9f5c-c6ea7733431f", "value": "T1D1C339A9F890DE52C6D1267AF75E518C33231378C3DE7106CE249E3477EB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250386, "uuid": "dbd334f7-dfea-4c54-8cb6-7d3c2b40a39e", "value": "3072:N2348J4ZU5Ng4EpPOoX9tUWcYEEUv57pMx2+jSOBFt7QUkZu+df1Dl:N2oc6PuWcYEEUv57pK2GvBFzA5d95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250386, "uuid": "c2617912-508a-4ec8-af26-a96fac347214", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250386, "uuid": "af80b4c7-8951-4e26-a53c-24fd24b0504d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250386, "uuid": "c50dd1b6-fa99-430d-96c4-e63aea2c1762", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae2b287-81f6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784303024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303024, "uuid": "5aca9723-3ade-4c3b-8f7d-7d1d5967c1f8", "comment": "Malware payload", "value": "24ebd83f4f1daf7c6e653c703dc4c948", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303024, "uuid": "148f2cb1-88c8-400f-8b8d-e4d2a73e9f40", "comment": "Malware payload", "value": "1ff74838c6c09b784495f192c25ac00ea8d1537764822bf82a4b1a6d55217dca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303024, "uuid": "83f9c4ad-7077-424a-b385-92e54324e41e", "comment": "Malware payload", "value": "a8314831267400aad40de744c8b26248a7c43857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784303024, "uuid": "375f9e6f-389e-4c48-be24-d65423acc513", "comment": "Malware payload", "value": "d8119cbc8c0bff6dcc1d0f3978ccf91f46250a32f0b6a425742d4a40e5ed974ca49aace97f2b7d7f06bc3abb21470034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303024, "uuid": "4c728ec8-27c3-479a-b11c-00e975033cd7", "value": "T10A33F17202461EFEFF7E2DB6E6EB4250BBDA35AEE8663322910D0564A31500CB67D5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303024, "uuid": "cc50fd24-6e83-44ab-a04b-66fa130cfb52", "value": "1536:2yKnfnN9vyBQwPOO6SUabjb9hQ6Ik8NfUY:D0PyBXPLhjf9hQhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784303024, "uuid": "620e97d6-828e-4795-8d5a-e7320b6f2f63", "value": 54880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784303024, "uuid": "3e1fd5ce-d30d-4c98-be06-f40e087ab06e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784303024, "uuid": "d8a5a25a-21a4-4965-b3b8-f8f479938b8d", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b7d8a3-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311276, "uuid": "160ba5d1-1ded-491a-945a-5ffc510a818d", "comment": "Malware payload (Mirai)", "value": "516a8fd45248fda486b851da2daa2528", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311276, "uuid": "9ca563e4-7cf4-40df-9067-7b277e2cf52e", "comment": "Malware payload (Mirai)", "value": "201ac109d061bb79daf5a9e4521047b52ce37b794dba704456a29fe387b3782e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311276, "uuid": "d9b13b15-be86-40a3-9a8f-6c8dcfd11f99", "comment": "Malware payload (Mirai)", "value": "8164bf384a77ca090a8d5063cbee0d6bbbd60cc7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311276, "uuid": "389b12ae-284e-43d1-a96a-f11046de63be", "comment": "Malware payload (Mirai)", "value": "d3d5b4a8dc009e4c34ad66ab69eea659dd1c1c37fe37376a60300e5756c56ce934f59ddd935303b424f5078bb784e291", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311276, "uuid": "baf43ad8-726b-496d-9ee4-85c06e176140", "value": "T103737DC5E793D8F5F82206712137AB734673F13A2029DB83C7A9E933AC51602E5467AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311276, "uuid": "3fd5e52c-26d3-4ac7-97c3-2ba922178e1c", "value": "1536:9Rf86hsvwWEC4eWF3tahQKP8TyIAWGi3sCSWJqQ6zOb1SX4:/gwWEC4eWF3tOQKP8TyIbGi3rSYPO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311276, "uuid": "5089d8e3-3856-457d-8443-e1039b18cea6", "value": 75248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311276, "uuid": "7fde7065-88d1-4ce8-9aa2-324c2d67f235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311276, "uuid": "1da3a978-c4d0-4e48-97fa-90aeb3359d54", "value": "byroom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7229ef51-81ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784270877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270877, "uuid": "09dc7291-75e9-4f72-8448-066073494068", "comment": "Malware payload (Mirai)", "value": "90c2d9d89eb148ec66a01b0dbe0b6e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270877, "uuid": "b5d8c907-0ab3-406e-b267-a8d3bdc301a0", "comment": "Malware payload (Mirai)", "value": "201b1a44204bb8e3ade6a1694512c86f6b1067b07e8008e3434ac80e78dd5c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270877, "uuid": "b744b299-64b4-431c-8c0e-7c2531cd100c", "comment": "Malware payload (Mirai)", "value": "56a50bc239715bf1da09522090d3cd7f0a430ffe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270877, "uuid": "a0d3c5b4-0360-470e-a4be-40f219ad5ef9", "comment": "Malware payload (Mirai)", "value": "363b35ec1f7346f30c3468699c23849232169a12c3f8b0e2bac6dc51f2a8a1aae7f4cff5617003049d1d6c33006a34c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270877, "uuid": "331c7cd2-7fcd-4af1-ac94-3b96d01c674e", "value": "T106D3B71E6E215F7EF35C863447B78A35925823D52FF2D690E19CD9011E6038EAC1FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270877, "uuid": "a81c1458-6951-4e1d-8b2d-725e5c2d548b", "value": "3072:c6eq1UMHDKi0E8+tlBMU0Lv1WD/LJqoJxw/zm:c6eq1UmDKi0E8+Qv1Wr9fSzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784270877, "uuid": "cd30f3c2-ecd9-4f92-9594-71c905764ea2", "value": 130764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784270877, "uuid": "26d9ea02-0592-47fe-8dc3-5a9827fc3efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270877, "uuid": "84439fd4-8333-4833-a582-003e763b74cb", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad14e2b-81da-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784290944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290944, "uuid": "fcc7451a-dc82-4d4e-b173-e0b3929c9df8", "comment": "Malware payload (Vidar)", "value": "289e9f2507e9acec0e1647d90c4b9970", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290944, "uuid": "9a4c7b82-c9e5-405d-89dd-473509b48e20", "comment": "Malware payload (Vidar)", "value": "20ad36ac90cf518661dd10a81d0a9cbab1de1da4f425224e122371f8bfaad66b", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290944, "uuid": "667cab98-67de-45e3-8129-3b436e3ad4cc", "comment": "Malware payload (Vidar)", "value": "91f9039d673b96d9b1f167342430e951de829c7a", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290944, "uuid": "445bd8ec-7977-42ed-9c3c-dd95210781af", "comment": "Malware payload (Vidar)", "value": "0b585982f57a7482635de6478d5244c9a3fc111709fffb768f91921be73d348ecd7e4431b421b55ff5b992e622d43959", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290944, "uuid": "8ccecd6d-ac07-4560-bb94-deabe7331aa7", "value": "T103D73388DFAC414ED76A9FFA80DF932CE062C60967B6B55F4DA419805CD1AFA1F0B107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290944, "uuid": "603d8bff-3e1b-4e1b-8090-4d8e5e03d353", "value": "786432:LXf8faiq6HbXGTv+/iBxf6005XWPeDyRYReR357mOS/lspBgHf+7aHnmuHHIzKbb:LfyJjGqqf6FXEeF0R35iFl5H2aHBH/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290944, "uuid": "5728dea5-814b-4314-822c-4d9fdc51f83a", "value": 58685404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290944, "uuid": "8f51b127-f472-4a7b-b1b2-822a016b25f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290944, "uuid": "eafa8428-4657-46cd-a932-3020e9b97ac8", "value": "#Pa$$w0rD__2024--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f7a43c-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315261, "uuid": "e381ddaa-8917-4cbd-8a70-4a5f4113a37b", "comment": "Malware payload (Mirai)", "value": "dd35c2579dc9974c0146d5c4e967509e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315261, "uuid": "9e8dd8d4-4b38-4ba9-af7d-74c9cf9be35b", "comment": "Malware payload (Mirai)", "value": "20c9e5330427b01ca19e17dd1ee1be07d43a9e5a1985ec8f3b02cd52622b032e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315261, "uuid": "b65a4a61-c91b-4674-9cd7-1d6c8387a6b8", "comment": "Malware payload (Mirai)", "value": "fcd8cd6f82d0a5571f0924a2f3601415e0c57233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315261, "uuid": "0026909b-6da3-4e92-b994-ec2b120c4bca", "comment": "Malware payload (Mirai)", "value": "5454b9d53081b503a7e6eae0bfe5e63765653a6993671a0564da139f42c227fcdd96bf7cb98ec28abf5a69331f40aead", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315261, "uuid": "972dce19-514c-4c46-9046-6c2bd868d4d7", "value": "T11C33F1F049CB96B3DBBE0035803E9BCE76725A398B152B32A024531DF7743CA59BD159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315261, "uuid": "fa37b709-e2da-44a6-a319-9b14bae681f8", "value": "1536:uK0yJ7rWjxB/x1dgOPXmFYxKghH/ObUExARF5fJDfH:3WmOvwYxKghfvEI/RDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315261, "uuid": "300461ac-7996-4836-a8d3-8500b70ff4a4", "value": 55044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315261, "uuid": "a14a162e-8467-4c71-a756-9e782bd1a54d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315261, "uuid": "4a33adce-4b4e-4d16-8742-67ab4832d371", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6828c38b-81c1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784280310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280310, "uuid": "b400bfe4-a996-4490-8142-4dd7872f1252", "comment": "Malware payload", "value": "034e4d2957b6c7d2bb00a8997d0cf7b3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280310, "uuid": "d1b62a79-ddbf-40f4-96dd-23d97d40f6f4", "comment": "Malware payload", "value": "21e5d1db878d6830f1830e8f6675250cac209c9d8453617436ce8d1f09c1d9ae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280310, "uuid": "40e083a2-24ba-4f20-afcc-9fd614dad054", "comment": "Malware payload", "value": "008a1d948646b6dac6c8470945d75c0b21f704bd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280310, "uuid": "cd34aac6-5465-4a52-acb6-9ff3788c8730", "comment": "Malware payload", "value": "8251acf3fa933ca4a29982838ce6d54cbbe6569aea18c0bdfe9de0a9fefc736a02a5c25318edddc16d0a22484588dcdb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280310, "uuid": "657bb569-7bac-4bb8-b1ba-fefcdf3798b7", "value": "T14DE633A5DAD4AFC7E0956C3A048D721CD074DD050E3A90513B347DFA62BE27673ABBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280310, "uuid": "9801e574-3697-4fcf-b528-a90bf0227c21", "value": "393216:xYXii00TApFv4SqwUP8GQHgDmbQPJOTI:xYXinRdYTQHB+J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784280310, "uuid": "531e4a8c-9f5d-4659-8fa1-a4e3fdc7d4be", "value": 14913536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784280310, "uuid": "32e2f383-e569-4ec6-9b5e-d128fbcf6551", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280310, "uuid": "6bdfc9de-fb9a-4728-9f6d-4fc221bad31c", "value": "agent.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8c839f-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271992, "uuid": "092b09bf-14e9-4ada-b316-ec8dba41284e", "comment": "Malware payload (Mirai)", "value": "1684c5abd42572f9edec9001a4209c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271992, "uuid": "d7619d1b-2a0c-480e-9412-2bccf5202a3b", "comment": "Malware payload (Mirai)", "value": "21f93d06243b59ccd6ffabee1f3a7139c457174bb213ffe12d537ab3b952dd8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271992, "uuid": "a22bf2ce-f8d3-4635-bfe7-00c7e19ea768", "comment": "Malware payload (Mirai)", "value": "7447345b6b695c897fefdca052fcf04a783a1f53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271992, "uuid": "c1798af9-75fe-4244-810f-d6d9da57d09c", "comment": "Malware payload (Mirai)", "value": "79a4b0a24438baad9134dad0fb35b49ee25f76b105ede9909ea5df97fc280ca53ac942189a7d29eafec114157743a680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271992, "uuid": "0114411e-67f3-443d-b8a2-39b4997d85ea", "value": "T1A2539C73C8296E54D19582B4B871CB781B63B48082471FFA5BD9C2BA9087DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271992, "uuid": "b3ad0441-d94f-4ca2-a093-f2cc3bf454a3", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYPOgpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYGgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271992, "uuid": "99daa3bd-9b6c-43f6-951e-7e2207326c1b", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271992, "uuid": "6e81eff1-7022-430e-89fd-057dfe7370a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271992, "uuid": "97e08971-6a8f-4340-89c6-847199fabab4", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871a45ee-8210-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784314292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314292, "uuid": "dd601f0a-f9a5-4f07-bda8-08c242e7819a", "comment": "Malware payload (Mirai)", "value": "87bc02979417f72922c75e6e6c1fee31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314292, "uuid": "11e0c7cd-8dca-469a-80b1-c20f23cadaac", "comment": "Malware payload (Mirai)", "value": "2206016e172f3396d04a228f70de8be81ae5acbb2c9d67b497611168a424c14a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314292, "uuid": "ffbce655-233b-42c3-82e4-07ed61387c83", "comment": "Malware payload (Mirai)", "value": "a623dbd6e032ba0df23071c7b291fc4e0a44c4e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314292, "uuid": "7eba52c5-71c4-4100-8375-328812a793a0", "comment": "Malware payload (Mirai)", "value": "11de55cc64bff6b9e5ee6d167138b78f364e19e7e954d484f214b3f282bea315f57b9d77de777f676ab468edbe512830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314292, "uuid": "75da67f5-c55c-4367-aef1-61cdc09ddbd9", "value": "T11DC31959FC819A12C6C216BBFA5F82CC772623A8E3EB3117CD155F2537CB81A0E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314292, "uuid": "da82a7a8-370b-47f1-ab1b-b18f11136f1e", "value": "3072:cyO8faq1CKJjACV0QrbEcItrpOZz/nbX:cyO8fz1DklQscIhpazzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314292, "uuid": "3fe8df4c-4141-4d60-815a-a84264eef44b", "value": 124236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314292, "uuid": "685461bb-c02e-40a5-b20c-a43309ad2647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314292, "uuid": "a206d5e6-af0d-4ea9-b885-7335dedc8019", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8b465d-8179-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784249450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249450, "uuid": "40e831bb-2035-463b-8c0d-ba404d86d84f", "comment": "Malware payload", "value": "da700c693bc248d9fd5bd934ac1f8bf9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249450, "uuid": "6123afea-05c5-44e5-afa5-a1378ba7b8d0", "comment": "Malware payload", "value": "23ce81ebe09d6028b0e8259073855ef820e38f0107f4d6381bed182535095822", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249450, "uuid": "c1e0807c-7b0b-4cbe-850e-c73e22d11272", "comment": "Malware payload", "value": "a90e30a99998a0f6585982cf77c85df2f9494aba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249450, "uuid": "a2a34066-4838-4008-81e2-1445882c4dfa", "comment": "Malware payload", "value": "cee6f984d543564ba1c3086bdb855bee7485b726069a480cd370b75b0e2989a9214657b1a351ec3d229c663474fdc191", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249450, "uuid": "9d0debc5-2091-4447-b5cc-2f3243c1d87a", "value": "T15E235C512A857C14AA98C8371D7F2F0CB9A943E6324452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249450, "uuid": "d9303904-a967-4947-8717-b9516245ab39", "value": "768:hQFWzZx5/W9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:akzZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249450, "uuid": "6e664060-bb84-4d97-8e52-2ef58d84022f", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249450, "uuid": "3ea7a906-7242-4e3a-8294-37720bc5dd0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249450, "uuid": "19e16665-7d9d-4a5f-8fd2-31a42de4d63b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb2ddc9-817d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784251274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251274, "uuid": "ea61f995-c587-4afb-a5be-3725318db88e", "comment": "Malware payload", "value": "35d5d50f26ee5b4efe6d1896cd843134", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251274, "uuid": "38eacc06-38aa-4359-829c-c188e59677d2", "comment": "Malware payload", "value": "24c693f26a9b6a79dfbb2622ccf7f3a15748a31b60ebafa3930252efa591dc52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251274, "uuid": "95430428-c3a2-4fbd-841c-7b5b4f0cf356", "comment": "Malware payload", "value": "905a5aaa8491af69e080e7e30b7fd533eb953dd2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251274, "uuid": "bc1bf33e-1117-4fe0-8146-46f88872aae5", "comment": "Malware payload", "value": "3d65cfffe6559a1efb06ba5d740b179f6930cff26ea0cf8e04667a474f43af9875296e70a3a73d321d0deaaa732956e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251274, "uuid": "e6e48147-8f59-46f8-948e-f7ee3f43da39", "value": "T1EDD097B3307B023A28BE0C81F0C6EC60F006C73F6D96C288BA0328706E64219F9C0B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251274, "uuid": "034f3bbe-0bf5-4ae1-a82a-d6dfbada9c27", "value": "6:hTmI+6/2rtosBkXzF/FvqAulNXYq9DG+NjVsNXYrkJ:Vu6/xD5BqPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784251274, "uuid": "42e4cd03-afc9-482e-b85e-5a634a44e07b", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784251274, "uuid": "b23c77ed-eb33-42e6-8a35-39632d26ac97", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251274, "uuid": "b0040dae-f0ce-40fe-ae9f-118c44d0bf45", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3126da36-81d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1784288378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288378, "uuid": "f81e7d4c-499d-42f0-8c5f-e0c9eed358cc", "comment": "Malware payload (Formbook)", "value": "87bbaac098c22beb0c40621967a1573e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288378, "uuid": "38e60a48-52b7-4662-9342-eca67028b233", "comment": "Malware payload (Formbook)", "value": "24de9e8109b96df449fcbf9722bccc8dc22c2b666854e53f3974233bd4fb9e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288378, "uuid": "ed01a152-2c9d-4f03-8f4a-c7155f538325", "comment": "Malware payload (Formbook)", "value": "870236e97a76f7ce35ec0600a78807358d524525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288378, "uuid": "3d0905c4-67b8-491e-a6a9-5c831ea420a4", "comment": "Malware payload (Formbook)", "value": "dfc6afaafec51ce6646b1c226f1ac067d1e58359c08fc701f6bd3b28879ef87ad8cad2b2ec48e49f05f9194631bf4bda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288378, "uuid": "77eecb77-964b-4bec-867d-4833fbd601d6", "value": "T11D54222A1B24DF27E98E8B384C4E236FC5D09BB8756AD95343352FAF305A4D50862F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288378, "uuid": "7e1077b4-99d9-41be-955a-de7bdaadb81e", "value": "6144:sMs+HNuejqUuNVPVjvvZODbgwHLL/RPlCxYr2J48/M2u2g57QgO:XVbuz7MgwHv552z/M2uT57Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288378, "uuid": "80b3e651-2394-49cc-8f16-de684a4019c0", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288378, "uuid": "9eb0b261-d723-4173-a799-efd90431a6af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288378, "uuid": "0ba566ab-4810-4ac6-b9eb-50b43dfe5bab", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e87e5c-81ff-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784307149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307149, "uuid": "ac03d6c9-25e4-4bae-b729-61b321ee3848", "comment": "Malware payload", "value": "02e30d46992271f2715334b05f3ff0f3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307149, "uuid": "af1cc40b-0a3e-463d-95a9-22e7b132d691", "comment": "Malware payload", "value": "259bf007e7d2e4ff4c35e611aa94978051d0b36de44a3e04fa453d453d15cb97", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307149, "uuid": "cd5e3c98-3889-4b58-b484-36ee3db56dcb", "comment": "Malware payload", "value": "48297bf9f3e593323ff996d8f73d0a53047e5de1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307149, "uuid": "7b24127c-9e68-4b8a-a416-34e255cc6cbe", "comment": "Malware payload", "value": "1006f40f28e4dfad8b82690adc27479b7c15b20f24a4d1e048e3b60e4fc9d3076af93d479ad101f168273ce150167b3e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307149, "uuid": "78290be3-8810-4339-9482-49703f721caf", "value": "T1BAE6334CA9E117FEDA735034DAF22B93D9ACB4AA0336C6CF477486523D632D04E39166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307149, "uuid": "c99a0c0b-5f26-4ab8-9c8e-5d05a13a82b0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307149, "uuid": "7db2c31a-e4ed-4402-bceb-0f6158a3514a", "value": "196608:HpYhLdJDbSLa1KijLHgkikYE8nXMCHGLLc54i1wN+MC2PIcu9KYK39sI3PPGTMr/:HpQLzG4AaYEkXMCHWUjXBcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784307149, "uuid": "f0a117cd-2395-4247-9681-9e69149fc32a", "value": 14323334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784307149, "uuid": "5c4bdf28-76f1-4f0c-a9e2-95fa2035ab80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307149, "uuid": "d7dd8acc-8fce-4027-b9ca-61a8f26667fb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096a4157-81de-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1784292606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292606, "uuid": "7620a6ad-c1d8-47e3-b23e-872e03b9519f", "comment": "Malware payload (njrat)", "value": "250038d713bb19b4dd5927b4d5a58c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292606, "uuid": "419a645e-cc45-45fa-9134-d8ff2fc2d642", "comment": "Malware payload (njrat)", "value": "26d0e0fbaae0f40a3f6b48499b09deb1fd3a5287aaf2bacb3f23586c75e8ab4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292606, "uuid": "c777b83b-d997-4050-b269-2dbb393c3a85", "comment": "Malware payload (njrat)", "value": "150ef30a5ceab618654f04f2de422f2f85b37ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292606, "uuid": "17477262-55be-4155-b539-8854256ba587", "comment": "Malware payload (njrat)", "value": "1e61ebaef5d66c8547d8d687073bf8b86f33f7db8492efbac373786f8bad1af9c051411a0e2b02841b550d5b6040b6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292606, "uuid": "516a4eb0-1348-453d-86d1-70387f41fd99", "value": "T142B2094A3FA88C55C4BC26F4C575965003B099470412EE2A8CE574CBFFB3AD66D48AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292606, "uuid": "e810b280-0b5f-4a82-b560-05ae1c008f5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292606, "uuid": "00152bdc-5954-4dc9-9eae-9c556b28a4f3", "value": "384:aQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZOgPq:F5yBVd7RpcnuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784292606, "uuid": "e7c992c1-9e00-4769-91da-27f1d26e3ecc", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784292606, "uuid": "bdd3229b-9adf-4bc7-943a-a4c2334339ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292606, "uuid": "c12c3300-c814-4398-ab7a-a338d09fd751", "value": "250038D713BB19B4DD5927B4D5A58C7A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f66998e-81ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271356, "uuid": "8d6c60f7-a064-4799-a248-a184c9d06096", "comment": "Malware payload (Mirai)", "value": "6dc73ec570db0810e26bfe95ac1b563e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271356, "uuid": "5cc99573-aee7-42f8-a8df-6c3502f698bd", "comment": "Malware payload (Mirai)", "value": "26f397197fa3d512411082110358d2c73d15e5bf2dda834a51fb93251c770445", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271356, "uuid": "ed6b53f0-c4c0-41c2-8341-f5ba63e40017", "comment": "Malware payload (Mirai)", "value": "0019f3a6a7b3a3704dde8ce37fab383db8dc30bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271356, "uuid": "3d185a95-b901-4078-90d9-b487e0dbeee3", "comment": "Malware payload (Mirai)", "value": "6636013b419324125f7f5cc355f1c3ab40ca3a74d44ece0589d443b53dd65525049852520cbb484cfcf8f0397d80034b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271356, "uuid": "eaa82902-2110-4317-a801-d3e8da7cc77b", "value": "T1EEB35C02731C0B47D5530DB42E3B5BF193BA69A121F8FA49290E9B1997B1E365183FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271356, "uuid": "a64be406-de64-43db-928d-d7589c64a490", "value": "1536:cLZU+Xofn/yNTWmukkQYxnMNEd/6Wcm8KJn6Y+Nq9YDX3CO5+CormKSSOwIe/v:crTtYYEJ6E7n6fX3Cg+rl7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271356, "uuid": "ce6014b7-fe39-41be-8ee1-f9fa7ea1b884", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271356, "uuid": "b5b37e6c-8306-4af5-8d37-a1978f304b84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271356, "uuid": "50acc74a-7bd0-405a-9336-5d99a7dc8fff", "value": "nerv.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e79705e-8190-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784259168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259168, "uuid": "37059ab0-b404-4978-aadb-581757ac11d9", "comment": "Malware payload (RemcosRAT)", "value": "3046299828205d546b0710ca26ba3229", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259168, "uuid": "d1107215-42b0-4209-88ba-fc188cb85a39", "comment": "Malware payload (RemcosRAT)", "value": "276986727cd341d97eecd625486862c423563b36038e6226ae0ea5a40c47f78d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259168, "uuid": "dd5325f8-8ac9-41fe-9c39-d5d2ecce188e", "comment": "Malware payload (RemcosRAT)", "value": "80de241f8905c157e2a31171c80860e7f5b62a53", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259168, "uuid": "07a81201-df84-4b45-aac7-19f5155d1ac4", "comment": "Malware payload (RemcosRAT)", "value": "8c384ec81072338756b0dd4a2c6d9286aa958b58cb4df6ab9b686bad362ae9276d4461abfe42323ba4c166d242c5699f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259168, "uuid": "a4bc7391-ff7d-4f95-a1ce-ff346d30b72d", "value": "T135C24C93BF8504D749CF11B789BC0F56885CC6C581737CA4EFEC7B59C845A1C21A891E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259168, "uuid": "f3abf820-d0cf-401a-b8e8-b43b2e05d02a", "value": "768:m4zYfWOYJvxv7R9rd5rhier1m2f3i1kFNwnynWeYstRH:kOhxD9i+1Zfy1kFNWyzvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784259168, "uuid": "eb9c305f-da00-4ec4-ae18-3ad568e38c05", "value": 25805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784259168, "uuid": "9dbcfccb-82cc-43be-8588-097c60973276", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259168, "uuid": "f1b276ba-ab41-411b-8c69-932d29b738ea", "value": "EGPL-476-2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe3fa51-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311300, "uuid": "c15bfa08-2b09-4ab3-afb8-d86fa9c7192e", "comment": "Malware payload (Mirai)", "value": "dc2db281715c002400c094b72d0ec6cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311300, "uuid": "c0f345ec-e78a-4a19-8f30-a1d77193e282", "comment": "Malware payload (Mirai)", "value": "283a4909f7def8f3e7d4bb0cd1812bc35fa95728f2b044a459075292f408a89c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311300, "uuid": "62b9c486-551c-44f4-954f-f992f321435d", "comment": "Malware payload (Mirai)", "value": "f869b427a27702f489fceb2692654e33cefaaabc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311300, "uuid": "6eca56e2-0e4f-4c35-8c5c-7373e8c0e464", "comment": "Malware payload (Mirai)", "value": "4f6af00796777f1a40d08848e0975e95c4aa7cd201bffe34f46424a868ebada44187cd2824c33462d2f19208b76d6fbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311300, "uuid": "fbfd4f34-96d0-4da9-96f8-2a66a3f96a6c", "value": "T1EC33F27427995C24C0A68D31ED3DCB5FF18BE53FDAF984821313086271EBAA924B5D0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311300, "uuid": "053543cf-e2b1-43e0-b836-067916abc124", "value": "1536:WVErMfbMMOEES27fyInSPmQz7pPCA94eOJKazd:WVErMfg/BTnxQXpPV4Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311300, "uuid": "c2152ac5-41fb-41e0-b890-64c2f28a1ddc", "value": 50636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311300, "uuid": "44b80769-0152-4cf5-916d-f5e7c7762fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311300, "uuid": "f3eca425-0c41-4b97-a18d-911b47e0142a", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab80638-8180-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252450, "uuid": "b88db5d8-bd7b-41a2-96fa-cda80159f074", "comment": "Malware payload (Mirai)", "value": "6cfabb89d39470e519460c28e0d1c338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252450, "uuid": "4a264f74-931f-49e9-8428-f6fcad96f2b4", "comment": "Malware payload (Mirai)", "value": "2a1776c73595bcee6974802751eff6d9c579b1ce189909a74bce7ab6128d7a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252450, "uuid": "b2a8297f-c4b4-4b5d-bdd4-6653eba87bd4", "comment": "Malware payload (Mirai)", "value": "b8a5e59bafd11839c1e5691d5a65b8dc2da66ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252450, "uuid": "f0263900-b0e8-4124-9a6f-bf0bca166d36", "comment": "Malware payload (Mirai)", "value": "35585366a5a00c5c190c05fa1fbd6af741eb14ab946f3a410dd517b552f3d675027f062884148de363f557c98d4bfb6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252450, "uuid": "a530c231-64b0-49e2-a01a-f4d04be6eaf3", "value": "T16533F1EBD62B78C1CA7C99BD95EDAB746B5120F17223578CC7A51C4D530A7F82A4A00C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252450, "uuid": "0e430e07-76b0-47d6-82fc-0968f7e02a14", "value": "768:c4MsSKFz9Q3V71gRjZ6G7wxPiix0RGuoFhrzwexQa0fvIY0JjKE67PMHN154RWW+:/FFOh157E81u+Wex5MX0J+E6Ax48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252450, "uuid": "77866160-aee1-454e-97c5-816cdc4e781d", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252450, "uuid": "40cbaa59-8cd2-4d45-b0a5-0ecdae905f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252450, "uuid": "7666f85f-13f7-4db3-8498-ba8eca93b608", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b01cab-81a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784268499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268499, "uuid": "ccd80673-b612-496a-bfdb-79a12ba85fd3", "comment": "Malware payload", "value": "3739572ef9696f8765ed5fcb6fb242bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268499, "uuid": "4907746a-c94b-4be4-b47c-e897314986c9", "comment": "Malware payload", "value": "2ab3078e5418b2958891768928971a64df874a860f1063bdd5b4fcbc80687487", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268499, "uuid": "dd9433fc-a0cf-44ae-8f88-f30be8ed231e", "comment": "Malware payload", "value": "cd48b889abb2db6c4a0ceee417be9820d798f227", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268499, "uuid": "d0ed74f8-7980-4a2c-bd0e-b7a89528a781", "comment": "Malware payload", "value": "ee00463644cc2fab989688c324f9e8c8359d094637fade4f6a0c8c29f3d11f42dfcaf2160e8f77c694e5344905a37a1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268499, "uuid": "40bdb306-6fe6-4919-93a1-b58638f6ce89", "value": "T1C5236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268499, "uuid": "3f5d9431-87b1-4f4f-bd36-6b8b71f27942", "value": "768:hXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:blxrcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268499, "uuid": "e355cbbc-326b-4fed-b78d-438b1bb6c8e6", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268499, "uuid": "5c8f6c01-1760-4992-b79e-a1c8fa0ff2db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268499, "uuid": "80adb631-134e-4514-85e0-3b8c130f053c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a502df42-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267097, "uuid": "b672a066-7699-4829-9870-a837dd54e21e", "comment": "Malware payload (Mirai)", "value": "27e581c96d556c220aa44cb5e223ce53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267097, "uuid": "3be5bace-934a-4050-974d-12ab51a9950a", "comment": "Malware payload (Mirai)", "value": "2b797d49c263a1b7096519618da1348ebc6752183c306dade29aacc6c2ca9582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267097, "uuid": "5494a3b8-7589-4992-9ee1-28fe12e3941b", "comment": "Malware payload (Mirai)", "value": "d2316ecff689265abdd015657288bdb513debc9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267097, "uuid": "3eca3ca1-e184-4ee2-906e-9f396aaa8600", "comment": "Malware payload (Mirai)", "value": "db1c52ed2d4c72f103c1b4a3b739b52cd66db3e96d5b261a3d020205098a71b8c6971edc48326dcd17f782178981d390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267097, "uuid": "df674c20-ab54-46f9-973a-a6f710729c6e", "value": "T16A83AC33C93A0E68D84845B4B0B18FB65763E51581972EF7499AC63AD083EDCF58A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267097, "uuid": "4e40ada6-292b-45d0-b10d-2a8af70e6f24", "value": "1536:lgynxf8zTG9xM4BefRQKRPLSkC+RCaR9HnHyW:lxnx39PcR3RXC+Rvdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267097, "uuid": "9ca9d318-9e3f-4d7d-87a3-1031257ee97d", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267097, "uuid": "4834749a-880a-42c0-899b-dfea670141d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267097, "uuid": "c20792b9-c64c-40b7-b076-bbf8001dd066", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3117f2-81de-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CountLoader)", "timestamp": 1784292607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292607, "uuid": "207b3500-1a65-4a92-bad8-9f1162f97214", "comment": "Malware payload (CountLoader)", "value": "2243330efe44f4d866456f72f43f83e9", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "file-hosting-vg", "colour": "#C6A0F0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292607, "uuid": "9e9ae3f4-514a-4f0e-8275-1e8904729815", "comment": "Malware payload (CountLoader)", "value": "2b90df9f31061f1a5d88116ce7e06a2444b0972f8dc163ed078c3b51487b20bc", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "file-hosting-vg", "colour": "#C6A0F0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292607, "uuid": "eca6df91-f08d-4043-b540-e788db098781", "comment": "Malware payload (CountLoader)", "value": "fb4f9659168a4a90f669dccf9368899487d778dc", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "file-hosting-vg", "colour": "#C6A0F0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292607, "uuid": "cec0f6a2-e166-42af-8bd4-67e49d3dcd24", "comment": "Malware payload (CountLoader)", "value": "92874c31a1ec72171a8187c3c055838c76cf9cc978fdfe75a8b7551e70a11ad491af88a96ddae91a55980084aaf9b32d", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "file-hosting-vg", "colour": "#C6A0F0", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292607, "uuid": "d490d91d-baff-4048-b1d7-1a91b30e9f6c", "value": "T11B3422932345E6B8E2CD0BE6AC070925E2F8C815FD9F5189BBB17DCB775AE440874E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292607, "uuid": "001efcf3-6341-4575-bbe4-385fede78a6a", "value": "6144:+ygIWqGrwQr3PFCq2lVP0g7prAWUZOivNybCjGbVdu:83PCztY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784292607, "uuid": "0cb74e8a-e721-49e7-806f-6f90c1bd15aa", "value": 234184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784292607, "uuid": "4a71dc99-a473-4192-ad72-2ce5b54fc13e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292607, "uuid": "c2218cc2-9053-48eb-a00b-d9649a8c45ad", "value": "Summary_Tokyo__23.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab81514b-81de-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784292878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292878, "uuid": "f0f1c814-0475-4846-8c4c-2825d2418d6b", "comment": "Malware payload", "value": "5cc62f3e01ac8c2d35ff5460ea7d7343", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292878, "uuid": "eeb8d78a-f1e1-4240-be10-e22d66a7620a", "comment": "Malware payload", "value": "2bcbcff893cebe512e5a5385e3ffeb31f1fbc1b7b55e82bfc92a9cd9522f681c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292878, "uuid": "706fc1e4-ac3b-42e6-a2b8-43fc7e9b58e1", "comment": "Malware payload", "value": "5665714404a25b858630b1394b1c1bf249345ef1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292878, "uuid": "252dbf2e-2713-4639-b9df-37c13dff5466", "comment": "Malware payload", "value": "af8ed455587af0741d551719f33cf5ee9ba30258673cbbd2400ec28817a9a3741603e8879c78c210e8567c1edffa93e8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292878, "uuid": "47e799f5-7cc0-48ec-b5f6-f97354689b9b", "value": "T14FD097D395A700B804E308A2F2CAA414B948C3BE0C81C41CFF8320301F4634AF4C1384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292878, "uuid": "1269973a-6712-4d61-9754-ac500649083a", "value": "6:hTOs5F+HqykoPs+OriWj/u8mwAulNXYq9DG+NjVsNXYrkJ:VOG9oariWj/zhPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784292878, "uuid": "ba32a9c3-a423-4c55-b5d9-779cff61cd72", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784292878, "uuid": "6e68cc1d-e654-46ea-b0d5-d6e0dca3345f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292878, "uuid": "cd7d8f89-1456-430c-b8bb-c828201e7bf6", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63d89c2-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325189, "uuid": "f3e78c26-ff64-475f-95b2-9ee58531b166", "comment": "Malware payload (Mirai)", "value": "9d048d9393a819f08d7d62bdb37d17d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325189, "uuid": "1952a468-06d9-4248-9406-b794e457fbba", "comment": "Malware payload (Mirai)", "value": "2be1a6dceb7020334d9f70c512a174224e692e9084d8680a56ec03a089c9de78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325189, "uuid": "b10889ae-31cb-4e36-9734-2a47fcdb9521", "comment": "Malware payload (Mirai)", "value": "e4a236eea39cb7c0e179d75dc0a337ae00557b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325189, "uuid": "7dde84e0-87a9-4b8c-b3d0-af9d5ded834b", "comment": "Malware payload (Mirai)", "value": "6b0d9147ed19a0d9031ad665726818eff6a0aee2010b392fed465b59eeeceb7efbdfa1a7c30d075f9ac6b05305a2264c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325189, "uuid": "e28bca1a-590b-4e95-89bd-abfd72a1c7cc", "value": "T1AB633B02B31C0E47D1635DB02A3F27E183BEA99121F4FA89651EDB469676E331186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325189, "uuid": "fd734d25-88a4-44b5-956e-250b97b49902", "value": "1536:5p58ijCznr6P4nZTFrQBSnO0zjAeIhy549KJDUwTAs/UORkf:5sCvPE/lMeIg5p4kRkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325189, "uuid": "8fd34828-d039-4342-b652-9f963bc27adf", "value": 72772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325189, "uuid": "5357a013-7dbd-443f-ada1-f3e5fe175ada", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325189, "uuid": "2662bba5-a113-40c8-ba30-ba0b791dd8d0", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af94c0e0-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311353, "uuid": "adeba186-fd48-4ce8-b5a2-249a5a0d557a", "comment": "Malware payload (Mirai)", "value": "13f5340480191cb2e130d590064c65d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311353, "uuid": "09fa3787-208c-4545-849b-afc4cb5328c5", "comment": "Malware payload (Mirai)", "value": "2c0728ba235631b209dd6d53bd52b44609ea4385a6a8ea7c9a332e9d36fd2896", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311353, "uuid": "0537d818-6bbb-4c13-bbc1-52b4393b8ba4", "comment": "Malware payload (Mirai)", "value": "c2345dd5e5383d5c14c368242dd5eb2550fbe32d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311353, "uuid": "48a7300c-0126-4508-b091-ab67e1b88339", "comment": "Malware payload (Mirai)", "value": "1b5e61990a7e090374fa897e527d2fed3135689caf225946afe119bc6e8330b74ec5c6c8c59682bfa064e856fc890860", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311353, "uuid": "bb8c18b7-cd35-4387-b698-f5cb17396fe7", "value": "T1153301B3F9988421E331093CF9FE8D039A7E6578A0C977196041CFB899E7D92E178252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311353, "uuid": "b8618353-739a-43fa-b8d4-73cacd74483a", "value": "1536:JKo11m6+AguyJI6yQnowFu5IxVWx8QnUcPHM9zR:8Ym6+zur6y8oI6caHsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311353, "uuid": "07aff154-de0e-488c-bfaa-d1a370fa9e90", "value": 52056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311353, "uuid": "da8ba54c-bf3b-409a-a59b-d54fc67e6fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311353, "uuid": "f7700dbd-a029-4334-babf-6c8cd466b8c2", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57b0746-81b7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784276118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276118, "uuid": "f1bbc984-d63c-4c53-8693-d7ca73d550c0", "comment": "Malware payload (WannaCry)", "value": "127d38ee2a015193915c7fbf1028fb66", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276118, "uuid": "108e15dc-4a89-4479-b200-164f4b6c7dbe", "comment": "Malware payload (WannaCry)", "value": "2c2883d25e71c2859b16ac28757e3754f33767931aa98d5a9e705c374818e8f5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276118, "uuid": "f75cfc8a-5688-4c22-a812-3c8eaf77e0dd", "comment": "Malware payload (WannaCry)", "value": "f36158630c2f88e579e1e75444ef24ee1e1e6521", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276118, "uuid": "394eae4e-3d60-4454-87ff-1137a38424ee", "comment": "Malware payload (WannaCry)", "value": "9f82c5349db2c2abb8de9c720152e1b362d9c9052ffdfc78a99792fd3b612490e9d0284d9a1a23e968b10fecb9cb8aed", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276118, "uuid": "7d9b8a18-4b3f-4ad8-b5b5-2bc852e4d3dc", "value": "T1BC95235931BC91BCD106267484B78E23E7B37C5A23FD6A0F4B844AAB0E13755BB64B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276118, "uuid": "0b744078-aab9-4b75-b6c1-99a1c362acb5", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276118, "uuid": "57c1df9b-5296-48a8-aa7e-12e801231969", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6S5:DXDqPoBhz1aRxcSUDk36S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784276118, "uuid": "b550ac6c-92c6-45a2-acb6-6536f6cda1d5", "value": 1935360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784276118, "uuid": "a468c530-cb30-4f9a-9344-b2da8474a662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276118, "uuid": "1d93ee17-78b1-488e-9cec-8959c29c8b3a", "value": "2c2883d25e71c2859b16ac28757e3754f33767931aa98d5a9e705c374818e8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a784d6-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784250425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250425, "uuid": "1d0772de-6a9a-4729-bb55-1330e46afae2", "comment": "Malware payload", "value": "43b96948e81a27c875aa637c5ffb04ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250425, "uuid": "eb5dd2c0-aa33-423a-a7f3-9ad2fa1f6dee", "comment": "Malware payload", "value": "2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250425, "uuid": "0df38191-f0e5-42f6-a47c-9a8ff2817d84", "comment": "Malware payload", "value": "e4cf3ac30b94c0aa93d27912b16c8f63398d72ff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250425, "uuid": "c414781c-c0d9-47b5-9a78-f0d8b847955e", "comment": "Malware payload", "value": "d50547e8cb5225d9f2adde6039d852c23c77800d59c9f2a91c0b3d8c0c0815b21e0ca13b0b81ed347f187d5ce86101f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250425, "uuid": "5b6279fb-637e-4928-b012-3167c5e1a542", "value": "T1EC01CED69500AC2100DE8A1C32971459F820D3CF164A4F38BFAC6E3DEBD8C14B06AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250425, "uuid": "a3b69759-4a64-4b16-ac3d-fd3e649566ea", "value": "24:kXCKysE2hi0ziQvZohah3yzz+/dBMTAnX:e9Qp+Msh3yz6/MTAnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250425, "uuid": "2174a958-86c5-4175-9bd5-bf9875c2ad71", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250425, "uuid": "01f8eca2-85a8-4247-9a07-a976610ea236", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250425, "uuid": "9743c573-db60-45be-966f-7f640aa61b95", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03718de-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "7e29feda-2df2-4bd2-ad8e-eeee13603c26", "comment": "Malware payload (Mirai)", "value": "b0d855396197834fc47b34e8f9b65ca8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "a8f59377-17a6-4890-9194-ffa43b3b29c9", "comment": "Malware payload (Mirai)", "value": "2dfbdf7b8575da1f4b164c1552c0bfa8dac7730aa306fc4a96d452cd2ff182a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "94bf7a9c-4f65-441e-9c24-b035fc73713a", "comment": "Malware payload (Mirai)", "value": "9ded3914b5fad27edaa7cf71f3000e52b054379c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311381, "uuid": "f06136b6-9f85-4e0b-8fd1-03de960884c8", "comment": "Malware payload (Mirai)", "value": "4657c3a08131fa55a223901a4012e50fea73eaa63873cd0d772bcf6a080a83ec17ca2cdf3be9cbe844b73f9656723c91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "72e80e9a-d4d4-43a3-9a34-019735eb1235", "value": "T1B333F13230B22591CCE14ABAFE514F99CAC10BB9D1D67D72295048EC7BBC29957BA403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "d5eec6ba-140f-440f-982b-8223dd29337d", "value": "768:3gVnFK6OkmxlBJNvlwl5N4YjveeOmWqsYOeKxLp8/aW5Yd5Wm9q3UEL/:3g1dLmlBJ4rtL7BKxLG+uL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311381, "uuid": "7786cd51-8a59-45ba-8e6e-850b8dd0a5f4", "value": 53120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311381, "uuid": "ff959a32-e9da-4b65-9973-8d677e3a5b77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311381, "uuid": "bca1f701-1d79-4e9a-8d87-1177b462829c", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532742b2-8177-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248492, "uuid": "71dc5dcf-3b0c-40ce-8bc6-1302f55a6282", "comment": "Malware payload (Mirai)", "value": "deca76e69218e65c5c1b8b92a4ab9483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248492, "uuid": "7428277f-54a3-4c79-9571-e055fa6a1247", "comment": "Malware payload (Mirai)", "value": "2e05529f2e98504b0f04733be686c8628daa6032d56b8726573799aa48e5e0da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248492, "uuid": "27f647ba-b6f4-4315-a758-24bdefb131a2", "comment": "Malware payload (Mirai)", "value": "ecf78e954061b54ce4d78cda4c3f4fc5d1f9d85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248492, "uuid": "7ccb1c23-a420-4654-bbb6-dcbe0c236c86", "comment": "Malware payload (Mirai)", "value": "797a0f8595a6a455615923fb2b970e026c1807595815afedde68630d50e143a6c5ba694ed027f419eeca627ce47f6146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248492, "uuid": "8c1ddcd2-67b3-4eb3-a229-7b14c1e879f6", "value": "T106C34B9AB4019D3DF94FD57B58632D1ABD20A3925183272A639BFD93AC321F47C02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248492, "uuid": "6ad6052c-62a4-44ac-9113-641e6b96d7cd", "value": "3072:XjXiHb1ZoCGRs0rBlpUjeZ5JqieX8KJFLOQs:TSHbPoCGRHqCZrquKJFLOQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248492, "uuid": "06a553aa-55ab-4a5e-a998-f39c91766931", "value": 125920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248492, "uuid": "6d6a213f-7d5a-4716-8b59-f5ec9ee369b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248492, "uuid": "ac58bbaa-fa5f-42b1-a39b-395cd501d82b", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb488744-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784311480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311480, "uuid": "d236a185-6626-4632-bb14-d699cebe50fa", "comment": "Malware payload", "value": "85016d78544f2189294c4230e6afca77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311480, "uuid": "a019d4c4-7645-482a-b261-fa349f6e1cdd", "comment": "Malware payload", "value": "2e3fd53865aa701297229fe699e4c4c2267f37a0ec80f2c30e10ba2371940499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311480, "uuid": "7a688141-1304-4692-8902-ba9c4e3a0a2f", "comment": "Malware payload", "value": "f529f0a0568b6d4916248fcd13eaefafbccfc329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311480, "uuid": "111fda32-8b8b-4183-ba0b-4643a9bb63f8", "comment": "Malware payload", "value": "66fd3ee4d7bc3276b8b8e942a4da1a5aaa43715af49133fcc9c4be682c6fce698528c438d38770a09dce36417cd6c4b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311480, "uuid": "371ab13a-f7a3-4324-ba01-7850f1ebec14", "value": "T1FF146D99E90F2D41F2C6D2F8DE4D8BE13A2730F3D77759B17D1202ADCAA78D98590902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311480, "uuid": "3c222ac0-2f77-49cc-b765-d7bfd4cf491e", "value": "3072:Ka7xOgCImg0YfwSXq7+izog0MCmyxAbcpm/FqQnPt7XDT1QGKKALiMVw7q:/jXe4dmyxnmUQnPt7XniKkiX7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311480, "uuid": "a44ee0fb-5f7d-46b1-8303-c3e8fb6bcef6", "value": 202424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311480, "uuid": "876a7bf4-6e61-4476-ae67-8c09fed3dbaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311480, "uuid": "f1c4a694-ed9a-4590-af08-5af6ce627703", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c120ce8-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284128, "uuid": "6944c480-f3bf-454f-98fa-97f5bacdb820", "comment": "Malware payload (Gafgyt)", "value": "b85649ff0e8286f5f124cddce0246ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284128, "uuid": "582a7e91-4657-46b0-b597-e79473c53c52", "comment": "Malware payload (Gafgyt)", "value": "2eadf5975b78e611ff728fe231e163deff913ec365e987b3a41d6088e1325b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284128, "uuid": "f9ac2b68-802b-4e36-bd72-5dc95f78d131", "comment": "Malware payload (Gafgyt)", "value": "ab4382f7bd3d9d5adb54c16caf083bcc2d622740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284128, "uuid": "4b711e12-e81a-4d2b-a513-1e1c5eee9f30", "comment": "Malware payload (Gafgyt)", "value": "66257c7bbe87bf27ba3e8295c2d6632a72faee854d936778cb5ec98f6971f553424ecbc096fb44befb20d568b820bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284128, "uuid": "ccf569a0-48e5-4693-ac6a-3d437d7d4d98", "value": "T196833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284128, "uuid": "0d8b6b46-0795-4003-a0b2-291213c248aa", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCYdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JjBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284128, "uuid": "cff8620e-2d3c-4242-b4e8-d11adb2853e9", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284128, "uuid": "c2937cf4-7392-4c56-a0e3-028ac353b0d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284128, "uuid": "2f3b0123-e0d7-47f2-bab5-55da556e2f83", "value": "sh4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9657f5d8-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278669, "uuid": "5ed23705-b1f0-40f0-b614-41d3add8ee87", "comment": "Malware payload (SilentNet)", "value": "ef614d718f633fe66f38ee876f826920", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278669, "uuid": "622a18a0-8a96-4ee6-801c-e6814e04bf33", "comment": "Malware payload (SilentNet)", "value": "2ef16781598a523f4a0a635e19314be9958839e920867427c6fff22f15e71dc1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278669, "uuid": "d6378001-2917-458e-b30a-8d11652511c3", "comment": "Malware payload (SilentNet)", "value": "a9f561b33c7123c28ade64a53999b73981877735", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278669, "uuid": "a4627231-48d4-4c8d-b3b2-5ed35bf0ff0c", "comment": "Malware payload (SilentNet)", "value": "ef2720ac2c6d001b366dfdcbab65f3fab2e7da069d1d8d81082ec51d9bda25d3250d70e6bb25ff58d6768bbf4a4249f9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278669, "uuid": "604c9da3-669a-4629-9a11-60b8bfc6b317", "value": "T17193023BBBA1C806CE40183D25A9D96569FCD5D2706B3E7C3EC6CDCD068CD696C82CA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278669, "uuid": "e1b77270-3ce0-4212-ada3-1a4a05002c29", "value": "1536:IRNE5MQXJpkeekfKp2xiGLrME/C4zLa+o7j1IP9YbUQoAW3Ghk2fBRVUxjXbmVfO:I0CQXJp1flxoE/FK7iSIQVW3GhkCRVap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278669, "uuid": "79779d10-cea4-4522-b4e4-0bef34884482", "value": 91343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278669, "uuid": "300f2335-5b09-4b9a-bbbe-e02c25cdce99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278669, "uuid": "6155c993-9a22-4e60-bdc4-af6d37d94462", "value": "Krypton-Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69e0442-8218-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784317861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317861, "uuid": "ca151599-7686-47e3-be1d-234afa2cdf4a", "comment": "Malware payload (Mirai)", "value": "e10807f8afdccbe07d4ad36ec312debe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317861, "uuid": "c73525cb-2a2d-450a-80c0-fdbe528121bb", "comment": "Malware payload (Mirai)", "value": "2f424aa64a90cf58b3cd24164d8f866d4b08f1bc15f059863b5f2d52c7bf593a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317861, "uuid": "f7a66eb0-2f6d-4489-a601-ed8ed9b55ff9", "comment": "Malware payload (Mirai)", "value": "1176fd18e19f8185a0ed44aa874ed7492341508d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317861, "uuid": "725aa3a1-2153-4443-be9a-8556f8f6b6a2", "comment": "Malware payload (Mirai)", "value": "e1b1863f9c22539d26eb699e8a902bbd41b44d308c65353492cfc36493f91bf37a87d4cadf5736098b61aec9a3390df3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317861, "uuid": "ed55d989-d0a7-4de0-bd92-cf8ab46c07fe", "value": "T104041A4F7710CF61D36DD93049B38B9656A922522AE2884AF35CDE083E2434D792FFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317861, "uuid": "8ef33887-8d4d-4172-b904-e3ee6e41a64c", "value": "3072:7dh0R5Zr4n61Zifez/zzBMwMCejGYMmgVJ1DZjrg:jI5Z0ncueDzzK1i1xVPJrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317861, "uuid": "70bf8254-738c-4313-8218-3eccd6f8b6a4", "value": 184620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317861, "uuid": "cd79e475-89c8-4ed6-8242-17da9873e324", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317861, "uuid": "135956e1-d635-433a-a1b3-041772120d76", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cf9260-820d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784313140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313140, "uuid": "7bac1a8c-19b3-477d-9ee8-e927bd8fe61c", "comment": "Malware payload (Vidar)", "value": "cf4866e9f6c60a4b253de4bb85f4da90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313140, "uuid": "da0fd350-009d-4499-88fb-aa0dccb71f77", "comment": "Malware payload (Vidar)", "value": "2fdcac512cef51c5b0d8a4fb23c278b973d20978aab5d463abbe131dd04879a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313140, "uuid": "bedf3738-cd14-4e63-88dc-a74308152828", "comment": "Malware payload (Vidar)", "value": "3ec44d141f4d08ada015759eb2c5c79d76b53c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313140, "uuid": "058dcedf-f2cb-4ea4-a549-79cbe90aafc2", "comment": "Malware payload (Vidar)", "value": "2547077de47a979890b0f4ed8cfc04d4f5f217ae2847cdb5c4e58b8ca1652aea6b47c8e782510f766168c29d099a2125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313140, "uuid": "954922f9-efed-48ce-ac5f-1ad0c256e8cb", "value": "T161F58C17ACA148FAD49AA331887292467774BC091B3573E72E90BB783F727D09E35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313140, "uuid": "1223e803-a14e-4ee8-a96e-5a411b3dc56e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313140, "uuid": "a6ef5534-4b95-448e-821d-7da30fec704e", "value": "98304:4L5oAypfKSn1Ue9UFjJeDYy3J79xqSxivJ07O6SPnL+nchdIOO7CUer/kEII:4R2NNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313140, "uuid": "aee76e23-bdf7-4b2f-b0ad-c12645691ed1", "value": 3633504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313140, "uuid": "3a17332a-c936-4489-bc2d-313c6595b2fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313140, "uuid": "05dc80f8-8d85-403a-851d-f2ab92ecfb48", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff32ea9-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784312589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312589, "uuid": "690021fb-63ca-4956-87e8-f27e07e2f512", "comment": "Malware payload", "value": "a4867ab4e3285fc0c1f5ff5a2d64f7bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312589, "uuid": "f8c4b532-376b-4d4a-9464-3ac46fb308d1", "comment": "Malware payload", "value": "30d0bdfd0d875235474e7a1cb9fc4396bbc1e81452cf58db92467fe00fa994a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312589, "uuid": "3cd33795-71fa-4f3f-b941-cde8e55553a8", "comment": "Malware payload", "value": "65b13886d3a28aaaeaa428fc9bf01bbb7b47bb25", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312589, "uuid": "92f00efe-6a23-4fa2-8dc0-542e3cfc9fd7", "comment": "Malware payload", "value": "5a881bb4b6dfcbeeca88f0d4108413b525cdfc000b854be0575e9aebe81da34ef28ce11443e0d9a3a1d4ebad57961018", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312589, "uuid": "6437b9cd-b1ad-497a-abca-e91b0522e1b0", "value": "T198236C651A857C14AA99C4371D7F2F0CB9AD43E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312589, "uuid": "9ffa6032-32e3-402f-8ee6-7ee4d17481b5", "value": "768:BZlVEJVIhtMX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:BZrEJ2Mgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312589, "uuid": "4e0f4376-6d8a-4fdb-ab97-9d36eb8e7388", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312589, "uuid": "0df8fddb-803c-441f-8256-4c6ab073cdfc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312589, "uuid": "83fd3bbd-1d72-4403-b04b-32443d1570de", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c32d07-820f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784313971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313971, "uuid": "8817f8d3-e5c6-4e23-b09c-0a5f31638d10", "comment": "Malware payload", "value": "e476c18b475d05def1cdb6937c4e64e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313971, "uuid": "4e5fbda9-9e6e-4c5b-86bb-a08e9214c0fc", "comment": "Malware payload", "value": "30d87db6fc7d389cc45049828afe518c061f8988402b68ee131ead7fb84c01b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313971, "uuid": "4a57f87f-fb04-4454-b34c-d5ab4e2b7696", "comment": "Malware payload", "value": "bad4d716b993d0b31409de61d09aa7a1fbf43ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313971, "uuid": "7fa9993b-12f5-4dc2-bbf7-b4c7e72f4ade", "comment": "Malware payload", "value": "a341b645fa934577201207f0c1ca6945a5689bbb55c9aa686288ee98e87d6805a5c2833698a220609c4c12c451ec956c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313971, "uuid": "6971576e-2d16-40d1-99c7-3ec2dac0e394", "value": "T1F6855C17FB7284E8C55AC1B48662D7B2AA30FC284634B91F29D4EB323F52DD08F5E654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313971, "uuid": "14420acc-693b-4dfa-94e3-771948dfd0c1", "value": "efe549471217f6ff903a24964b0fb16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313971, "uuid": "80c2993c-f89f-4583-9955-54b16e8c5e9a", "value": "24576:ucLVIz7cqXpc76S8Rezxdo11manIhD4fs8bIr/HQ13vjcNsIx:ucLVI0qXg6S8Ezxdo1UanSoBjcN3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313971, "uuid": "acd18612-6a38-4e31-bfba-4df49094acc8", "value": 1735496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313971, "uuid": "c0b42f58-fb54-458a-b97a-11b872b6f4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313971, "uuid": "b9e43983-cde6-4475-9b10-623978d7a26b", "value": "Unix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671260c6-81b3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PlugX)", "timestamp": 1784274295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274295, "uuid": "9399e61f-6384-44b3-9ef2-0818c3ff59b7", "comment": "Malware payload (PlugX)", "value": "b8df9a2c000cd9ba4708b646b9547393", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274295, "uuid": "9f2a095d-fd99-4cc4-9f34-e99c17420384", "comment": "Malware payload (PlugX)", "value": "32391ce6eca836369cfd5b3948ba978b7982dd3a85b81bb33c973773adeaef01", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274295, "uuid": "a26857d5-7a1d-4d55-a4d1-9c6e87fa7e71", "comment": "Malware payload (PlugX)", "value": "dc7dc30c84ed390ce63f6fe457ab743ace69082e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274295, "uuid": "1dfe2cf6-508a-4724-b224-c887b0d65dd1", "comment": "Malware payload (PlugX)", "value": "4ef2d14d95b582369a1b5fe80f964eb24b03c1d8e97738575c408d4bba1073ec9e44552ca65a9fb565480a1d66ba609b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274295, "uuid": "6ad2b5c7-3dad-4255-ba59-c565760c267a", "value": "T15F76E4D2E86F42D3E8520633C5BC6B6CD31D6D38BE910067F14B3E15A63E64939AC52B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274295, "uuid": "37e6509f-05ec-48f9-915e-c11341a9b4f7", "value": "98304:5fkfDu3M/Gxd2GwI8/AnVBmwka9tDAj0nHFFLOAkGkzdnEVomFHKnP8Y+Iym2sx3:5Gyzxd2191RgdFLOyomFHKnPysJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274295, "uuid": "3b0c859a-6f8e-4fc7-a36d-176340088c8e", "value": 7727670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274295, "uuid": "4e1ef5f3-731c-49db-bc91-95543cbbc842", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274295, "uuid": "fb5402de-c607-4a9f-b15c-9e3a92848773", "value": "Tin_buo\u0302\u0300n_PG\u0110_Co\u0302ng_ty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0695e9e3-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311499, "uuid": "31ccd246-6b46-4661-b807-32e844160472", "comment": "Malware payload (Mirai)", "value": "696bef93003cf5d6cf02803f3d669a00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311499, "uuid": "66cd889d-4f6b-4172-b6b7-161163dcb2b3", "comment": "Malware payload (Mirai)", "value": "3261cadb8a3ad85663f7902b650831062fda1c0d14906f2661d5cb47aad32453", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311499, "uuid": "cea211bd-f301-48bd-9d38-9a7907546350", "comment": "Malware payload (Mirai)", "value": "e26aeb4b574455a95ef1fc2bd48fcad418aa2bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311499, "uuid": "93efd311-8d47-4a1a-87c8-83fefcb1745f", "comment": "Malware payload (Mirai)", "value": "1392d304de2a7ff156c70027e10f2d2d68e052f8df2213222a9eef1ba18321c04060b9dd4b21a5981e2076cab3799d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311499, "uuid": "4f074707-0357-4285-87a6-b3c1ab9193fc", "value": "T129935B8AF687E1F0CC0609B0117FF73A9731AD312130DE6BD7D8BD63ADA2642945926D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311499, "uuid": "2662c598-091a-4c8c-bfda-cf363af9d8a2", "value": "1536:7f5zfbfrfrfKfdfkfZ5JPIcfalCDpERJoK9rvUm31cbr4Ow2InYr:L9jzzCh4ZPwcfBDpJKfObiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311499, "uuid": "97bd7a97-4c96-4ec5-a052-d3cb8fa4b568", "value": 90752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311499, "uuid": "e0601c2a-94be-4cc4-81ea-4751f8f42c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311499, "uuid": "bd996d3b-d066-4bc9-812e-f7d0490797a8", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb0911e-8215-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784316531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316531, "uuid": "c47fce6b-6671-4c93-ab75-4b58d2f32536", "comment": "Malware payload", "value": "58f059277965f439bed40e9a038ad2d1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316531, "uuid": "74670b87-c9bb-4d12-956c-5579bbf01ae1", "comment": "Malware payload", "value": "3309450498daff8df885b200d3e5fbf7e6346979085d2fd0a69410925917c10d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316531, "uuid": "60d2d0d2-20e9-4721-83f0-0840cacfbebf", "comment": "Malware payload", "value": "667eb155a9153af159fee435b986febc45a53d80", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316531, "uuid": "8cf0ece7-17f2-4d78-b691-e340ee6854a1", "comment": "Malware payload", "value": "1a8c0a7eac00ae2ad0f065fbaf60eb2779e2882a11231099be2de91d59edbbe0e3d7946213ae7e046cd6ec681d873a92", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316531, "uuid": "172ad2a5-8ea3-4531-9f6d-671a97a886f9", "value": "T144F1773DCAB5FDC4436F72D05AAA3B46209C1B23FBB54B6CFAC208691814649DF3A54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316531, "uuid": "2887cdb2-14c6-44e4-a548-2eaca16bb04c", "value": "192:PvLvZuRs0PGI2/MCju6tCAABQGb5CtiHhwG7jVsS2KoYoWL:nLxuG0PB2/Mp6MAAB3sWhwGuS2PY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784316531, "uuid": "61c8bfc9-4a24-423b-8b7d-63ee88904e44", "value": 8170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784316531, "uuid": "73506509-481f-4320-b9dd-318c2b50325c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316531, "uuid": "d90ba0d2-8050-4723-8eda-0c326046fdf2", "value": "73tedupXUiHwXXhQ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bef61d-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325141, "uuid": "16fb16ef-7b86-4333-958e-ce7af1873a99", "comment": "Malware payload (Mirai)", "value": "b1461ce59c5a1f52d30157a7dd140e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325141, "uuid": "74209957-180f-40df-ac27-1e07c44a5333", "comment": "Malware payload (Mirai)", "value": "331091d35177773e4b7fdc474b472e80a503a49cb03920622c1dcf2220080624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325141, "uuid": "9cde93dc-8226-4d19-b701-78ab084b214a", "comment": "Malware payload (Mirai)", "value": "ce288a6c8f39133c529d9f0e8d9ee6b2c529b680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325141, "uuid": "f9c3cf4b-828a-47d1-9ba3-18dfbc051a7c", "comment": "Malware payload (Mirai)", "value": "898dfe26caf79e863c9adebb3ede90aff59d980c73e4db0b6cfcee601d16c03df89f7a019426a0121f7bfaf925389b33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325141, "uuid": "5dce23be-9c45-4e82-b7f4-a55c8740cf7f", "value": "T11D832AD7F400DDBDF80AD77B44630906B231A39116831F36A79BBA63FD321A45966EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325141, "uuid": "2d278d5c-9085-4a62-bc83-d56475dde2b8", "value": "1536:wRGLxlgbULdD/0XF7r8FXrl1Xw/LmebZJTX+F2AG1K0tkXf/:wRGdlf5/0XF7yTgLLbz6G1K6a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325141, "uuid": "924d5b39-1175-4219-ab31-92fb894dcb1f", "value": 81720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325141, "uuid": "b1fea370-4911-4b85-ad35-0e4391feb1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325141, "uuid": "e11c223f-bc2b-46ae-b6d6-1b0229472072", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b92f711-81c5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784281953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281953, "uuid": "31a62b08-029f-48aa-9c07-df0d5e035b66", "comment": "Malware payload", "value": "a6b633a866f9a2c3a1ae3f519beca06f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281953, "uuid": "92ea8173-b880-4ae3-a3bc-931616dc89b6", "comment": "Malware payload", "value": "33d74b754a992eedc1eb2a0758fd6dfe0e29208b72147fb5c613d66640de086e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281953, "uuid": "3e00c904-1392-4504-b143-0cfa91cb6132", "comment": "Malware payload", "value": "d22e4fd961a8437d79e2b414eb82647c4f507135", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281953, "uuid": "c411f744-edcb-4760-9a68-55db2fe98087", "comment": "Malware payload", "value": "67dcb3e18bebc2d439c77c934e9af856820df8db1fabea4ea369c981534dba4e54ee39758197d3ecec30fbfd206186e4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281953, "uuid": "ba82ff85-20e7-4e1a-97ad-c7c56e61775b", "value": "T14CE6330C56E502EEE663413CDEA15AA9F5A878328B70CBDF075487F26D231D0993BF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281953, "uuid": "9f136355-ad0f-4e94-ada8-60b331450cb8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281953, "uuid": "d3531ab7-7d9c-439e-bbeb-2c50f7c25611", "value": "393216:QXPuJ0LGW+HRmaa3LJ4raRFt+XMCHWUjXJcuI3/PGTAI:21SrHVaLJHTAXMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784281953, "uuid": "df4bb38b-9886-40e9-9fc5-57549f264fda", "value": 14309302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784281953, "uuid": "43cd1322-e4b4-45ab-9667-9a3b6b6deea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281953, "uuid": "3ac58d08-eda0-430b-97c7-7920b7cd3272", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743add5f-820e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784313401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313401, "uuid": "474f54d2-555b-44fa-949d-967f6777a44b", "comment": "Malware payload (Mirai)", "value": "d337985b556a5d8c1893fc4f9484ed59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313401, "uuid": "99fb5cdf-9c43-4bd1-ba6b-15e8a4908ea9", "comment": "Malware payload (Mirai)", "value": "37883530e8617bcb83bce3a34654cd34dfca719ffebe8f89de9f61484918c65c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313401, "uuid": "d0c21e6e-8830-4d16-845b-bdbd442049b8", "comment": "Malware payload (Mirai)", "value": "0c65463ac877bf1f3ce1691fe87e37a65cd4c3ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313401, "uuid": "d8c21ea7-2341-49ca-a6c6-f1e52c7b95e4", "comment": "Malware payload (Mirai)", "value": "49b2b965e2ff6308e506457fede1a802f8cf8dee34bad683450bc9b3d819e9661d5fb2a328f8735bc3f08e3d204674db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313401, "uuid": "08ce99be-33e9-4af9-a81a-bc04da0154b0", "value": "T1DCC31959FC819A12C6C2167BFA5F82CC772623A8E3EB3217DD155F2537CB81A0E2B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313401, "uuid": "e4674e33-3538-44bd-9b23-66f0b45f58a0", "value": "3072:A9OG2I78oy02KrpJWJdCKJsGfpYhcNiKnbb:MOG2IDPdH0C7KpUsimb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313401, "uuid": "f5117729-fbc0-4daa-a0cd-4b1d30a55ca1", "value": 124236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313401, "uuid": "b3c2b6e7-6ec3-4581-a880-0ee13cb1ee6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313401, "uuid": "39c9f562-02fe-4218-9653-c3f8d78d31c9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941eafea-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784278665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "d0e0895c-ec8a-4d36-8c79-394dd437804c", "comment": "Malware payload", "value": "b1a355ee498f911dd127e3ba94ece526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "63c3044f-c094-46cf-83b2-c3a3d89d2348", "comment": "Malware payload", "value": "3878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc9902376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "034974d9-07f7-4318-a7f1-9b4788829881", "comment": "Malware payload", "value": "a6e4afcb4b9a64d6666f98c116d108c5502f40f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "30aa7bc4-8a6d-4983-b035-d31af37070cf", "comment": "Malware payload", "value": "3a7252c9c8acaed8d601ebb45895e7e10e706533a7c0a3c17cf3329a360d12d269f328dd68d2fa99a7f8ecfd5198af16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UAT7810", "colour": "#464598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "2273b48b-1ebe-4547-a01d-129a816cb794", "value": "T1EC83F989FA408A51CEC565FEFA5E529C371307ACD3EEB2029E115F3026D65570F3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "91126117-d4c5-4e72-8ebf-6201a90e0559", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+C25E:bGVAZyojaPTIsFsGO9Zr/REugmPkXC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278665, "uuid": "d13271c8-b74a-41fa-9ed9-d73826adcf0b", "value": 86168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278665, "uuid": "c421d581-1105-4276-8da9-aa6ec2872fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "31b017fa-9a74-40e3-b539-5418cf6d1822", "value": "r81o2bh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77b3715-821d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784320064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320064, "uuid": "7291f81f-4cea-4fd9-acce-d0d85bbb9e21", "comment": "Malware payload", "value": "21cd33d7a08d709fd523c91dad98e756", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320064, "uuid": "1f3927d7-1d8c-4703-9c38-f5356c85a5ad", "comment": "Malware payload", "value": "38ec2a642d499bf7ed9a566a800fee83ab31e5b3bf548fc8841f719a7065fd68", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320064, "uuid": "a76b31cb-80db-48d6-b1cc-80461b9e5dfa", "comment": "Malware payload", "value": "dc5cfaba4d3720f069fbdbe5ca0e2fcf513f1481", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320064, "uuid": "9f0d0693-4408-447f-a67c-115780c8d676", "comment": "Malware payload", "value": "55318109ee5dcd00b33075a047f8f32f35f0086c7804f01434b78bef2bbe320c1008b4937009de06a395d6bf1a0bba3f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320064, "uuid": "3f6c20b4-1cd6-4826-ac4a-6dd45603dd8f", "value": "T12B11B6C7110503315FA5D9EABBBB499970D0D1DA54C37F2BA898B8E9818ED0CBC43663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320064, "uuid": "cf7989c6-39ff-4d05-a51d-71f676a4a792", "value": "12:xj8p0FlkziHkzOv0FlkzLPxHkzLPIhOti0FlkzvHkzlVC0FlkzHHkzne0FlkzlQx:xjlSTqUS3+3IhOtSoZtSw3SxTnxTGFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784320064, "uuid": "17131b71-58b1-48f2-8157-a33f4861f6fc", "value": 972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784320064, "uuid": "71a59873-5e42-4f38-b879-006e1b86a9c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320064, "uuid": "a841c256-2400-4686-8b32-d842f6ef4f37", "value": "g.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d3ed12-81e0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1784293773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293773, "uuid": "2b317c03-822b-4d5c-bf62-7b0fbec3ba5f", "comment": "Malware payload (KongTuke)", "value": "5b9f5575fc366af58da232207ae55993", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293773, "uuid": "8ebdf4e4-2693-4abf-a7c1-ed5e9fde4f58", "comment": "Malware payload (KongTuke)", "value": "396df00f4024c8a1c80970b9d8d65056a9ef872765304c3e4666cb057fa5aeca", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293773, "uuid": "34736498-38bc-40b1-b1f9-c7793ed63a62", "comment": "Malware payload (KongTuke)", "value": "8e2fb8b92de75795f68317b16bcbde548d30a147", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293773, "uuid": "0cd6dd43-9e48-4098-9566-ea22d2306de7", "comment": "Malware payload (KongTuke)", "value": "378d2377389099d81f2a6ddc8cfb90ad4eac4367337327903ae3ac89d01760192e69f246cffdc98323243a1dfa771668", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293773, "uuid": "364eb36d-df98-4b76-bb11-c76e84283275", "value": "T174A27C767187407E6A8766A38A41C39484F7727EDB880130F82CD35FDA5722917BF2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293773, "uuid": "80ccc874-c1bd-45a0-889e-da7b2d3bbaa4", "value": "384:iiqNiOeGJpG2w/4BVdTC6EzsAygn6NWqddTLonRV/w8+YHvH/+8YYAfKzMlHmIoB:cNi9v2PdTC6Eoe6QqfTLonRV/w8+YHvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784293773, "uuid": "a8fe08ae-3a1d-4b1a-9fac-31b6c60b8885", "value": 23118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784293773, "uuid": "ba21917d-94b6-435c-8073-50db63b8e54e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293773, "uuid": "c52432fa-2fbe-445f-8bcf-2d82e2627e4a", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53c5a27-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784315631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315631, "uuid": "c55ba657-83ca-4330-8236-b7c48b4ec682", "comment": "Malware payload", "value": "3cc47b90df14f11cf82c289de2f78087", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315631, "uuid": "c7a741bd-bf6c-4079-8dca-a7a72f79a2a3", "comment": "Malware payload", "value": "397fc2060b8bb2e308dcf498f20bbabba97128150bfff564647a6afa47f57fab", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315631, "uuid": "13aabe55-ff15-4a89-bb9c-ab3570b37d37", "comment": "Malware payload", "value": "003e5ddc139c87bb8a06a54c3404e6c706d516df", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315631, "uuid": "4d3af30e-884c-48f7-9e6e-fc55ff6d5ba8", "comment": "Malware payload", "value": "b740c57e72d6d6f111b50b1d0ef4b4940224a2a8e12ae08ce2585461757a5772209fc33477072dcce53c9e4619374102", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315631, "uuid": "bbe2519e-6100-4d87-848c-97e23300ab76", "value": "T1CDE51243BF54A902D59A5EB598B0C3F85371FC49EA16934B35C6AE2BBDEE2C34D024C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315631, "uuid": "8a8e7f65-b3d9-4487-93fe-ac883f8af6ad", "value": "87a129cc2ff1b6b3193209158644b880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315631, "uuid": "6438372f-3392-4444-b54a-0ca1bc9bc6f8", "value": "49152:37lLu4MI4bWOziyKtPxRDRMEQ+yEXHdYyZHFX2bGJVGv3RDC:JLl4xG7xR1wEX9NZlX26JIpDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315631, "uuid": "8e90790b-71e6-46de-9dd0-f0c32ae7bb0c", "value": 3065656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315631, "uuid": "f885b017-e7dd-4214-a572-d7b85bcb22b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315631, "uuid": "0a1c28f3-1dae-4739-b7a9-27d719674fcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8828e872-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784329755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329755, "uuid": "46a432d7-7ba6-4b74-a8ce-1beb6c41019a", "comment": "Malware payload (Mirai)", "value": "df4bcc77165dce73df0b2ad004fff710", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329755, "uuid": "da1d6e24-e4e1-476e-8aa3-5bd862d04b2e", "comment": "Malware payload (Mirai)", "value": "39fdaaa503065403e9cca7ea29efd9d43f245b8b976cfadd70ddb1d364ddffe3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329755, "uuid": "e9429d4b-baa6-47f5-b6f5-73bb2a1dc227", "comment": "Malware payload (Mirai)", "value": "a74a2dba577b4d73d81a641eaa2ce6f11a45dffd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329755, "uuid": "8a4f21bc-4d0d-4f42-bbc3-767c64856f25", "comment": "Malware payload (Mirai)", "value": "d56f5407322b17cf91f50e388ea480f855d9b013a1dcfd8dfae1f88ffb22204861d234e1350a74fc8aebf5a091822957", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329755, "uuid": "29653fa8-3eb1-47f6-a05b-37c7281ab257", "value": "T15901B9E1217414F63AEEE4DA59731C1C318654753D865CF83C6EB4D6359DC84B0B2899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329755, "uuid": "a1bb7e3c-dae0-40da-a5a5-9f8c078e838f", "value": "24:ZDkH/FbfNHFJNHFoNHFWWFzFM5gFvWWFJFMDgFvaeD:hOFbfNLNyN06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329755, "uuid": "26604ca4-0abe-4b6b-a923-564826e36d20", "value": 771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329755, "uuid": "eccfe889-ae74-48e8-959c-bf695951c3ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329755, "uuid": "9af456d5-2e23-4382-b4a9-7ac58865124f", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6911a9-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "e4342291-6c05-46f8-91e1-65c03da9c301", "comment": "Malware payload (Mirai)", "value": "6aac257b1d6ac1abf5b142c4bbf05326", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "fbc4a81c-7c51-45e4-bbe7-71cf21bf5310", "comment": "Malware payload (Mirai)", "value": "3a663b3bc0888e872e3c7bcf713699df15249ccc1d6f77eab917c4fdcc313a51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "274147d4-5857-4857-acf8-460811b25c3a", "comment": "Malware payload (Mirai)", "value": "a3ecc9261203fbe5fe0311d631994b278543a1e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "3af20191-0376-4580-a32f-10c0fec4370f", "comment": "Malware payload (Mirai)", "value": "6f3196c54f96700f5d048b68ad336bfcc36227c6aaa55865464043843d6086cace2491b198a951bc03ddd86ccfcf99ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "1c47a188-ac31-4110-ba94-7af0968641b2", "value": "T1DB934B51BC815A13CAD5227BFAAE428E332613A8D2FF72178D215F2133C785B0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "ae728dc1-948e-49eb-9fed-f232016d44e5", "value": "1536:K5YDZ5b/P5Z6sRFwsEsHYQnpUzWMjcD759t4z++JBAxZWPpaV2dvgle:4YDZ5bTrt4z++wQfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311264, "uuid": "e48fcdfe-08ea-4b7e-9af5-6e9c31a98b7e", "value": 89092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311264, "uuid": "89eb1bdf-fb60-44ba-bd2b-b5105616c7fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "0da890fa-8b00-4630-90cc-8c0438dcb5f7", "value": "byroom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23399f3f-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250129, "uuid": "1c29d553-b300-45c5-ba88-54763cd9f2dc", "comment": "Malware payload (Mirai)", "value": "a1f524f7e00b3027630e8954dcbdb8e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250129, "uuid": "c2a150ec-80db-45f3-9334-179a45b29802", "comment": "Malware payload (Mirai)", "value": "3b03e32d06c84721bce47173fdb28283c185edf5a7b3a3b0c1282e424af0a40a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250129, "uuid": "53ba31f2-14ac-49a6-8009-1860815982b8", "comment": "Malware payload (Mirai)", "value": "8dbe7fde1c61b43497a14c3713ad4ef428ae7479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250129, "uuid": "ce18ddfb-16e4-4a45-bea6-6b9c2e1e0cf4", "comment": "Malware payload (Mirai)", "value": "d2e22e60dabb80fd3f9bf8e1c5c65a09e8db0a6cd0c1caa99ad04e275c9fa582aaeda6bbfbaea29e98f84176b470f03f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250129, "uuid": "0effb9e6-8244-4473-aaff-cb5080bf02c3", "value": "T1AE041A4F7721CF21C369D53049B38B9756A922622AE28485F35CDE083E6434DB91FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250129, "uuid": "fdbcbbdb-1c88-4559-a190-8db9c540cd09", "value": "3072:XjYtZmy5PRLailkkaGEw/AQ+YLouEX0GoZSo1Dqjs9t:TYfmypR+Kknfy3vnonySe0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250129, "uuid": "1c0ed487-0c6b-4b35-b5d9-231311efe43a", "value": 185100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250129, "uuid": "7e40ea14-acba-43df-b576-135da816daa9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250129, "uuid": "31de0ec4-5235-4e85-8e53-b1416650291c", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84bd648-821c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784319555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319555, "uuid": "a81ea364-d3dd-44a5-9206-e4b96bdf1303", "comment": "Malware payload (WannaCry)", "value": "b0a87d0fcdd49c072364c4378dfc9f8b", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319555, "uuid": "91ec2e99-0948-4bca-b280-13a7120f940e", "comment": "Malware payload (WannaCry)", "value": "3b6603d9bd648152700076a8e00a0e23218fd642ce63b5b47891f9db9ec0172b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319555, "uuid": "17ff5f10-9a84-4273-b039-c51fee641f41", "comment": "Malware payload (WannaCry)", "value": "1963f2cceff182e761507020f6cd92e54cb5194d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319555, "uuid": "b542a79c-776d-4cb6-b966-19e857dd5279", "comment": "Malware payload (WannaCry)", "value": "56075da1369585ae801750e0b200a81d22eed56d93721214db66b5add1719a6f33758bb4af0d478d06b93c68892b6d67", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319555, "uuid": "f02a910d-b969-4952-8c5f-1ebb691428c2", "value": "T1F036239931B881FCC106167484B78E22F2737C6A16FE5B0F9B50867A1E13B46FB64B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319555, "uuid": "9e9cd7b3-556b-4494-95d8-e5c0a9b20032", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319555, "uuid": "0f7a8c4c-5f7e-43b0-9b0c-55119ca1fb59", "value": "49152:jnsnnMSPbcBVQej/1Is+TSqTdX1HkQo6SAARdhnv:DMnPoBhz1FcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784319555, "uuid": "a79d4c50-8bd2-496a-af5b-344d2b4eecef", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784319555, "uuid": "36b3a9cd-b44e-4a57-995b-9260bb0e038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319555, "uuid": "91f83d01-d463-463e-b9fd-04c6b37b1fcc", "value": "3b6603d9bd648152700076a8e00a0e23218fd642ce63b5b47891f9db9ec0172b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd32520f-81a7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784269312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269312, "uuid": "d506e28a-ee36-4d49-9fac-f71746c2258e", "comment": "Malware payload (Mirai)", "value": "6603daea66bf344ae21dd5a92640f4dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269312, "uuid": "b77e4bff-bbc4-482f-8711-6b33d86f0b45", "comment": "Malware payload (Mirai)", "value": "3ba46a4b246db63935fc44fc1f02e3f00dc833574f14733c0012fab9f5896510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269312, "uuid": "2c35db1e-9d09-4841-aac0-51ab4d8eee10", "comment": "Malware payload (Mirai)", "value": "ed91a70c03bd115fd88aebf4afc91d9b193d6f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269312, "uuid": "eea6af3d-6744-4d97-821b-217d4b10dc5d", "comment": "Malware payload (Mirai)", "value": "69fe77d53ccbdf4a1952b129f6dedc285cd288adef319db8e078115994efe8e7403ddfae5377093641cad486e6f0fa75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269312, "uuid": "ccc2496b-5836-4501-904c-c4a7b7ed75c4", "value": "T121D3E71E6E218FBDF769C33447B78E25A39873C622E1C641E17CD6115E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269312, "uuid": "faeae62f-2c37-4d08-a6db-a7d5a3466525", "value": "3072:z0SBJcnFwP9oYCz0i6Kadw9BaFZnugRQeAgQN:vJoFwP7Cz0iRi0zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784269312, "uuid": "ab58364c-62f0-4740-a292-e0892c788430", "value": 138292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784269312, "uuid": "89447331-e496-4938-a7e2-b73469872771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269312, "uuid": "5518056f-981a-456a-9e70-19b3d0f2299f", "value": "nerv.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1915080b-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784291344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291344, "uuid": "f26002ff-eff1-4532-8670-90d56fbc0707", "comment": "Malware payload (Vidar)", "value": "69ccf0eafa559e506b4e6e2773cbdb48", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291344, "uuid": "78c7078b-5c12-466a-bd1b-71eb264dab4c", "comment": "Malware payload (Vidar)", "value": "3ba8def47d369dfdf0c15cbeaf33baa1677342c57de97d1d659a120b6c64c792", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291344, "uuid": "fcb8898e-6660-4a87-9fd1-3eab709a2a87", "comment": "Malware payload (Vidar)", "value": "79969ff9b3907bd8ce65c28408d5412d37ef40fc", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291344, "uuid": "37f81f0b-af3a-41ad-a4ee-0216e044a0af", "comment": "Malware payload (Vidar)", "value": "d37a9a361796455c09dc59f2b8d0ec3d5c8c0f3f2b1431e3bcca8159195aa569a3894536c00b1052af201471811d9232", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291344, "uuid": "8ecd9ec8-5001-44d0-bbc7-af1bfa7027c0", "value": "T1FD25070099F0C4A2C8700C7FD5AA96F56D76AC59FB1682E396483D7339F13C01636AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291344, "uuid": "e5f8bd43-66b2-4ef8-8c68-48d4b096d66c", "value": "f61b0d90a86ff4abd024c3ddc1120071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291344, "uuid": "07c9b7e7-e413-46e1-81d7-68a04d9ba911", "value": "12288:rDIQ1WJW6u5JqsaT8GNqHvfKn1QlTtY2X8RuCLITH5a:rDIQ18EHoQonIz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291344, "uuid": "ccf2daf8-2b3c-4180-baf4-5cd02c8e50fb", "value": 1030632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291344, "uuid": "14ec4acd-b0ec-4d6a-84ce-8e87ae41361c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291344, "uuid": "adaa91f6-1974-4317-a128-e89bfdfe0c4b", "value": "Eztwain4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470b85a-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312381, "uuid": "985be692-4f6d-435f-aa60-e3fc2121c067", "comment": "Malware payload (Mirai)", "value": "626e284d9cb5694684f52432929a4776", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312381, "uuid": "7274edf2-60d3-4c5e-9949-c2525e42514c", "comment": "Malware payload (Mirai)", "value": "3be0f71efb3471c5da1828096bd00dced6ddc5f8e5d8b84efb26ce43adee17ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312381, "uuid": "044e0a4b-899c-472b-9f52-0b4ff323de5e", "comment": "Malware payload (Mirai)", "value": "de8fe8ff9d56d5205f1c9b23597d53331a775e63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312381, "uuid": "52758bb5-4dde-45d7-9def-2c38214eceae", "comment": "Malware payload (Mirai)", "value": "092da6449a4d2b051f861982904cc33b6718999b7a9afe4c5c76bd1947b7199219bd0abb05541635e167a72aedd8e6ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312381, "uuid": "9ecad6ee-cd47-49ff-8ff9-4d772d05bdd7", "value": "T1CF83180377094F03C16729F026BB1BF097AABDA119F5A284752EBEC59271EF12181FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312381, "uuid": "12a60cb5-8014-4346-8cb2-c084ca877278", "value": "1536:JLPgNDM2wcb2o7EY73KQ3Efem+KfqgC/WmJyxz2aMoEaLsp2hF:JIGo7beaCmTanNhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312381, "uuid": "0b851bd5-4c43-4fed-b203-8b77ecdf8f97", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312381, "uuid": "efe6b690-0fab-4e2e-ba6a-7b64026d65bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312381, "uuid": "cdb7992e-718b-4bf3-acc5-db17c93826c1", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db1394e-8182-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784253100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253100, "uuid": "1b841127-d7c3-4422-b877-91efa19802ab", "comment": "Malware payload (Mirai)", "value": "aaa40766d73644b1aea823ee8274d4d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253100, "uuid": "7a20b1ef-6c15-47ce-8d19-ad235d108c97", "comment": "Malware payload (Mirai)", "value": "3bf8bc35c9909047deea7338c690480e8e2e36e5eb36b207c449080bda0e9a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253100, "uuid": "8277adb8-2574-4a35-8ec7-e3756b44d575", "comment": "Malware payload (Mirai)", "value": "e0ff53931adf18ec1bf38bb69a739bf3a3a3a38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253100, "uuid": "6dedaf2d-ad47-444c-a06a-ac608907a29f", "comment": "Malware payload (Mirai)", "value": "fd2772441b1c704ac22cf1e26f3f193d2840177e5ecdd9be42bb6a5e339492ab91b3ed24f535536e19bdb437714a24d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253100, "uuid": "e539a2df-5e2e-4674-a134-62444e86826d", "value": "T19DC32945B8829622C6D723BAFA6E21CD336163E9D3DF31038E219F1137C659B0D67B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253100, "uuid": "16dd87c9-3a01-4116-ae6e-70c4bfdd267e", "value": "1536:lKSmAASQ6ei2cdv/Lpl+9RKp1anmmA4zQyCR8PajUSi0CmOlc45PLv7Htt:8PAA/6eedYZAlmPajU3xX7Htt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784253100, "uuid": "96e7dd4e-90d3-4398-a7ff-236df6780f28", "value": 128492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784253100, "uuid": "1978649a-88d9-481a-af53-704062e3addc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253100, "uuid": "e14ec369-aa5a-4000-ae47-053c19748b65", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d3d477-81cc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784285107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285107, "uuid": "bbfa33de-ea44-4c3d-af3e-f121b56739ea", "comment": "Malware payload (RemcosRAT)", "value": "a8cfd3884986b1fa7b24078c6fb9514e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285107, "uuid": "1a6a5ee7-ab67-46fe-a8e4-ebf9f506e894", "comment": "Malware payload (RemcosRAT)", "value": "3cc23841a4efb02cb713948e570b587a7e63f76ef627e9b0323694c2ab100f50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285107, "uuid": "ed22bc2e-9a2f-42a6-b5b3-f7fb0c9eaf56", "comment": "Malware payload (RemcosRAT)", "value": "0fd204188f63a67b69cfe1abc25706129e429bc2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285107, "uuid": "5c254f2f-e1e7-42a5-99c9-3bb435c5d02e", "comment": "Malware payload (RemcosRAT)", "value": "9efbcb691e0d0c6e00655869cd81ee3d869c2419c1587896c6ec5a5266b4c192d0893e30f99e967e34c98995d64fb98e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285107, "uuid": "ad4520aa-46cc-460f-a2ae-4513f5949fa2", "value": "T16BF5F15046C03EA8DB6A972D41BEA12DE3A14A9B5C2D6D4AE733FD41FEB3500C3161B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285107, "uuid": "75709b47-d059-4ce5-b76c-95e004e55895", "value": "49152:JxECHjPVsLD9rFA8YzMvo4QSz0wzT1qEKdZ:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784285107, "uuid": "8ce747ae-de88-4dcd-a0c9-61dde0998b07", "value": 3502176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784285107, "uuid": "08674d99-8e8d-4ee7-ad44-0d6181095200", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285107, "uuid": "06c83ff3-e7e2-41fb-b4d7-3c78359aa9f5", "value": "Contract, Customer Serv Agreement and Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16fdcb2-8176-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248247, "uuid": "55f43cf6-9957-4f7f-b33f-2173ac2edbaa", "comment": "Malware payload (Mirai)", "value": "444b80f6b6d09a131a7b8d322a44fd8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248247, "uuid": "bfffe4c7-ee02-422b-80b9-4b39f28c29f9", "comment": "Malware payload (Mirai)", "value": "3e24ad303b4fe1d1715656a959aa40aa036128f694fa059377bac2b247ba788c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248247, "uuid": "0edfaa4d-0dae-47dc-8468-ec251c716788", "comment": "Malware payload (Mirai)", "value": "d1bd6941e225f4b1cad12729b03a736573dcf186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248247, "uuid": "3c95a83a-e2cc-4cae-87c0-07ea6a88393a", "comment": "Malware payload (Mirai)", "value": "2c1c9fd8dc906af59fb890cd43d115f7fac4e4c7882ebaed0d6e2a1fc54f5783c7e33e7c09ba331bad302e54737f1f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248247, "uuid": "6f0c7d26-1f07-49eb-a61b-8181c326693c", "value": "T12443F11029012BDBC5F41C3BB52E930896AB5BBE5A76767028306B7DBB9271B74B044F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248247, "uuid": "4d352157-faeb-42c0-b7a2-a0c6740025ff", "value": "768:hmKBnBAqA+iXd1iqgAfSplB1cB0IEYIQh/2hH1uk2R2bRLdhgQffK2yGxQi3U03y:MBRZXd83A0lYIQh/2hH1u7RIrtK2jefd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248247, "uuid": "e32e56cb-58d5-474b-a4d8-3b30a1cf9da3", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248247, "uuid": "a04e2015-d7cf-408a-8a55-831c4a800f77", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248247, "uuid": "5e28a5f6-805d-4b24-86c8-ac43ef0ad453", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf3942f-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272345, "uuid": "0968792f-1d6f-4d6b-bb3a-2d8bf59865b0", "comment": "Malware payload (Mirai)", "value": "23959dc38597ce6d99c7101ad14e3456", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272345, "uuid": "f64a96f8-e11e-4d23-a848-dc44f12ad4a9", "comment": "Malware payload (Mirai)", "value": "3e63129bbddcf21df302bc0248c5877896c084b6b2311585d976f491939b5b3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272345, "uuid": "e5273bb4-7ede-4530-8ee4-a7f7ed01f37d", "comment": "Malware payload (Mirai)", "value": "659cc5f3fcf40886481dce7c31370b851541986a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272345, "uuid": "cfe160d6-68db-4551-a021-99ec0f055ff6", "comment": "Malware payload (Mirai)", "value": "4ceb3d34efab6e57c27cda84431859a61f70739f0676c375edacad45ea84ebc471e2bbe9d4214cf1c8b5cf6198311740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272345, "uuid": "b6dd08bc-c4c5-4248-b82a-d016412fd929", "value": "T1EAD3D80AAF500EFBE82FCD3705E93B05258C755722E87B7A7634C918B64A64B06E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272345, "uuid": "80ef97be-39f5-4ebc-83ed-9f907cf554e5", "value": "3072:kXu+P2CwPAW7q1WEc+te8DDDmjLiBYPscvo7ix:8xXzWfue8DPmHoYPsqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272345, "uuid": "dca56340-cf0e-4c66-836c-3724d6759993", "value": 142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272345, "uuid": "76bbb2cd-9576-4766-9aff-6d3e30032ad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272345, "uuid": "8d4c0c50-6758-4f22-ad29-0b2bbb0b68af", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b400f73a-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278719, "uuid": "a445f189-c58a-4d0c-b33d-a609bfb244e2", "comment": "Malware payload (SilentNet)", "value": "35f6ac82e3fa5bf03b4e96b562d49428", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278719, "uuid": "5d8b8abc-e6f7-4e79-9877-b9d20470db62", "comment": "Malware payload (SilentNet)", "value": "3e6fa0cee27201c9fc93852415abd8085a54361a5f04b222876cf8b7eabcb0ec", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278719, "uuid": "255bb1cd-6c66-4af3-860f-c7982dae3496", "comment": "Malware payload (SilentNet)", "value": "07e30f2a41e293385f9cbe12d09cf2579edec974", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278719, "uuid": "989b1a76-cc36-4fb4-9fed-6ee7684a0235", "comment": "Malware payload (SilentNet)", "value": "4f2ec6ff051d965f08acb6eb536b0e4773dfc07640b7277349359e154aa5a349d05914a6442a0c4f95b589c51307b6df", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278719, "uuid": "30cdf615-ae88-4e57-84dd-5ca5beaccb25", "value": "T1BF7633BD85745A3CE8B69DB039443A69C762EA7A10DCF6A74F26E31F5E0E4837C40394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278719, "uuid": "349e5b03-628f-499b-aca9-7d4a3fe19f5f", "value": "196608:5meiZI5Kn7HAZUx3ZjPXlimGqLLfNstp4eFiiJ35b1:Eeitn7gApjPXlipqLv+3d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278719, "uuid": "436d42f0-3325-458d-9f10-6b8e362a4de2", "value": 7167989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278719, "uuid": "6a2183af-47ae-4b28-80e1-80c52f8d6876", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278719, "uuid": "9f1105c8-eeb9-4d44-a879-ecbd50db1f38", "value": "Nexooo_addon-1.21.11 .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49235e3-8180-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252574, "uuid": "f75f3514-461b-43c7-ab79-20369ec4c154", "comment": "Malware payload (Mirai)", "value": "00a3180dcb1d284914add2c59bd54cb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252574, "uuid": "a1c99713-9c1d-47a4-ac00-caa1d97fda00", "comment": "Malware payload (Mirai)", "value": "3f267bfc1659d5ad927a7ba7cc278af09163e102449517040f8269cc4c485b66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252574, "uuid": "89cdbe1a-9a70-4ddb-a3fb-f042da0e8613", "comment": "Malware payload (Mirai)", "value": "7e5ea280b4901673dab405ebc9f468ca1df43162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252574, "uuid": "c1024b1b-4b0d-4ca2-98a7-4611287aabcf", "comment": "Malware payload (Mirai)", "value": "a2760225fd05258234e31b99db19818deb4500d923b3bad5317c33df16e38ff09300933fb1419b06fb284799d072e139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252574, "uuid": "89c82427-0599-41dc-942b-d7f6b28d2462", "value": "T142E2D0A224D01EB0CB70C831EFA591C7B6832A3D8197A55A66498FF452EE8D809F8557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252574, "uuid": "81b92dc3-a3f8-48cf-a0b9-ee85f9cbe8e9", "value": "768:SZ+6GyLuOzsD5AwQhe4ljYaDTTqu79rXu7Xs3UozL9:SKawDq3he4ljYaHTqu79rUKzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252574, "uuid": "41c3cbd6-0108-42be-9131-ce809cb533f2", "value": 32900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252574, "uuid": "2f41979d-d6d3-4ab4-b6c9-60fd6b82462b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252574, "uuid": "dd541cfe-f05d-40eb-b94e-bb3ac23f2466", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7babf2a7-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ExaStealer)", "timestamp": 1784284208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284208, "uuid": "be8535d9-9b98-43e2-ba95-82909d6d07aa", "comment": "Malware payload (ExaStealer)", "value": "909d3d355c4ba0fd1a8c29573960bf0e", "object_relation": "md5", "Tag": [ { "name": "ExaStealer", "colour": "#B66FBD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284208, "uuid": "4c905323-2c0c-4938-b3d7-957c7d0c06de", "comment": "Malware payload (ExaStealer)", "value": "3f35a5d84fc27ce5201e1262fcd13d7e3c895db3fe9bd47b0118ad3a6ae85d9b", "object_relation": "sha256", "Tag": [ { "name": "ExaStealer", "colour": "#B66FBD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284208, "uuid": "29d1874b-4f22-4459-9606-3f30a89ab39c", "comment": "Malware payload (ExaStealer)", "value": "3396683dab8d939eba5540bb102465f1b9681c30", "object_relation": "sha1", "Tag": [ { "name": "ExaStealer", "colour": "#B66FBD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284208, "uuid": "cc4d57e1-9119-4eb5-bd47-25f747f0a12e", "comment": "Malware payload (ExaStealer)", "value": "63aa3193b66b4817bed3476249da1f594171b46eb2ca2943fe1d3b35b07fb23268c725c5045ef7afb88c1c2dcf08d724", "object_relation": "sha3-384", "Tag": [ { "name": "ExaStealer", "colour": "#B66FBD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284208, "uuid": "b4a7d6dd-c164-4c55-bbd9-3bd2c877368a", "value": "T1EAB60257D4C98C36D977E3B2D0C24A71A43E32C8E40BD27E56F40EC2A9935CA7B12769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284208, "uuid": "1d0e9f58-239c-4d70-95dc-052b6cef6180", "value": "196608:033HEN/C9FKD+hDqQSl0Yuzvh/gkaSpLGAUjitk/aoW9YGJxla/Y:z/CGmD60TJ/gEtGAUjwk/aoWJ5a/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284208, "uuid": "f52ea58d-cadf-430a-875d-ac2fd73d14e6", "value": 10880297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284208, "uuid": "beccd32a-2aad-4835-bda2-6d2298bda195", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284208, "uuid": "3fb01fd1-1898-4b21-865d-d542dbdc038e", "value": "emre.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae20391-8227-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784324257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324257, "uuid": "a9b4283e-193b-4d45-aaa7-0b620de00fcb", "comment": "Malware payload", "value": "0d80a2ad1c7ac7062da2489017230ccd", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324257, "uuid": "44a51dae-94a1-4277-a81d-6be720d3bb0a", "comment": "Malware payload", "value": "42348b62b28e9a0ab2617b550d82dd0aa266a71d3f4f581ff5d94590e47b4a4b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324257, "uuid": "bcc259f1-eb88-428e-ab69-30e554d98351", "comment": "Malware payload", "value": "8f7b9556dcf1dd1362aa680d9efba05e0ea15cbc", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324257, "uuid": "4c1dc36c-1b26-4602-8bce-ad9a8415e24c", "comment": "Malware payload", "value": "dc404e4f5fcf7b2a9b188b96b445358c08ec065632dab140ba20bf086a0ac6b6acdda6cc228974c638c38fe0b03223d5", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324257, "uuid": "b59722be-d733-4eb7-a8c5-b095dddd7589", "value": "T152F512073F14C416E21A1931DD65E7F8A360FE08EEA6874775E6BE1FBEA96C28D011C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324257, "uuid": "5cd4c453-9eec-466b-9089-1727ef9dad13", "value": "ff3bb7945bca253adc74f71dee73f3d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324257, "uuid": "5506420c-8741-432c-83f9-52731368eaf4", "value": "49152:81E5kPEvL53yoh+f926cOrRAqddj+RgmO+xKJ0iNQ5HVYK8WI8kIYkOQF06:81E+U4829vcU2qddj+1SYVYKwtkJ06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784324257, "uuid": "c6538a13-0320-42ed-af6d-b08695c2d611", "value": 3590280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784324257, "uuid": "75a0b012-b6fb-4c6c-8530-8b5d437d5294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324257, "uuid": "76ea373f-7d05-44e9-a44f-cb827d2eac35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd598dfb-8173-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784246952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246952, "uuid": "ed8fa178-cd8e-4be9-af19-79c3ceebc4a6", "comment": "Malware payload", "value": "81c7439398578c2100a31d7a3ccab83b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246952, "uuid": "cda6d285-cd59-426e-9695-a3baf7b1a9b0", "comment": "Malware payload", "value": "424f302b4f6f7edb6d7b6539e961216e078a12b2ce6c6df33bdb347ae50f73e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246952, "uuid": "e81525cb-c5da-425c-b623-1b9de03107cb", "comment": "Malware payload", "value": "66538e46df9256efcdc999056c11b30e29b2013a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246952, "uuid": "cc29897b-7162-4e5f-83ac-7041b59b6f1d", "comment": "Malware payload", "value": "89c645911ef70b9a9b99f0878af208815c836c9c8d30fb490a524e2078030ee0e10c42bd7bf12f3226e80efd6ede8ca0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246952, "uuid": "d0eb8793-1402-461e-b81b-a23248f4b7bf", "value": "T197016BC6D26099004059896E66AB9290B431C3C7555A4F6C7FDC983EEB89E14B03AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246952, "uuid": "40204286-caac-49c4-9c3d-62e8a845aa4c", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauCkS7KA7lCQJB8C9nU8CuDFCz1YkauD:kXCKysE2hi0ziQvZohaurmJNkZ8TFe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246952, "uuid": "aca4f0e2-d301-4dea-a292-26a6b5cfb95c", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246952, "uuid": "2c42c78c-53fa-4ff2-a586-586e54bd7ccc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246952, "uuid": "f5519aea-11ec-4a3c-9124-a00c1276be61", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b26cbf-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271991, "uuid": "4bb0e6b9-8d53-4906-91c9-5bd63d8ebc09", "comment": "Malware payload (Mirai)", "value": "bbb23d76820d8a79ecc17d222e3b5d9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271991, "uuid": "fbdd2016-66aa-4a9f-8c39-018ae739d92d", "comment": "Malware payload (Mirai)", "value": "42c9c5808ab7ced1e4b8f26b9c191898bdf48f3b9719f03430cefe10c5c1cd4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271991, "uuid": "211f119e-83ed-416a-b10e-1cc4caa545b9", "comment": "Malware payload (Mirai)", "value": "1bae147fe79865b66851bbab4ab745d3c44d08d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271991, "uuid": "d7feeff8-1403-470e-8f78-b82103fbccc0", "comment": "Malware payload (Mirai)", "value": "0edc9a9c7386268c43561d89de11ac7532623bd7694b8678d869a60a3a04ea6096a618f93399cb01d26ea0412d3191f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271991, "uuid": "19bc7254-75b0-4da8-be6e-d4fe2e1d1e58", "value": "T1F0F2F0B4745184CDE87592FF67B04331E24A2B9BD803DC1A792DBCA3E6A70A9311B3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271991, "uuid": "c6ac892e-cfa4-4c01-b517-0a5a0e521949", "value": "768:gNYKyukZoTMKe3yvRyqdLMBV1KE/2obtThmS5aG20tfbgSZMd8VJgGlzDpbuR1J5:6YdWleCvRhlQThm0T2Gf7ZMd8PVJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271991, "uuid": "1ed9c9a3-6586-4cb4-a5ab-be8808f6345c", "value": 37076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271991, "uuid": "969cc697-8363-4c03-9113-c40c9c21cc6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271991, "uuid": "a6b8f79f-5b5b-495b-a043-35e71035cfa5", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45c0d8b-821c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784319549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319549, "uuid": "b2e509c1-4c86-4efd-a04e-6a9e031bddb8", "comment": "Malware payload (WannaCry)", "value": "752b88ff4f0f5ea39ac1912c924f2f4d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319549, "uuid": "a77550f4-08c2-4e58-8fcb-163a20be90eb", "comment": "Malware payload (WannaCry)", "value": "431e527d800caf5391917f79b07bb0650501ded29678edca8627007f629c1bad", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319549, "uuid": "2655d644-22e1-4cbc-994f-57091ab380ba", "comment": "Malware payload (WannaCry)", "value": "ee2a0f806eea5db5f8ed4e22f52d1b2492e62a6b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319549, "uuid": "9d055126-1769-4d9b-8ee3-bdbaf3dca9b8", "comment": "Malware payload (WannaCry)", "value": "c3f03f321e2a8d7c4ae4486f5760884ba86fa065ad2da56341d57522a2bd81bfcf6a35267206e47c2e5a6bd7b2096f77", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319549, "uuid": "c10b6b39-73bd-43ff-a6b6-da3cd466c816", "value": "T1C8251259336C81BCC11B523494B34D26E7B3BC5A227D970F8B948B6A1E13390BB78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319549, "uuid": "3eaf17ef-07ab-4333-86eb-dd2395b974d0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319549, "uuid": "9282d00b-6ae1-406c-ac35-aca73c31df61", "value": "12288:jbLgmwbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLg1bLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784319549, "uuid": "df74f301-a1e8-4cc9-97aa-dfe289790738", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784319549, "uuid": "27c11127-001b-40a7-81b0-b9972843e1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319549, "uuid": "08e30ae0-f4c1-4bf6-a03d-7010975ebe00", "value": "431e527d800caf5391917f79b07bb0650501ded29678edca8627007f629c1bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2b1378-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272349, "uuid": "95b4fc45-9c89-40c5-90ff-75f61cefbba7", "comment": "Malware payload (Mirai)", "value": "9024fa0323ad90aa0c3d7ba0755264a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272349, "uuid": "668442e8-0541-4ea8-bbc9-d25146609307", "comment": "Malware payload (Mirai)", "value": "434bc55346fbaec419b4c7b1cb0b47d2748d3560c8ab77ceb38f4b8c52cf3f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272349, "uuid": "eaf1aa13-f2c8-4ae7-b225-1022fcafbf73", "comment": "Malware payload (Mirai)", "value": "dfa66aeb93e21bd8b60063a61e687916a33b31f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272349, "uuid": "9847cb44-6168-43f0-91ca-f039fb928bfa", "comment": "Malware payload (Mirai)", "value": "e490f00a1fe8b261ac73a5c13091d057fbd58eebc54fbfd5993a1147a241f32bacbe828fe22fc0c39db389ae49ed8dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272349, "uuid": "830a4008-d846-45ac-a8e1-3eb14b690b3b", "value": "T192B31855BC829A16C6C1267BFA0E728D77263398E3DE7117CE259F2133CB52B0E6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272349, "uuid": "71b023bc-a64d-474c-a4b6-6c7719aea607", "value": "1536:14/3MKbkhssguBU3b4fuE0QNNqEUU7tocGXydwzfYriocY0LckY2vEWU:S9AszuBS+NqhzfYrd0fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272349, "uuid": "ebec5e8e-7ef3-44de-9475-409559e10b04", "value": 108880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272349, "uuid": "0aaee091-7949-44f5-b60a-6ca93ec5d627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272349, "uuid": "afa56a32-6194-4d94-bb2f-4e2a61dcedfc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa5e350-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "2d16881d-1fdc-44f9-93f1-86aa536b119b", "comment": "Malware payload (Mirai)", "value": "f013cfebdf04484aef9823e7bee0052a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "3cd78579-2842-4c4c-94ca-2da55e110d66", "comment": "Malware payload (Mirai)", "value": "43629f3a9e2ba837d89a669d26d193c2d0f2c7dbda56b8d8878b2b049c529456", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "b4679e55-7876-40be-a5d0-a13ff4bb202b", "comment": "Malware payload (Mirai)", "value": "8bec533cd5a00d1e06da8998330dc9cef1574a57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311264, "uuid": "f85be6ad-78fb-4235-b92b-8a780f3c5a8c", "comment": "Malware payload (Mirai)", "value": "c35110c77ddc474a18c9d1e0e7ede7266adb4dee60457c585b6dbcf836f31d536256cfe56a7c16ebdfcb213dc439b867", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "08a8004d-68ab-49a0-8199-2bfbe230f08d", "value": "T114330781BCC15A1AC5E0137AF6AF868E331263E9D1DF77238C141F00768A55B8EE7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "03c28d63-fb4f-41ce-b275-42c154ff1b26", "value": "1536:a5zFEuPqk7Pr96/3FzkELyY3QpXGu8d5kHSmcL/F:a7EuPqkuacL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311264, "uuid": "287a1206-8040-416b-b669-e26935b41171", "value": 52612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311264, "uuid": "6b8822fc-1d76-41b5-9810-899dad90fa70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311264, "uuid": "31d17270-d62c-4096-8a1a-e47ae5a4ee60", "value": "byroom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939e5171-823a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784332352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332352, "uuid": "b7fabe54-cccf-438e-adfa-73011df580c3", "comment": "Malware payload", "value": "cec03a97aad76c90dd6676ba37ba1d29", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332352, "uuid": "219c7b48-b4c2-405b-9b33-06fd3fe1a606", "comment": "Malware payload", "value": "448776210b0c1802fd3e5da66813e90e7469bcd365d64e11b2a992547bc2fd4a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332352, "uuid": "7c4cbd7c-9384-4b5b-b342-c002d8e8f052", "comment": "Malware payload", "value": "7915b613f7b28bbbc0f56b2205078d1048d90cfd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332352, "uuid": "8d57a1ba-8eec-4004-9d75-df8999f87c4f", "comment": "Malware payload", "value": "df8853df0c74d49bc552dc8a5ec12fede81b386bb34b7b11bdd7637ebba6047ae94f9bc4252cdb1e6849f600d0a2a8c0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332352, "uuid": "eaf98a75-d7f6-4550-b7e4-0ead007e0b47", "value": "T1C9E6331CAAC105FEE5B3017DB6B152A6E966F8761B31CD8B03984352BD231E05E3DB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332352, "uuid": "db1b9a4e-286f-485c-b4ac-a0af9f87ea05", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332352, "uuid": "e8465dfb-aab8-404e-b219-b0e2fb469414", "value": "393216:fxg4SAKdBMvN/jAvkZqZNOy5WXMCHWUjXbcuI3/PGTAI:fW4SApvVjAvk2DWXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332352, "uuid": "c4a7d401-d36c-438d-b13a-1ad9acb683f4", "value": 14299991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332352, "uuid": "c2b7260e-ad25-4ac3-b4e4-526bcef7f689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332352, "uuid": "2b60464c-07eb-4332-87ec-36f88ddd3182", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a9e464-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311494, "uuid": "ab0dd232-c493-4159-9d5f-d8e55db4615d", "comment": "Malware payload (Mirai)", "value": "1bbdc6f8990b24fb3c506dc8a5160bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311494, "uuid": "47d53920-be36-41e2-889e-b51d7166bbb4", "comment": "Malware payload (Mirai)", "value": "45b28d0c9db63487402901b2457a04e1b2c43c1f5d7d7326718fd8faca1ca750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311494, "uuid": "1a10dae5-c9bb-40ec-8fa3-9fe3bcdea544", "comment": "Malware payload (Mirai)", "value": "692884f2028901a3da333a51bb36bc9106dba1f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311494, "uuid": "98e6aa24-8223-4001-8bb2-b7f8ceaf0261", "comment": "Malware payload (Mirai)", "value": "91a4bdeabed540a2bc9dc814bab108b9996e1209209dfc39b6c3e5d58a7a39b460671fcf3a0b085ba00883cb94a135ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311494, "uuid": "53edbfc8-6a94-4148-963c-91457cd4ecd5", "value": "T13914A64E2E228F7DFA78873547B75E24A75C23D626E1D685D1ACD2012E2024E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311494, "uuid": "a00edc96-67ef-44c6-87e2-cc8b124225c2", "value": "3072:ARGQEhi/DMFLogb7a6ZpHEnxETFHTL/tjEE2iu36:IGQE8/DMFLogvaakOT5L/VE3iC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311494, "uuid": "ce1cfad2-f315-475a-bf8b-5dbc0c881270", "value": 197700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311494, "uuid": "8f42e1ff-2178-4c00-9931-8b420bc036f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311494, "uuid": "c1bfb3ba-6528-4df2-8e74-56d28508da40", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1157ac43-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312376, "uuid": "3daea8f4-3604-4ea3-a6f5-76a8ea81b870", "comment": "Malware payload (Mirai)", "value": "e54b192f2b1de76a7ee6539a672d6854", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312376, "uuid": "1c67dc23-7551-40a8-929e-9b16ae6bc5e8", "comment": "Malware payload (Mirai)", "value": "46288108e2801df11bb87accdc8e5c95b3f57a4f628013854254f28207886b0b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312376, "uuid": "166f2b2e-3ec8-45b8-b149-e3e36a584d68", "comment": "Malware payload (Mirai)", "value": "1b92c709da2d666c371ef79142581b8509648ebc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312376, "uuid": "daa904d6-ac29-4497-bb62-b38c8f63b908", "comment": "Malware payload (Mirai)", "value": "470420b88b5e874db20ad814afb22391450a981a47f43f22d57ab65a88fab661ec79fc900ff6a1721e65227de0c6c822", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312376, "uuid": "a7a317f1-bb4c-4788-b891-f923bbae5838", "value": "T17F73F842BA87CAF3D41704F041F7B63F8E31FD3A493285A9EB65BDA2DA235C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312376, "uuid": "1d964133-6c70-48d6-9e32-8bafb36e47c3", "value": "1536:cfGl11IuDxOIX9GtkxBP4nIjv3DX3lO3+W/8xQ62wHvbi3aGiE3uM+92:YGl16uDx1XPBP4nIjfxO3kxQ622ji3Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312376, "uuid": "542f18d9-47ff-4f30-b554-0835b60e1ad7", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312376, "uuid": "b46be135-f3b5-435e-89af-73e861836f35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312376, "uuid": "816e6c7b-cc7e-49f9-ab0e-d3495294e7ae", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384cb9d6-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272069, "uuid": "1bfbb233-9818-46ee-ae49-29f572e91f09", "comment": "Malware payload (Mirai)", "value": "3ed6b952c0770d1645ed7da1664eb17e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272069, "uuid": "7ce7adc7-32c7-4b0d-942e-0167c09674c3", "comment": "Malware payload (Mirai)", "value": "46a86e178f866e61752676f2e7d3313c1f6758285c10ceb24247bbe711d14e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272069, "uuid": "7306b0ed-e09a-41c8-a301-edcd58fe8faa", "comment": "Malware payload (Mirai)", "value": "a5d7979763c9f410f8026a5fe3c9f733a0ae4aed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272069, "uuid": "f69fe267-2936-46fe-8235-29de3a08e5bd", "comment": "Malware payload (Mirai)", "value": "2a0403ef0a2f214443da72be5467d2c55576eed76a7e3c84fe178d0518ae78bb5f6e98df113c0e2c86ed8b22d9701a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272069, "uuid": "98b351ac-661b-4638-aa4d-922f75919ae8", "value": "T1E8A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272069, "uuid": "1d6721e8-6f11-4142-9d6b-6b386333c991", "value": "1536:yk8NZJjWAaOPtcve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBaOlzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272069, "uuid": "3c5f2a88-c2e6-4f2a-b8b2-d84732d766d1", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272069, "uuid": "9909bac0-a4e2-4816-8167-2188abe8db99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272069, "uuid": "6ebc7093-7f09-4cc4-9900-2331aa2dc1fd", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f1913e-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267092, "uuid": "0e770596-b55d-4b06-befe-27c9fdc629d5", "comment": "Malware payload (Mirai)", "value": "a1506247edfdce60b1c8a2fbcde42e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267092, "uuid": "9590597e-3097-41eb-b4b3-81b4e2f9e49d", "comment": "Malware payload (Mirai)", "value": "476ed5f12585e7d0ab386d76d0aaa357bd5b31e06e006d03a33932917a2a7c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267092, "uuid": "94128327-9e0e-4744-baa4-2d142cd6f434", "comment": "Malware payload (Mirai)", "value": "0f172a4e616e113056e0d8772a3059cdfc676c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267092, "uuid": "7d46624b-e50c-402d-b31d-88594cbeb885", "comment": "Malware payload (Mirai)", "value": "cdd4d5356b339948d6ad1caf3ecf81fada649e6d63a100aee0a825ba3fa4e936a37a79afcfb72842d3415344d18ebb4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267092, "uuid": "d3c646ed-9fc3-4c6c-849e-2b90e25d030b", "value": "T1A8431B95FC9245AAC7C117BA771A978A33626369C2CF7313CC080A5176C9A4F4E77B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267092, "uuid": "5903b47f-2d5a-4b3c-a49b-a9353025ff51", "value": "768:CuoWs1gISk7nchvb6bKkWqeTE/aEZT1Yrx1nlc428tMz2F30npzF2V:cB1gISkuvu9je0a0pYrx1nlPkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267092, "uuid": "64046287-4714-4a0c-87f4-ce3ed5486a67", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267092, "uuid": "d3a7b0e0-0485-451c-8e73-0366bd722ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267092, "uuid": "6c3fa16d-dfa1-4c0f-a799-a092299729a9", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2192ad-821c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784319567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319567, "uuid": "f6611086-bc48-4c3b-98d1-9774cda3d0c1", "comment": "Malware payload (WannaCry)", "value": "1da954be17c19b2e61d605097f1c7b29", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319567, "uuid": "1c9ce503-baf8-458e-9b47-a285eb231b87", "comment": "Malware payload (WannaCry)", "value": "48fca9f4433f79d8595fb75fe0940af8177b91b51068c132655472551b91af5a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319567, "uuid": "58ac12eb-fb59-4817-9d82-231f776a66ba", "comment": "Malware payload (WannaCry)", "value": "e7aae02abc7dc06ef69efeb1e98654dd69efd500", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319567, "uuid": "5232fcc8-bc67-40c3-aeb3-93031cd4cf75", "comment": "Malware payload (WannaCry)", "value": "9a6451a7d42a3371f42076a00be30bf283c82a2884e006cc155a9f3ede24cc53b44a3130e673d28820f11998b613177d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319567, "uuid": "1b43479b-e5ee-42f4-be41-5ff83a7b327f", "value": "T11A363360B265D0B8D0122A70447BA936E2B7BC2A1A7E560F4B40C67B1F537B7EF54F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319567, "uuid": "3d899b50-e27b-4070-ac12-435c1b4dfa83", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319567, "uuid": "5614de6f-5ee1-4b61-8b8a-cafa95908f95", "value": "98304:DyDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2gC:DyDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784319567, "uuid": "ec95d167-dc2b-4786-b153-53f6f2a87dcc", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784319567, "uuid": "12008ee4-f42d-40d1-b751-55a610d74495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319567, "uuid": "b79e486d-c630-4edc-8bf3-170f13e3faf2", "value": "48fca9f4433f79d8595fb75fe0940af8177b91b51068c132655472551b91af5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227e8a02-81ef-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784299950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784299950, "uuid": "89a20e97-bbf1-4629-89d1-186a5589d06f", "comment": "Malware payload", "value": "fb95048090c46a69da21781ace29dadc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784299950, "uuid": "840e3804-43db-4383-9234-72f5c3b0b6f5", "comment": "Malware payload", "value": "4987db769cb4add59666ae8d0fe5e70e818ce7ae0d0c545cf52171fa65642a0e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784299950, "uuid": "1907e5e2-3d72-4b55-b43e-9efdcdb92b1c", "comment": "Malware payload", "value": "b42e05dc3237a078fc7f4e91c733ea287d3501ed", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784299950, "uuid": "787041e8-0e31-4df9-84d8-335102a5c4a8", "comment": "Malware payload", "value": "31985a59ea8634da33535ed846075edbc96c6262cc734b7561a0564b47f0b56c4d262c48712c3c188898b74ab0c2c6ac", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784299950, "uuid": "3071db73-44ee-4da5-bc6b-3221610bb090", "value": "T1CEE6335857D001EFF9F3913DEAE112D5CBA970661BB6C5CF0B58C6A06E231E04A38A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784299950, "uuid": "e976b351-fcf0-4654-9899-9187243e45f9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784299950, "uuid": "a5694657-8aa4-4334-ae08-eecc9919fbb8", "value": "393216:Iz/HqsdWpt0J6+nhkCUhXMCHWUjXecuI3/PGTAI:SisgptaFhkjhXMb8XTH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784299950, "uuid": "5ec6cc4d-842e-44ca-90e1-e8f75813d8a9", "value": 14316489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784299950, "uuid": "3c7e9372-e31d-4bca-a40d-c39e3c4c4910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784299950, "uuid": "10f7b0aa-80b3-4fbb-a84e-c88a59cf2ce9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d658ff7e-81ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784271475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271475, "uuid": "a76bf96f-cca8-4502-94e0-05b64c1b52c3", "comment": "Malware payload", "value": "6754fb9104c5a8a3d947cbc78a5af0ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271475, "uuid": "5a9dafd7-46fc-4373-9f01-ecfeb6aaade3", "comment": "Malware payload", "value": "49fa8de8c73bd2e496ff6a56cb6fae7513b44a9918880c980e8d48adb1954af6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271475, "uuid": "594244ac-39aa-4616-85c7-20983ed125da", "comment": "Malware payload", "value": "7c878437ff16ebd863538a36b61da536683d519a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271475, "uuid": "3fa34ff3-bed4-45a9-9c20-4fe17b6affbf", "comment": "Malware payload", "value": "43e61e20898797ff324bbefbf38e7560576ad9eb5d06d83416e3bd476a5f7afd65421fb2a46e61b5c845b2eb9793cdf3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271475, "uuid": "a967286a-92f4-406b-98ec-6a14b2dd6a61", "value": "T159D02E93A137013084A28C40E4E2A002B0008BBE0840820EBE52A0302F48A08F8C02D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271475, "uuid": "6c3798d9-1919-4253-be00-79a66e7f4f60", "value": "6:hTmlRKxETF7A0ZpAulNXYq9DG+NjVsNXYrkJ:VbxEC0bPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271475, "uuid": "19a58738-369d-4b26-acce-7c133fe2e26f", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271475, "uuid": "28c82351-0929-4307-a2ab-258dd8a6ab8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271475, "uuid": "9dd3a6e5-f401-4894-a37c-5c1e8d41f0ef", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aa6142-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272172, "uuid": "b5007fef-077f-40ac-ad57-6962e6350a3d", "comment": "Malware payload (Mirai)", "value": "ab6855f631aacd7f4ae7eef5b14a8966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272172, "uuid": "a7e987b6-7b6f-4e05-b2d6-86bd61067a2a", "comment": "Malware payload (Mirai)", "value": "4b07bdd04f7864af26b44b344cefb93f1a4f8dde3c7e0431b09cfb9b40e82c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272172, "uuid": "bd443db5-d774-4a23-b27f-3ec8744122eb", "comment": "Malware payload (Mirai)", "value": "f2be5719d04791ab982d9f8a042618a0ea96d8a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272172, "uuid": "2910ea90-0ddd-44da-97f7-75853e8ac9ae", "comment": "Malware payload (Mirai)", "value": "1047db40f75e43f839cdc1a1221333829052a43d7af378c6a3390c70039c49dfb57786655dc1cd4c4785e90d182c3c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272172, "uuid": "97db7ac0-f4fb-424b-b8a9-507b328bc1d0", "value": "T116430251D3071E79A61A2172D132185373C72FF5E1EC612A3C8F1FE8628F52F622498B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272172, "uuid": "6a9245c5-2a3d-413d-9fdb-7d66923c6765", "value": "1536:bb43KXpBIqkjhvEhg02cu/aQ3WaLuy6tlV1nLC:iKXpHhH2cKaQJLd6tlHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272172, "uuid": "d58a31cb-4f9b-4b28-a4e4-6e34efa9c083", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272172, "uuid": "014ba8a1-e075-4892-abf7-f9a8d347c4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272172, "uuid": "57dd749e-3dfb-4c7b-b3e3-56a2e4403890", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d0494d-81d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784288527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288527, "uuid": "484e2fd9-4f25-43e5-a2b0-1e996f32849e", "comment": "Malware payload (PureLogsStealer)", "value": "02db485105be3075a8fff129ad9f105a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288527, "uuid": "2314c46e-af80-4e80-a20d-a3a656719b29", "comment": "Malware payload (PureLogsStealer)", "value": "4bc0f3939bfb316ccfd6458797cbb9595f4f76d435a087478ea46bff60c89089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288527, "uuid": "a9ec9395-b2bb-437c-bb98-7791e88c8df7", "comment": "Malware payload (PureLogsStealer)", "value": "acd23fc4348f98845d907e7bc57e151d182fcc91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288527, "uuid": "6c5e03d5-75cd-48b9-8c8e-2290601cbaee", "comment": "Malware payload (PureLogsStealer)", "value": "85532688bdcf81162155e18d7dfa7e14cffa9da9474fae348653df4b75248332d5d674922fa57cd386c6dd0a37a026b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288527, "uuid": "30d35d8b-0c4b-46ae-9667-2f1120fe89ce", "value": "T162F4BF1B73568E21E2840236C1DB550187F16947B67BEB0E7984239B29033FBEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288527, "uuid": "8dfe5596-6309-4fda-81be-28d85fea35fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288527, "uuid": "f09a3c82-0991-4cf2-8909-f6bdf6b05b47", "value": "12288:uetyShabBkUBp7Q8sFHv+VuyG8AObsByGxtHNFyvNGKnsEYQcaXL:TUlpU8S2V7JAtyQNNFshsEYQca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288527, "uuid": "bfc26da8-4a92-4b3b-a82c-d5848f77f5c2", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288527, "uuid": "2a5b6ef1-5403-4cf5-b7e6-eb533634f4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288527, "uuid": "8df6b595-16ab-45a9-911c-1963e6dd29d9", "value": "4bc0f3939bfb316ccfd6458797cbb9595f4f76d435a087478ea46bff60c89089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a46e539-8208-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784310834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310834, "uuid": "c69c95d7-d4fd-4538-9504-42345cb7e658", "comment": "Malware payload", "value": "bdc3546c2659bf932144335bb46b1247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310834, "uuid": "1696e376-be79-4725-aec4-9f555bb8fa49", "comment": "Malware payload", "value": "4bdde00f03ff8fb972b0320e74ed1f74798002d64261a4077c547706150c4951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310834, "uuid": "11dee44c-3159-4823-b8f9-36c8424f626e", "comment": "Malware payload", "value": "2b26ce677d37457a4c60257765372e65968403eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310834, "uuid": "6fa7343b-f6b1-4598-adce-261bc44c0de6", "comment": "Malware payload", "value": "b00e451b3a7661f3591819e1fd2f56d38851d718fc75659b0433a724eefaa7aa8f03825ace8263be7add86fb8919d1c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310834, "uuid": "9e3c5f9c-daaa-4ac3-afab-0fcfa35f8506", "value": "T1A0957C27F7A284A8C56BC1748752C7B5AA70FC294230BA6F29D4DB323F26D904F1E754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310834, "uuid": "c4634664-dfde-45dc-80bd-c8d990231312", "value": "f67ab27aace6361da723200ab2e0e108", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310834, "uuid": "62721053-d6a6-4a7a-afb9-dd73f446c90e", "value": "49152:39TDCjAWVRvd4CIPuRG2PsOZARWxo0RSpJ:toRvd4CqWPNkWKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310834, "uuid": "7ec1103c-e3b0-40b0-8132-0c8e77b5a678", "value": 1933856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310834, "uuid": "7e651ace-c8ad-462e-9c80-355e919777cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310834, "uuid": "44ca1bb2-c6a4-4baf-9072-bd52acceb45b", "value": "Unix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23675c46-81b7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784275899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275899, "uuid": "913a01d3-b0d8-4309-bc9b-8293921190cc", "comment": "Malware payload (Gafgyt)", "value": "5cbb727508d02e95dede993d06053ce8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275899, "uuid": "308bdd32-072e-4fed-81a9-a8ff7dd5fa2c", "comment": "Malware payload (Gafgyt)", "value": "4bf01201b22a7bd21d00d409ac8ad6e2024bc50e0886b9579837b63599dadb19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275899, "uuid": "0cb92c12-fd7a-4efc-b6bb-592bd8f8c6cb", "comment": "Malware payload (Gafgyt)", "value": "d3da2830d557ef84296fc5213e9b9df09b1bc593", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275899, "uuid": "ed51fe97-4c4a-423b-a90a-50afae66f1e5", "comment": "Malware payload (Gafgyt)", "value": "b8b4aee6712af4b0b9b89c8ee2a53453b86777433c120049fe7698ee22672ebd1db131d42ac14bb828755d6a4951b181", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275899, "uuid": "f5b81823-7887-411a-bf48-5c5a275f649e", "value": "T100314FDB219207F76DA1EA33316848D9F9C1A28714C91F956EDC3DE980BEE2CB041782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275899, "uuid": "8893c1ca-52d2-42d6-afe2-c7f15869f51f", "value": "24:14mltvY/M2T7qjr91/y010mRUiGbYJrjZcGvzh3ye4HP:14mHB2T2jr91/y0amKiNhjZcOzh3y/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784275899, "uuid": "9ad46d77-c37b-48ef-b08b-db75fed37246", "value": 1831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784275899, "uuid": "e90ad7f6-d345-4ff9-bff2-71d1936c2fae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275899, "uuid": "bda2135f-d1cd-4ecb-b221-d08b5665d45b", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e53d7f-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312387, "uuid": "a782e09a-e92e-4d8f-b815-5fd4ce792488", "comment": "Malware payload (Mirai)", "value": "02792b708e0b2e97dbe0ba320324d288", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312387, "uuid": "ce765d8a-b367-4cea-b05a-8f802529c243", "comment": "Malware payload (Mirai)", "value": "4bf2256a533b2444484ddb644619610d0a4c1e126f35d3917f26c72644327b4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312387, "uuid": "508f80a3-3116-492c-95d3-874472318232", "comment": "Malware payload (Mirai)", "value": "e7cf2a8ab484e9ece2d85a8999f56a3f2d62a6e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312387, "uuid": "b1bd69c9-23ae-4e04-9686-000f83f5775f", "comment": "Malware payload (Mirai)", "value": "dc2e7cedf9d260324c27fbb46dc1c0f094187f826dab25fc6415f892b99e72e052a02217931324dc6bcbf2ff79f4585e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312387, "uuid": "63db73a3-f6ed-43c4-a1d2-6b9084e8a2a2", "value": "T18851848E01D246356CE1D922F2B60828B2E8D0C371D9AEC6DBF878FDC05DD0974A9797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312387, "uuid": "3d3d5223-2a19-4edb-a2e0-b4fc7f20790e", "value": "48:i5S150d5FR5QJ53B55Z5rSrZ5AN5VJ5cd53B5Lz5j/5ul5v4:i8ytmDN8mdi/9JQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312387, "uuid": "13fdec66-701c-4d86-963b-26ef0cf02929", "value": 2809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312387, "uuid": "5fbe1ff4-72ef-46a2-baab-c743375dd562", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312387, "uuid": "a08fbade-a22f-42af-8771-0bf194363384", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7995b393-8227-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784324148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324148, "uuid": "7a2c4657-08f6-4d29-911f-0335b716ff6a", "comment": "Malware payload (Mirai)", "value": "3fa681a4888039c57807ac9bac7f15e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324148, "uuid": "5134b2e5-e4f4-4e1c-ae55-5fa16b0fa69c", "comment": "Malware payload (Mirai)", "value": "4c242a45be40f24309507d72b6652616bff68a38480ca8c5ef5d47b43eced46d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324148, "uuid": "19357296-8078-4433-b615-bc4e532bcbf0", "comment": "Malware payload (Mirai)", "value": "761c29829d573d36bd00868105f6f96a1c65d2b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324148, "uuid": "4775ef58-422c-4c00-8da3-46077c990ac0", "comment": "Malware payload (Mirai)", "value": "412e6caa38e5d99b56be2fbb6363771f6a901706c742d1f77904591f0b36260a3706ce6c91596fd018224ffff45a0ce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324148, "uuid": "c5061b3f-493a-4898-9d85-3b4377b5df0b", "value": "T1F0831995B8814B12D5D512BAFE1E118E3323177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324148, "uuid": "65202e4f-5454-4b94-9d07-45c512d1f164", "value": "1536:ijn63Wezi8kIc1UB6wQMlrqamlFdQaMCiruHG3yf687e+Y5mY0s/KN:TFzyHw1lrqamKuHG3yf68a+Ygd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784324148, "uuid": "9a984db4-0da4-4fd6-a62f-cc3c5bcc09fc", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784324148, "uuid": "30aa1f3d-7c6f-47a7-9c0c-02af08fd96d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324148, "uuid": "59d7a3d4-e718-4bca-8aa0-3dccc8ab25bc", "value": "SecuriteInfo.com.Linux.Mirai.10589.29319.5096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a138cb9e-8224-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784322926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322926, "uuid": "7aa1b790-873b-4ab9-9752-e4401db694ac", "comment": "Malware payload (WannaCry)", "value": "993e330b2c80db36a50514c5fd50466c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322926, "uuid": "fba1a2a4-398e-4af5-86fa-633a2b11db6b", "comment": "Malware payload (WannaCry)", "value": "4caa645feeb04cad5af75a3c5024076e99560678584c84ae07950c9c106d2af0", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322926, "uuid": "8238ee92-6bf2-465f-a104-b6b3e38a0549", "comment": "Malware payload (WannaCry)", "value": "55e3f9a3ae32da95511ccff3c3b2fcdde3b87c7a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322926, "uuid": "87540266-8825-4c55-8a85-d123bf1c9bf4", "comment": "Malware payload (WannaCry)", "value": "55a0b9b858236dde2f503b4c5409e85552120336a9ea0a8c5e4c329f9dd0645a168e0b1bbbc6bd8b18020077fe2e8c0b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322926, "uuid": "e150c5c8-cd42-4b5e-8ee2-dafb88aef0c5", "value": "T19136235631A8C0B4D003557488BBCF22F6B67C2A13B6694FBF904E6E2F23791E715B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322926, "uuid": "7ea25f70-9853-42c9-a14d-59b5dcea8297", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322926, "uuid": "e67e3cf4-ff1f-46f9-9b69-b9e00535d537", "value": "49152:jnsnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAAR:DMpyfBhz1aRxcSUDk36SAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784322926, "uuid": "8ebfe2cd-494d-4334-8394-71d281392950", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784322926, "uuid": "14511d96-5380-467d-9fde-30eed80c180f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322926, "uuid": "7c0b5075-2879-4ca8-91f3-a076dbff67e3", "value": "4caa645feeb04cad5af75a3c5024076e99560678584c84ae07950c9c106d2af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f178c906-8207-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1784310605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310605, "uuid": "546456fd-0a35-4dc5-8041-7a50965f8cc9", "comment": "Malware payload (ArkeiStealer)", "value": "bcedd23ea8393a59bbc4416154bbc316", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310605, "uuid": "b0fee3c4-0cb6-4795-97c5-39c9109d03c7", "comment": "Malware payload (ArkeiStealer)", "value": "4ed2957fbc5f5e78defd3cf75e7d5f70173eda881dcd8d2ab683f8f48ec3e032", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310605, "uuid": "24f2e857-b878-4766-a94f-53ae4c5bfc50", "comment": "Malware payload (ArkeiStealer)", "value": "5179d2841e8fd1ed90351cccd4c995ed83c9adf0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310605, "uuid": "e96646a7-940f-4e0a-a801-71a8ad203b2f", "comment": "Malware payload (ArkeiStealer)", "value": "3c366186dbde643fcd3ab8d3dd36985df1b2dc8f246badc3d4809d865a6b4dc6726aa82247142b6fda47bc5d2bd04bd7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310605, "uuid": "a0b5fa94-83c4-430d-9a56-a7a9e532fd5d", "value": "T16AE58E47ACE115EAD4AA93328EB651937B75BC490B3223C72F90B3782EB2BD05D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310605, "uuid": "6641f924-8ac0-43d5-b56f-e8974416a8c1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310605, "uuid": "0defe2ad-a42d-4699-8376-df3ee9bc121e", "value": "49152:zaL6YA+ZC0hYG4Bm5IdUycFNZLb+nGpLQoFk4BgN:zaH/+dUZHZLCnGpLQoFkIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310605, "uuid": "5fa220ac-3dd1-4ad4-8773-01e7b9b06a00", "value": 3026280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310605, "uuid": "52efe003-cfbd-43a9-a7cd-0520eec6057a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310605, "uuid": "2bd85fca-e25f-4733-8065-d615fb72ef34", "value": "Mod menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a865ba4-817e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784251618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251618, "uuid": "280c9a72-52db-47ca-9727-7e706547a114", "comment": "Malware payload (Mirai)", "value": "1b58e4591b9c1dcceeeff4be3f03a010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251618, "uuid": "a9a66eb6-b481-4e79-8eda-30e9f2a091f5", "comment": "Malware payload (Mirai)", "value": "504e8e159761fa56a843801922b86e2c8c5c346c85062e56ed90901aaf3553de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251618, "uuid": "4c5dd10a-cba0-4d2e-ab51-7761baf2e441", "comment": "Malware payload (Mirai)", "value": "dc4396afd2a6816f56542deb7bf0f9c8688d6f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784251618, "uuid": "f9ec817c-6dc3-4486-b10d-e6a4c1074072", "comment": "Malware payload (Mirai)", "value": "a33aa09f598d6de3f036be461f2228bf06cc5921acc64929900edceb1100ea3eec8c88921971834868582ccb911b4e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251618, "uuid": "3402a759-c6b5-4b05-b211-18bf5715a6fc", "value": "T1F4333995FD41AA02C6C155B7FF0E428C7727539CE2EE7303AA256F61378B86A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251618, "uuid": "db3b7d7c-4b40-4b6c-a299-7313c352b772", "value": "768:yw4ONIBgQmGs687QV367NFYgMDGowelPj+ORIS/L6ghYKH1SsnvhPaXRjZ0RrI:sOxQyeVgEDGIPaORv6ghHHHaht0Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784251618, "uuid": "7a217dda-98ac-49f5-8026-819020678cd8", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784251618, "uuid": "9bc51c5b-e876-4ce7-b0df-bf990ff3452f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784251618, "uuid": "30983887-f159-46a4-939b-43abab9b297a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14df694d-8219-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784317966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317966, "uuid": "f14e8f2d-2a34-4c94-b32e-0b018119d4fe", "comment": "Malware payload", "value": "14500924faca888ea4c3f6444da104fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317966, "uuid": "6d3412a6-0a54-4fe2-85ae-919c32992faf", "comment": "Malware payload", "value": "527853402cf78eccef078a06a60f6ea572ad6646db367efc82a45e4ecdada172", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317966, "uuid": "214c753c-ba8a-4a57-be65-b604f3b05669", "comment": "Malware payload", "value": "4ae22dd020dde9e7c9b38e6da6af651aa0e981c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317966, "uuid": "0ea9b776-3bf1-4125-9d33-ca207f07eb2c", "comment": "Malware payload", "value": "3fa7a4640455f8b6bf6055a3e7a7b56e000c07f249d294ca6dc78f338cd6696e2e836f6b35c102e25bb3228e4d82accf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317966, "uuid": "16ca6fe7-7487-4eca-8cb7-dea18bf6be01", "value": "T16AC26D966A857C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317966, "uuid": "0c91d92a-50e2-45bf-9a88-3b167de47996", "value": "768:68vCB+25j6es8RRN9FYpMSUpi+20qUpi+20YQX:68l25JR7d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317966, "uuid": "7e8ed453-9fa0-415f-973c-aa8e4f65cfcd", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317966, "uuid": "2aa67ff1-27af-449b-aa02-00c9e78475ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317966, "uuid": "64c9b0d7-f643-4486-a1d5-738a7451848e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e354e-8210-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784314350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314350, "uuid": "3726833a-6873-4705-b4d2-ebf015f21cb9", "comment": "Malware payload", "value": "943a29579af1456a8ecf1b62b11f1e29", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314350, "uuid": "cf7dc06b-2936-47f2-8d4f-adfb8b112a93", "comment": "Malware payload", "value": "52a6735e1cd4f59d8fb38ea9e821e9097c84f9c6528497be44d84c458e20b97e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314350, "uuid": "7f5a674c-bfc2-449e-be57-21c6ce3a518f", "comment": "Malware payload", "value": "0039e30212ceda9b4b549073cb0e48ae175d4cab", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314350, "uuid": "85e1f359-b666-487c-9594-83f99761c701", "comment": "Malware payload", "value": "5bd9b0a423e5c6b269e7c970d67dcbead930e718fbb0f7549d1e800ca8f4f9271dc948c21f4e04610534350d175decaa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314350, "uuid": "3d6f2d8b-e944-4d4b-9f44-c4211257b5fc", "value": "T154E63344AAE116FDF7A3423CE9F1A586E5A474B60B72C5DB1B7853B03E130D1893CA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314350, "uuid": "39cb9951-e2b5-4e74-8d95-6295e3c3c712", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314350, "uuid": "8742eb91-efc6-47ca-8afb-2b1977b7b30c", "value": "393216:A996PUX+dDxSV7p66JT5gXMCHWUjXxcuI3/PGTAI:AqU4SV966JT5gXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314350, "uuid": "6f4acea0-025c-40a8-ba33-3e559e8ee8c7", "value": 14324185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314350, "uuid": "a1cb3824-b029-470b-93f9-01a77d2982ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314350, "uuid": "e676c2ab-6b95-4750-adfc-95b719aa35e1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4be5ddb-81d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784289484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289484, "uuid": "500a10b0-4f00-447b-86c5-b73002b529e9", "comment": "Malware payload (RemusStealer)", "value": "dbdc539ce2276d056e3da79e5b556cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289484, "uuid": "9b79f833-8052-4091-8021-a348f03d7c90", "comment": "Malware payload (RemusStealer)", "value": "54c8c1fa5c44506bb1feb7c8657ef6b761b0e1d1e4a8dbe2b52eea5a89296562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289484, "uuid": "c25d0a91-9a2a-47e6-b008-e4e2c0fbfaea", "comment": "Malware payload (RemusStealer)", "value": "be359a25b1ed3d17fb2aad16d8d6c81fcda6a319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289484, "uuid": "7cf1dfde-f975-4ff9-81dc-2eb1ab1e4ccd", "comment": "Malware payload (RemusStealer)", "value": "0518b25423bca0711563b201e7dd4685c2e9c5ec1031202dff0588e2f2ed5cd7390e1083c57cc4356277bfa9b474ffbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289484, "uuid": "a83899e6-154e-44f8-b0d9-8cf097d91349", "value": "T1BFC54A17BD9048E9C09AE33289A74656BB75BC4C0B3233E72E90BA782F727D05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289484, "uuid": "faa82821-e0f8-45e6-893b-7a6305478d18", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289484, "uuid": "6103d129-ddbc-4b42-86dc-2310a65f50c2", "value": "24576:yub+9ZWgfIzjTrZwAShG/dspMwRuytjtGDBRmT2w+wazAoBele5r9DXmm5dEADk8:yubQJfgTVNS4l+OytjtuCTtO9lA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289484, "uuid": "693d618d-375b-4ec9-8115-aa8eb84d7d8a", "value": 2716512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289484, "uuid": "ee81dc65-fff4-402b-aa01-acc5f4dd6f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289484, "uuid": "f2381753-f3b9-4ba7-acfe-b6b0031d7c26", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6714d7a3-8235-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784330129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330129, "uuid": "b0ba5412-03a1-46d1-ae1e-f4f77fd734d4", "comment": "Malware payload (WannaCry)", "value": "e904d175277278ea87b853235875fdc9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330129, "uuid": "8cc906a0-7673-480c-8b04-11038e80e90f", "comment": "Malware payload (WannaCry)", "value": "55c28ae706e71466105213f097ade42c5022792c67dcfc29e354a1ade36fd4fe", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330129, "uuid": "e0925d33-9560-4ee4-8924-8b2a84f2c5e7", "comment": "Malware payload (WannaCry)", "value": "d917862e4dc8f55819dfde493322481bc9c58ef9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330129, "uuid": "0e593197-d66e-4bda-8dd5-528bc5972f1e", "comment": "Malware payload (WannaCry)", "value": "f21fac7fc332a5f53421143a45fbf19433cafe758b71a8999033e0dcbf3dfa0f665349ce4511d7c7beefbf11660e4534", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330129, "uuid": "76bedc0e-f317-4378-8cb9-e4993fca475b", "value": "T17936234D32AC81FCD107167494B7CE26F3B3BC6E22B95B0F9B5085761D03B96AB64B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330129, "uuid": "62517d68-7d97-430b-bf66-10a429842e06", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330129, "uuid": "6da6a508-efc7-425a-bcf9-feca18cc6e33", "value": "24576:jbLgKbLgdritdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+pSk+RdhAdmf:jnbn6MSPbcBVQej/1INRx+pARdhnvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784330129, "uuid": "287e831a-4d4b-4e85-b27f-a2f0a74f07fb", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784330129, "uuid": "84beb11f-a55d-438e-8738-762b09b0721a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330129, "uuid": "769d85f9-203e-41f2-8cca-6c56028ab3df", "value": "55c28ae706e71466105213f097ade42c5022792c67dcfc29e354a1ade36fd4fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5486518-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250052, "uuid": "60f9da5a-889b-45b7-9969-1a4a54d078ad", "comment": "Malware payload (Mirai)", "value": "c171a9661e3c702345a1a5188989b101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250052, "uuid": "de8ae2d7-ccd6-43eb-bde3-8615846bf808", "comment": "Malware payload (Mirai)", "value": "560409bf7fd5c35647e55577c5746fb4e8242fc2885f21828ded731ce7d442ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250052, "uuid": "6f3cfa0c-d928-422e-bdb4-fac7668afe08", "comment": "Malware payload (Mirai)", "value": "215639cc70d124e84f424bdcfe3e3e20afef9774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250052, "uuid": "bdf70320-0f34-4b1d-a268-7586bbfc0ac2", "comment": "Malware payload (Mirai)", "value": "5a4c28e9952ca0385d372877203136a9aa35e1c59112950ccedf4e1ef328ef1a9760536a29f9d885bc09a792df84cbe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250052, "uuid": "417ddfa3-1525-4cb9-8936-0daaf54fb241", "value": "T1088312478C3C2967D2E313FE2F4D4D43F52AE29A3C18F249C3599C2D1D51988EAA9D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250052, "uuid": "5555cf1c-9980-4779-a957-b723bbd9434c", "value": "1536:o0/9WZOrYu1PX1JcmWyufakE8tjrgdixynWtQkEiw4K+w9ix/a/TeQMv:/muP1lWywJtj6itQkEiw4K+4ix/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250052, "uuid": "584a0331-199d-4fa2-aee6-2ebbed3be8d7", "value": 82536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250052, "uuid": "3963a9eb-997a-48f1-bf1a-5538c3d20014", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250052, "uuid": "001a9550-3fe9-44fe-abfa-7d3c8a004dc1", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168405da-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312385, "uuid": "0ab7cc98-b852-4623-8c3d-54ad258ec455", "comment": "Malware payload (Mirai)", "value": "30158ef5eaefab784f41718dceddac1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312385, "uuid": "368abb01-bb36-496e-80d8-d9bc0eef2fb2", "comment": "Malware payload (Mirai)", "value": "56698c984e7ffcd5ea41d5567961bab0422f7615c977c30978799cfe154a51d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312385, "uuid": "31e1db60-84a9-4f19-bd9b-03d7c83f2544", "comment": "Malware payload (Mirai)", "value": "35900fe4699ba7ba413dd02f637dc8e02c825a81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312385, "uuid": "7455abc8-7d84-4edf-9719-0dbcbcea9025", "comment": "Malware payload (Mirai)", "value": "28c178f720ae942fb643a061e9ecbab893e2a26c33c7301ec188f024ab28c16bd4a75659d418dd56851bf19ba4c8f19c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312385, "uuid": "10acad39-99eb-433c-889a-c371a1de7eb2", "value": "T1A09318227E760E17C4C6A4B622F30B30F5B2AF5B28B8855A7C716DC96F646C032177B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312385, "uuid": "cffae8be-82bb-4d85-9d10-84144ac7e4c7", "value": "1536:hBoSbIMZPqpZbtO4I+WD8oSWq0pnxtfIRNWq5bssgNhst24M:hj3GDBhW/xlkNlVeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312385, "uuid": "8191fcbb-0ff9-42de-adc4-401253a35ba6", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312385, "uuid": "59bd008f-899d-47e6-81bb-bf2a47e2a57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312385, "uuid": "767ab5b2-8b4b-4ba0-8052-f4e9e4c2dcf5", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b7df5f-8174-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247172, "uuid": "c4f8eac3-b764-4e6a-9bfd-b3e49268dd21", "comment": "Malware payload (Mirai)", "value": "c7e3f8ace7b461f4ef6d513badcf93a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247172, "uuid": "8d184b62-9d57-4e1f-b977-5213d7972787", "comment": "Malware payload (Mirai)", "value": "56724d085143158238d02f1472e87786ff41e50f7a8d29fe254c427018065746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247172, "uuid": "a45bdeee-b9b5-4b13-b236-18e494ad8980", "comment": "Malware payload (Mirai)", "value": "f8ac156ee5b4051db1f80b2bdb29f0ec66710fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247172, "uuid": "18322093-1ef1-485e-b23e-669fce31d739", "comment": "Malware payload (Mirai)", "value": "74cb37d78aeecc241343b1b0a3236685732e0e256a067e26a225355432a1881a4239cee08862ba922999fa47e4bb6f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247172, "uuid": "db66b630-f334-433f-aab9-4c907c68e0ee", "value": "T1E18312D608F35EBCD2C23FF76AB3D852C957E259BB8D93324B9045EC1D16492C94182B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247172, "uuid": "f06ac1a8-cec8-44bd-b516-64a36bbdaa9c", "value": "1536:GeHyd8OLduiLgLTti0D6PpEn4k5U9/HZlx0Rv7nnpJDIQ0Jml78jbF+G8E+ZtKHq:G3TLduiLgLTRuPpEn1UxHZle7nD5Kmlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247172, "uuid": "918a1da5-22e8-45ca-8d92-810a89a408e4", "value": 81624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247172, "uuid": "cc75c39e-f498-441e-b8a3-01bfd33fc81b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247172, "uuid": "aca5fe4a-74e3-4b68-a941-fedf4d1b94e4", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bc09da-81cd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784285627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285627, "uuid": "19602966-919d-4c7c-8ca1-d4e2fe8feabd", "comment": "Malware payload", "value": "81cd67ee687bb7ab1fd0c36947e2f086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285627, "uuid": "f0c23573-b522-4cfb-8630-31ee0c4810ab", "comment": "Malware payload", "value": "5775e9da11dc238a1726f2c5ca4cf237ecbb9d3de01c14cd1cec6c6520460805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285627, "uuid": "7ab990c3-e2a4-469c-a23a-74fc9a25124a", "comment": "Malware payload", "value": "f83529829a560ea21bafea5f8cf77021c627e1d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285627, "uuid": "e62aeae6-3bd8-4e18-bc84-f2d481b63dbd", "comment": "Malware payload", "value": "155376ff41cfb9c6b27891ceab3c6109ed1c2942503db6186afd55a406e3572bd231ded89f9012573e9195b44cb6ba51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285627, "uuid": "e4fdaac4-5fb9-49b4-9426-17b1bbb6989d", "value": "T15DD36B1EBB93C470D55140B6B6BDBBB38129D934333644D3EBD1A8E06E605E269FCB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285627, "uuid": "bb4e55bd-a10e-451d-8f59-49073ed2a6d1", "value": "3072:vtM2+MMmTldlNsbzL3kir0g+NfztRs6UEO+xbMd6rBox9qYfluCvdxauPCjxVbdf:vo9auPCjx1dOx8aNUwp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784285627, "uuid": "3e4bd9b7-675b-4c3d-84d1-2a8169b6491b", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784285627, "uuid": "78882ae3-2cef-447c-8eb7-a6cbee2dda22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285627, "uuid": "9a4b9c9c-907f-4021-88f2-f62c02d70e9a", "value": "81cd67ee687bb7ab1fd0c36947e2f086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f667e768-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311472, "uuid": "520db40f-0cb1-4603-81e2-dddce7d191c3", "comment": "Malware payload (Mirai)", "value": "3675738c1bee764913b9b4b4c609df57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311472, "uuid": "fcf01c69-3d59-4932-877c-1ea9219f8463", "comment": "Malware payload (Mirai)", "value": "57e963385269719ab13dc1120fb1a6057ac4364ba82bd02b1066ac07dbba5620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311472, "uuid": "a7f351e3-e265-4549-83f9-1ddfec6c30bb", "comment": "Malware payload (Mirai)", "value": "537f0a137006c8b0d4deb2825e316e2f7caa22e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311472, "uuid": "41a06982-f924-4958-b299-722233b22241", "comment": "Malware payload (Mirai)", "value": "e0b0f71e3e6d57192bb59184ded232f457b49bd9397e1173277657ac19e008f64a1135f21500d346ce6921db1f60c946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311472, "uuid": "8efaf028-068a-4aca-9373-effa89593f3d", "value": "T17EE32941FC905E16C6D512BBFB9E42CD372627A9D2EF72039C115F21378A85B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311472, "uuid": "05c44190-1597-4918-800c-2c160c518477", "value": "3072:mkWGV5A+ea4W0jsMebuxk499qkUkopp8:mkWGVr4W0jXGik4Hqk1oD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311472, "uuid": "8c756376-e172-4d39-a771-e557984c9276", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311472, "uuid": "eccd8e72-0bbf-40be-8fb3-74eb372e6d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311472, "uuid": "627aaa07-aa5a-41c3-a5a8-3af3a046f7f9", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d105c-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284141, "uuid": "6262e061-e364-4d54-8ee1-225ebe161ed2", "comment": "Malware payload (Gafgyt)", "value": "5156c41a92da32acf4cb6a432c50121d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284141, "uuid": "306dc278-2ac6-47a4-acdf-943b994c8703", "comment": "Malware payload (Gafgyt)", "value": "58a51cd77e8960e176626daca6ddcc47fe3c27428f5c50af7b4c0dd484c1e2f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284141, "uuid": "0cfacb10-a37f-4f10-90af-eb2ddd9eaed4", "comment": "Malware payload (Gafgyt)", "value": "8298624ccbd7c16d700801af75e4cf7d5735cdb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284141, "uuid": "4ccf4cd9-1ee9-4843-876e-39fc9b39a758", "comment": "Malware payload (Gafgyt)", "value": "c4bed6b956c62d3c0bd1b34fcf001525acb014070a4045586922f4f2a747da1818a7fcec3484585f37efc27440b2e422", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284141, "uuid": "d23049c8-3eaa-49e6-9195-6a357cc8a8bf", "value": "T157933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284141, "uuid": "f5c774d8-bebb-4818-82fd-51d6fa84eb0a", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Ql4umXxVqDrstKfz9e:Q97vk51RcG7Ael4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284141, "uuid": "ea98c0a6-b593-48ab-998e-71bd5daef880", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284141, "uuid": "3bfbde8c-2483-475f-a419-035ace583cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284141, "uuid": "d58a2d9b-cf6e-4157-8402-ee8b2afde9c8", "value": "ppc.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef64808e-8180-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252619, "uuid": "79da5c00-b0d3-443f-99c6-fcb48de69083", "comment": "Malware payload (Mirai)", "value": "b01db963647017060bb234d611f97e1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252619, "uuid": "c839a064-c9f9-4e12-b791-35b6c3034700", "comment": "Malware payload (Mirai)", "value": "58c8bfd399a9734077089dd88ef9efc22751ea002461b52ff744180fb3e366f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252619, "uuid": "c6c5b138-724e-4b0e-8a77-28fa7b92e018", "comment": "Malware payload (Mirai)", "value": "1f3b0bdca85b3476db2d009572cc43e6d969b156", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252619, "uuid": "1bee739f-eaf5-4114-b27a-89a30368eac9", "comment": "Malware payload (Mirai)", "value": "57b2a5077cec270b6b27d5613d4b9bd0ca5a52f6b0384007981567372251499427291ef6afae4a1c09dd27f5eee539e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252619, "uuid": "05db2fc1-7a04-458c-a02f-a3d64930e355", "value": "T15093F781B8824A6AC6E02379E66E718E33A0B3F5D2CF3127DD615B11779518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252619, "uuid": "b40cce8b-09ac-4cba-8d82-86706dd79d89", "value": "1536:9m0L9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthSDH8ku8oeIH:9rBq1BtD6wq5UIORIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252619, "uuid": "c54b7b0f-3cf8-4871-8f42-91426326e486", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252619, "uuid": "180d1ab9-8109-487c-9e12-d91bf4dc9892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252619, "uuid": "c7acab03-d3c5-4425-ada6-ff7224bc7206", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c03176-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325134, "uuid": "64b48310-7f29-494e-8119-307cf1e5a1e3", "comment": "Malware payload (Mirai)", "value": "3d28a15f9500288c6069e9fde30d143e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325134, "uuid": "7a03074f-62fb-4fb4-840e-6bf30805a82a", "comment": "Malware payload (Mirai)", "value": "59109ba34d20b4dbddce0f2cae0c71c4b22bf823c37e8cb88baba3b170896cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325134, "uuid": "1ad518dc-6b1c-4ce5-9bbf-f8aba17d97e4", "comment": "Malware payload (Mirai)", "value": "62d760cd63564c83b5aa51a1487bc84fd60a39f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325134, "uuid": "67ee8ef0-9c15-4b83-89db-83d5da1c8208", "comment": "Malware payload (Mirai)", "value": "1e79d059a6817819254b0b61c0808fe5d6f882898348106f64b9c18a16d993b16249ca6bf74facfcc83e8d6c705dd4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325134, "uuid": "515aa7c9-ea50-4608-8cbb-ee23c5239551", "value": "T1D7538D76C5297E94D25442B0F871CE751B63B48482871FFA5A9EC2BA9083DECF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325134, "uuid": "1990bf7e-e3e4-419b-b21e-8e89a886507d", "value": "1536:KabZwtq+8o2FsF5+XaZs4fTA4XmgKOvTSl+ToDCULKhVtms/U84:K2u8o2Fsz+XaZs4rA4XmnO6+ToDncTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325134, "uuid": "21bc72d1-01e9-4efd-9f39-249869521be6", "value": 64524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325134, "uuid": "44957164-c2eb-4142-8b91-de2b4459af7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325134, "uuid": "b3e37410-ac6f-47f0-a81f-f60349da579d", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bad547-8179-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784249212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249212, "uuid": "5f2ec950-5f5f-447b-9da6-f0129904dcc7", "comment": "Malware payload", "value": "c3af7d9a198a31e3c667a1789488811c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249212, "uuid": "7469ee36-dda4-48e3-8c9e-c131a12a8e31", "comment": "Malware payload", "value": "5947a93487ce560122175027f194386b6362768e266376a26ce90148f806fee0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249212, "uuid": "a6dd8845-5be7-4198-9008-01c7c54fa8cf", "comment": "Malware payload", "value": "df8706e55784e02176403d089215d06cc3b44d91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249212, "uuid": "9fa70b08-51ea-4fc8-943d-c44ece0bfee4", "comment": "Malware payload", "value": "8e47fecff5a98b7f32419c0deca73dddf953320b0a9e17bd138d6f351dfd33d31806d3050e840e2813d06c0051e9dc01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249212, "uuid": "119768e2-a543-4c9a-9fbb-0fffd79b1dbd", "value": "T152C28D966A867C44BEC94A3E4CBD2B1D6DF4C3D1324952AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249212, "uuid": "de91e4ed-ca45-4c33-a855-bcc890dbd7a1", "value": "768:w8vCB+25j6es8Rj9FYpMSUpi+20qUpi+20YQX:w8l25Jld2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249212, "uuid": "c2927b32-92c7-4ff5-8b66-2975a9018374", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249212, "uuid": "15a5c5c9-68a3-4fdc-9373-cc3010381bda", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249212, "uuid": "d66cc124-a6ef-49ba-9c88-271bdc6faca1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef6d226-81d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1784289636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289636, "uuid": "f6edee1f-787e-44e5-a5cd-0f0fce5a1300", "comment": "Malware payload (PureRAT)", "value": "b4400998cf293b0767455fb37526b18e", "object_relation": "md5", "Tag": [ { "name": "196-251-107-6", "colour": "#855D15", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289636, "uuid": "2039f086-6844-4922-a644-cff5daf17a94", "comment": "Malware payload (PureRAT)", "value": "5a3938aa0350f3bf94c8f12cab8b9b0555648c20176fe9166a91240c4b27fa18", "object_relation": "sha256", "Tag": [ { "name": "196-251-107-6", "colour": "#855D15", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289636, "uuid": "b50178e2-8500-4bbc-8ceb-4900a3bbd780", "comment": "Malware payload (PureRAT)", "value": "f055ec7c63d01bde2d6aa1b68ee62c0dd87f076b", "object_relation": "sha1", "Tag": [ { "name": "196-251-107-6", "colour": "#855D15", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289636, "uuid": "2daa7c37-b7c4-450e-bcfd-56863210c4d5", "comment": "Malware payload (PureRAT)", "value": "55269c873c035f9a875ff40470f2284a3f5471ac335b1914cbbe94e103933dd6cd26ea769482a0b04430214a92c85612", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-107-6", "colour": "#855D15", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289636, "uuid": "9d5410f9-65b7-41d2-86c7-a502a575b372", "value": "T12586E021B382C136D56D0177E968FE5E1938BE730B3101E777E8796E49F48C2A279B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289636, "uuid": "03d163a4-ccf5-4372-9911-bb74aea8d8f1", "value": "49152:Z2CKitd+vszAlozTy4g5z8+5eNBA+Y2pbD2wZYHcz5g384rTN8CB9cLKpP:sihTy/kpbD+8Nm8CTN8CTcLKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289636, "uuid": "48ccd2c5-4206-4688-b0bd-9fc1ceeec8cc", "value": 8458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289636, "uuid": "07999b18-0b21-4966-a11e-e4c1698adad8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289636, "uuid": "a69fe131-2e74-4123-b177-50c5e0a2174c", "value": "FLStudio2025 Crack.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a3aa1-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284133, "uuid": "53e4266f-1aac-4986-943e-75d11892ae86", "comment": "Malware payload (Gafgyt)", "value": "c2fb8017e111df9e3bb778875c3677b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284133, "uuid": "ebbedbb7-6fa7-43af-a4ef-9c32c358090d", "comment": "Malware payload (Gafgyt)", "value": "5b023d173d21d1605028f0d301e0fd93149eb9a8c85e1b62ff0a0d2d2cfe237e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284133, "uuid": "94e727ec-2fe4-4459-88cb-63da9a7ec82f", "comment": "Malware payload (Gafgyt)", "value": "712ddd1b742243594f3bfd974022bb8dfd7aa51a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284133, "uuid": "8e875613-46f2-4be5-8405-2d685c9f47c0", "comment": "Malware payload (Gafgyt)", "value": "620415ea89251a053545bc02061d74391950af2ff60a4b5cd082c119b3604648a6d96370946cc19fc851ef7052a2561a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284133, "uuid": "c040733d-7988-404e-80d6-4a87d6c002bc", "value": "T152935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284133, "uuid": "7ad70c5a-dfc4-4faf-b22a-0bac82da6bac", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK32yPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKGifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284133, "uuid": "1ad99f27-d135-4070-9cb5-0d55af94acd6", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284133, "uuid": "ea97218b-931d-4715-a1a5-051a6abd4731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284133, "uuid": "626bba0f-7162-4c0f-a1f4-f4dd989d1453", "value": "yarn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c7607a-81b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784273643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273643, "uuid": "5da31f24-6174-4149-ad9f-b915f8ba188d", "comment": "Malware payload (Mirai)", "value": "3350b991978e1db9e87555ea92df2cd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273643, "uuid": "589068e2-eb5d-4bd0-975d-4a8854787f0c", "comment": "Malware payload (Mirai)", "value": "5b2af9ac1c8d073d038cfee2768d2ee6b4284f665c0cfcc941463bb379c27e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273643, "uuid": "716138bb-1811-4e73-b7dc-e0a75f413b3b", "comment": "Malware payload (Mirai)", "value": "a446a3b091dedb8d988ca724483d07318265e04a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273643, "uuid": "e6e92932-a196-4add-add3-fb0aca7580cb", "comment": "Malware payload (Mirai)", "value": "ca791e27a7071259175d199a9d27af9578c8af9383ef1ba58d733da55f866f6710a66a651a3e5d7cb99b9ac590fcd1ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273643, "uuid": "8ad3817b-ce78-4866-a3b9-927042b77ebc", "value": "T18EA33903B4C088FDC18AC17817AF763AD972F56E0139F1FB2BD0EA166D4DE215A1EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273643, "uuid": "2a79620e-8c09-4b83-a531-a100dbd1bba6", "value": "3072:EpSf3dIub3tZGahSksTYjSSxYo2V1E1oRi6LbLMfs+Mo/Uu:MSmub3tZrhSYjSSTiax6HLSMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273643, "uuid": "62a19034-6583-4ed1-8ae1-9802f0211aec", "value": 101232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273643, "uuid": "c52212c0-fa26-4539-8a78-93524e96b5c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273643, "uuid": "5fdf3799-ea13-4191-9c78-e21ce566ed9f", "value": "nerv.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130a570a-8176-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247955, "uuid": "e73a58df-2e72-4445-8e88-1d662e92355c", "comment": "Malware payload (Mirai)", "value": "f725ed6036e7c6947c361fbcbe5d464c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247955, "uuid": "f2555f49-d09c-45a8-9512-f1773ce06653", "comment": "Malware payload (Mirai)", "value": "5baaccc34a67d2217d67b45da0776bf139f63f45f5f40adcbe39cedbc7a31c5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247955, "uuid": "ccadbc61-5aba-48b5-88c4-45c8b0df6717", "comment": "Malware payload (Mirai)", "value": "68bb6ad005be6c0ded2158a3d7aa1893b7bfe30c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247955, "uuid": "37b95e68-cf6e-4d33-a374-51c8e9d26a41", "comment": "Malware payload (Mirai)", "value": "b8a713daa56dfc0307648a272adeb3784514bbdc6d98cacd178238df131a8c1435a09e14a84f2f30a7b0984a24ff74fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247955, "uuid": "360f5c15-97a8-4f12-b67c-19b8833a0ce4", "value": "T172C32C99FC90DE52C6D1267AFA5E418C332357B8C3DA7205CD209F3477EBD5A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247955, "uuid": "66ba1ece-2b22-4711-904a-56f2ff00f74d", "value": "3072:KGTno9FSNuuBvo1iyk6UQ4g8OECqFmiPF9hS7amQ3f1Dlr:KGTonSNuub6UQ4g8OZqFmQS7aJ395r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247955, "uuid": "d0b0d548-6a76-4370-8f60-49b0ed5a8d69", "value": 124356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247955, "uuid": "9b247ea8-5c9a-41d3-a828-982558e71682", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247955, "uuid": "f14e57d5-f1b8-411e-859f-f4545a1362e1", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c4c3c8-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267099, "uuid": "40e3468b-cc3b-44d9-b1dc-e755665acf18", "comment": "Malware payload (Mirai)", "value": "8b93e34fc3d71077f52552a3ae2477ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267099, "uuid": "816ddd10-302c-415b-ad0b-d4c2989fbe6e", "comment": "Malware payload (Mirai)", "value": "5c41fa829d65876cdad133bf9fcad3860e3a6e95ad599d425dee97043cbce7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267099, "uuid": "14ee81c7-ec04-481a-91f5-aa48b8c8729c", "comment": "Malware payload (Mirai)", "value": "e3abf6b3e6e820ff92479a24a5d6a33177407b3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267099, "uuid": "fdea1ca7-6f09-4b05-a747-afa3f7fcfea6", "comment": "Malware payload (Mirai)", "value": "f3d8f2133d8210b52358bd2921f1120cea5ac98e424ab49231c056095611cb4c195d9e69aac9192c0ff32fbb1c4b965f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267099, "uuid": "0c74f6de-8469-425d-9cca-cddc4ddc7d2c", "value": "T1FB432B96FC9245AAC7C117B6771A978A33626369C2CF7313CC080B517AC9A4F4E67F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267099, "uuid": "16b59577-2045-4ee6-826c-82e13ca8cf1a", "value": "768:L2uoWs1gISk7nchvb6bKkWqeTE/aEZT1YrR1nlc428tMz2F30npzF2s:LAB1gISkuvu9je0a0pYrR1nlPkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267099, "uuid": "b6da61c2-e334-4150-8894-0844ab569df3", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267099, "uuid": "cf94b753-4609-4eb4-b21a-2dc605a9caaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267099, "uuid": "7abcf87e-e282-433d-b6e0-2e5571c8e963", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6491621f-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784249809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249809, "uuid": "6efc5260-61f0-4c0c-a701-8688f50aca9a", "comment": "Malware payload (Mirai)", "value": "7e2868a711f8efd7beef0e7ec1c1ad09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249809, "uuid": "d3f8d5c1-d5e9-4ea9-a7db-fb6c8a36b871", "comment": "Malware payload (Mirai)", "value": "5c8b631173fb1e60c3435613ac2620aa4e62fd10fb2f95ac07bb753d3355867b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249809, "uuid": "845367c2-47a8-43cc-b7c0-b72b0269428d", "comment": "Malware payload (Mirai)", "value": "49b9b125b0e47012bc1afec372a9bdb9dcb43653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249809, "uuid": "96857c5c-1640-4ec3-bc81-036f7bc292bb", "comment": "Malware payload (Mirai)", "value": "f16ffaec5339c0a06939375608627792bf1268558625a9c58dd31d78cf3c1afa04e4d3a6a2f0dbde8466dbf42ecd8d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249809, "uuid": "b00dc0e9-e53e-44e3-88fc-11985c008de9", "value": "T16E237C46E643D4F9FA6B06B1103B97164772E8394039D756CBB96932ED33A00D72B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249809, "uuid": "175a6e42-f1a0-4b30-83e9-c72f93223536", "value": "768:/FbMExhkby4yX6KWHPJJ/KE88vY1vwv7q6Xw8SJ19LhBb+IRdSjII4:/hvJ4A7WxQvwvW6XCdf3dSjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249809, "uuid": "3caf8060-082b-4697-938f-8520d0b583cb", "value": 46292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249809, "uuid": "4fa22416-8c4c-41ec-a248-85d71d6c4a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249809, "uuid": "ab236944-588e-42c5-882f-32f7bcf041a3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d0f5ef-81a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784268335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268335, "uuid": "22f87106-0de6-46fc-b76b-7c07dc474b73", "comment": "Malware payload", "value": "7eca685eeb34cd9c083634c8360124eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268335, "uuid": "d2e349a4-df67-42ee-860b-4f93110dd891", "comment": "Malware payload", "value": "5cbe06a38642b5067e5e257a4614984dcc76b6b37ac8b299018c5e5ed1700df1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268335, "uuid": "6c749081-7ae3-4380-bfd2-a04089588fa4", "comment": "Malware payload", "value": "d81bf8019c9ed7bae8a0c18e051d7e6d424729b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268335, "uuid": "78806d4e-ac54-40bf-82f5-a2b95981a84a", "comment": "Malware payload", "value": "49c916b9198252d7527a122fc502b55f635b07bca6871f29b1a8429e4f676ec50408aa84ae91b0909114fce7f44a8c1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268335, "uuid": "082cf4ff-eeb1-4530-977e-b92e02c9dfb5", "value": "T14BC28D956A867C44BDC94B3E4CBD2B4D6DF5C3D1324942AC3D8A3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268335, "uuid": "9594747b-894d-4e7e-a451-5d3f7a4113c3", "value": "768:8/8vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:68l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268335, "uuid": "28318c89-d0f9-4cad-9dac-8a6be3860f76", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268335, "uuid": "d7dff396-7ef3-4f0f-9d46-07dd47caa722", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268335, "uuid": "5980c415-7b4c-4386-b17d-02ed6969b186", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c6877b-819b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784263928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263928, "uuid": "a824fcea-981f-4555-bccb-0af845426c10", "comment": "Malware payload (RemusStealer)", "value": "a4a2ab8a641059800db10989bee83953", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263928, "uuid": "70192219-e2b4-4b91-acea-69e59c9a6577", "comment": "Malware payload (RemusStealer)", "value": "5d38468be1bebfed0309c68875e07a6d2a5d928f4117c7293f3e04c30811d361", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263928, "uuid": "83deeb6c-feff-49cb-851c-92b604309899", "comment": "Malware payload (RemusStealer)", "value": "d4abbd7a388a657a8635158d4002b42f98cabec2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263928, "uuid": "400dd7c0-3ae8-49ad-a7c4-2dd324477d50", "comment": "Malware payload (RemusStealer)", "value": "090da6ed3c882b9bbbd4fe52feb5a73c34af2cdeeb6d56a6466812d5a5174371524a9fc7f5f1a851e407eb448f391112", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263928, "uuid": "6a7730ce-c9a9-4428-bf07-b3f5e42a5ac1", "value": "T14ED53385CA97C900CA55273699E6E3314370CFC9F123E62B16EE4FCB79337A99E51241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263928, "uuid": "3cf1a99e-adf9-4fc2-acc0-feb34b0c2c5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263928, "uuid": "07c145b4-8346-4132-a035-0f88aacda059", "value": "49152:dRC5koKwWlbdvN2ZYMmje/UxlpvbR89//JpM09Qg/r8CXY6yNl2tai5u1K7U+Ho5:7RdvNoWmcqM09tj3I6yri5u+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784263928, "uuid": "758a9b9d-bdb8-4088-bd0b-67b4998734b4", "value": 2848768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784263928, "uuid": "6e27702b-068a-4f99-92c5-ee8b91f086c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263928, "uuid": "69778bb1-292a-4dc6-88bf-026dc7a773f9", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f41e55a-8182-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784253129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253129, "uuid": "8d438bba-8cc3-4232-8537-d1ce4cdecb7f", "comment": "Malware payload (Efimer)", "value": "e8c3c8d8b522b6c0879c364ccfbf38b0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253129, "uuid": "24991cff-d524-4cb8-b76c-e6b594a99dbd", "comment": "Malware payload (Efimer)", "value": "5da44e36790d8bb2ab51d7b70bbc25063d8236b959a3452cbb4bc41b5bcd4966", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253129, "uuid": "ff4d191a-c4a9-4964-a901-0f4f4b36fbbe", "comment": "Malware payload (Efimer)", "value": "265109b8a26b6602bc5bcbb300fc7d38e7d07936", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253129, "uuid": "74de3126-912d-42cb-b5f5-0bd35155e9fd", "comment": "Malware payload (Efimer)", "value": "31e904f1bd3c596e3d9055a3980426e68151cb49bffa93417f385fb186ecc4f9f31e372d27a1eaf39d395331590bf699", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253129, "uuid": "14694de9-3fc7-423b-8fd0-afdbd0ef785d", "value": "T1BCE63358BBD002EED8A3403CDBE191DEA69974771B31C59F57AC43A65E832E08E3C617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253129, "uuid": "2821c602-919f-4d51-b780-f263839064c6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253129, "uuid": "0166da79-baeb-41d1-9f80-7edbe486e7d7", "value": "393216:dTqwYdIi8pp4cBKeB7+Sa5JnoXMCHWUjX1cuI3/PGTAI:dOkTpejeB7+S+mXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784253129, "uuid": "98885e0e-a636-4d8b-b330-07c9e7ac3175", "value": 14299267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784253129, "uuid": "fe9c6dfa-7cfd-49e4-b594-f65a8c7f8ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253129, "uuid": "bd1495c8-4cf7-4035-92ed-83998ff0eb33", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72765f80-8177-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248544, "uuid": "a674ff89-c44b-444e-815c-4d1625e25c13", "comment": "Malware payload (Mirai)", "value": "a937ce1d6eee9ee44d89c80e4b7569ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248544, "uuid": "3a597f54-4544-4813-8848-3289f1ceed76", "comment": "Malware payload (Mirai)", "value": "5e1dea6db2c27f33766997b67f3a2dc95ba58fa7e5851a30de8b074fe678dc31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248544, "uuid": "873dfe4e-5459-4175-be18-d182c77eb233", "comment": "Malware payload (Mirai)", "value": "c2819ca06df3a83ea7e25a6661652868d391f7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248544, "uuid": "2c6eff19-2b48-47c9-af35-43fa961717b0", "comment": "Malware payload (Mirai)", "value": "91fd6991d83586bb7d1854650135a61e1463e9f833c32e4d50d9d6900479df4601757149bb33f357d55dccd65dbb6195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248544, "uuid": "a150c018-5e26-49dc-aa32-f87ffe9c1463", "value": "T1B6147D01FF180953D5522EB45A3F07B6E379D88318F9E009190ABB561733EB7A6C7B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248544, "uuid": "4190fa01-fd72-4949-b46f-9a0d194750cd", "value": "6144:kTgJqVdY0NPcpBjwAAkpOpLqo0nftfQ89:B4PcWeeNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248544, "uuid": "577b2db8-9ac4-4811-a288-58aa32a69fd6", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248544, "uuid": "6ba502f3-047c-4f4a-b973-da4a561ff6a0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248544, "uuid": "6b2d2e72-110c-4f4a-8c4b-7e8ca4614a1f", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa063900-81da-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784291158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291158, "uuid": "fe344f74-d2e6-426a-b768-6cef0e2f9a25", "comment": "Malware payload", "value": "0be5f0bddbcae34d1025bc3fc0318d8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291158, "uuid": "d1f209e6-dc37-439a-bc04-1ff54bb964e9", "comment": "Malware payload", "value": "5e470bf589c80265b0fd06716f2e0433e933d9808339a172a2a8c476d9d24abe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291158, "uuid": "f6fb989c-0ef1-4ecd-9992-cd18cbb9f8d1", "comment": "Malware payload", "value": "8e0409cdf3272b9a17ee678537aa45c292deb426", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291158, "uuid": "652820e5-3058-4275-9861-c7ab29ff7031", "comment": "Malware payload", "value": "82c83625f46c0ab8bf0509f01caf00e6d0e21004e2560b552be0b45267b1eddf287a9b07594e7763bd6e51ec6ba67563", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291158, "uuid": "75f5ddb9-c34c-457a-82a3-244e8f8c2a1f", "value": "T1D2236C6516857C14AE99C4365C7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AC9209B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291158, "uuid": "4a03acf6-7ad8-4a2d-829a-da1f1908cfbc", "value": "768:c9r9NyXsZztCT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:cFHusZZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291158, "uuid": "22a50da9-c35d-413f-a42c-600f90c263da", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291158, "uuid": "18dd3d2f-b1d9-43b6-8f7f-1355b194ad4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291158, "uuid": "31ea1e4e-ef30-4d10-9ddb-c010efb24aa2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7ef8e5-81ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784271079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271079, "uuid": "b7e2daa6-75ea-47cc-aafb-70ebb57cd3df", "comment": "Malware payload (ValleyRAT)", "value": "a792d630bf03668221f1ab1a072f2a9d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271079, "uuid": "bf9d70bb-4d8e-4de8-b8ce-381d980dad10", "comment": "Malware payload (ValleyRAT)", "value": "5e486a8844c2438739e716277fba2e231af00b5b89c09cfc5ad127acf2525be2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271079, "uuid": "090d2c36-2c1b-4688-9f15-2d7ffea43030", "comment": "Malware payload (ValleyRAT)", "value": "091c56a6d9dc40ae8b0920b799db86840afd68dd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271079, "uuid": "d98f3fd1-1541-49d2-8893-6530d63bdd71", "comment": "Malware payload (ValleyRAT)", "value": "e90ac6960991f8fc2dbbe13c6a48db0cf50af8c0160c863607b3a4f5041f130937f0306c46a572b9faff26fa02a1a5cf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271079, "uuid": "9d2fa231-7aac-495e-8b28-74e697554bf4", "value": "T188A633EE78CE6BB1C04BC370948B9E2E7D053FD0B9664D0279D939306E70A5A72B5349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271079, "uuid": "080c8564-2608-4877-8bbf-3b590ff1e59a", "value": "196608:Cutu9jqVKqJDB+rSVs8JQ8U/lTa7SD4w521Z5K4F2oXhDRYBQ:wdiXQrYs8ptB1Z5Bgc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271079, "uuid": "a59b81d9-a1c8-49f8-8ac5-b009cc7b53be", "value": 9965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271079, "uuid": "38a219ea-5100-41c8-921a-c46004bf1db5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271079, "uuid": "b7f7fe91-4d21-4a30-bf81-bb1bc5fae157", "value": "appinstall.88tt000.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006e2b0e-8194-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784260808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260808, "uuid": "f2f8704b-3917-49a7-9f33-9d915d628aa7", "comment": "Malware payload (Stealc)", "value": "9795b819d38924f27de9c14c2b5b03e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260808, "uuid": "9e32f062-9397-4516-b5a6-237f77a80189", "comment": "Malware payload (Stealc)", "value": "5ef1aa40084a122011be62539f8d67aebcf7f9a0b1a31e6a057cbd1726a2b575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260808, "uuid": "37dbe63e-7b73-45ea-ba00-ecb18c7df530", "comment": "Malware payload (Stealc)", "value": "151e3eff1aca5ca6f97d079da44d7bb7654b01d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260808, "uuid": "12e950f0-306a-4524-b287-022d4a48acc0", "comment": "Malware payload (Stealc)", "value": "25d54a9de640ae00317096ec96538868d775fa20e5a61af9d5d41ff09a6b022fefb4df011aa2edd13444f771426e8d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260808, "uuid": "926b2fe5-e3fc-4348-8ec2-e3904b5fc727", "value": "T171341A25EF80447EED12817CDABA73D2B12669A46312D8D333C8165E4DF40E32D7E6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260808, "uuid": "eb621a39-1c24-4d2f-aafc-589c41bd9642", "value": "d071ac95ea1d6b0ed6ec53017449901f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260808, "uuid": "f51d0705-5f6c-45ce-8bc0-0cc645cadfc0", "value": "3072:s5bqr4G60J2/fwHt31f6wkh81YlofbijZC9Uof5l/IbI6RD3Xs:6eql/fYuMcIedC9f5ZIcAD3Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784260808, "uuid": "fe5d16ea-2850-4394-bd2a-94dfc6abccb8", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784260808, "uuid": "34872684-abae-41f4-8951-0e12446a7fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260808, "uuid": "d91b6592-0ab1-43b9-b74b-a9d57ee0f7b3", "value": "9795B819D38924F27DE9C14C2B5B03E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac36bad-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272073, "uuid": "f4963ee1-c950-4ae8-93c6-acc09808dae4", "comment": "Malware payload (Mirai)", "value": "9c1a5bb7ade0df3ca454bad725beae94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272073, "uuid": "42e63d31-5438-40c6-96fb-b8e56c4591a3", "comment": "Malware payload (Mirai)", "value": "5f492ab6ffcdc5bde4ef6593ade67dd09741b1605e003c9755bbcc11375077f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272073, "uuid": "25d97810-245e-4c29-af73-c30410135eb5", "comment": "Malware payload (Mirai)", "value": "d9cf68b2ab56e8be5eb218b3b48816cd27bcec49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272073, "uuid": "44872905-1015-4cf4-9591-cab5cbbee44e", "comment": "Malware payload (Mirai)", "value": "978451e516d30d4323d0f1a87434168fc51e407c4e8707525e0b86d9c4547f2f7cf9a52353e04726b1803ae993230066", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272073, "uuid": "578c10fe-bf41-4026-bc2b-d6030fcaca24", "value": "T1C6631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272073, "uuid": "a1780934-d189-4328-9817-86810f764b08", "value": "1536:XGBQnw68oqNi5Imzh/GIw+D3ohyaRdWViEs/hX:XGBBa5NJ1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272073, "uuid": "51b07fae-b7d7-4924-909a-118fc7f46e4a", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272073, "uuid": "699a0aff-9e1a-4673-9477-599b7a280279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272073, "uuid": "39f8aad9-a250-4e5f-9f4c-44697b3e424b", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0e2367-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311379, "uuid": "51eb6455-5874-4a8d-85cd-9ca0192f37ee", "comment": "Malware payload (Mirai)", "value": "eaa9c5e5ec639e681a972cafeadff4e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311379, "uuid": "b19a8552-4ba5-4617-90ba-08c5021f05c3", "comment": "Malware payload (Mirai)", "value": "5f6b5da377255bf624c52e462d713f54dc0a3829373342cd9272d4b929b68036", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311379, "uuid": "c032de94-4900-4b38-aef2-e946de66672f", "comment": "Malware payload (Mirai)", "value": "430a4c1f7f25bd49acd08f67064360ee0a0b2d33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311379, "uuid": "26d93b5e-79a8-45a1-bfbd-222b3307ae00", "comment": "Malware payload (Mirai)", "value": "7d7c251bb47a0ba21aab27d73fe8e2ac7883488767ceffb65e04dfdb41d7b9d77626fb821bfc06d1b697643f2587279d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311379, "uuid": "d6b0aebe-af29-40e9-865e-cadee7b1de3a", "value": "T12413F1E7D6D8CF14EA7BC637454E3CA688C2C20AA1508993F64434770D6FAE5153CEAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311379, "uuid": "bdf7906c-b932-46f5-b863-40629337a860", "value": "768:XrFwcrK35S82Ka+sN4nyExnNB6/X20AJx7wQmNqUrfdq9STXty0hQlChinbcuyDv:XrCQKa+7fiG0OlyNfVJy0ilIinouy84j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311379, "uuid": "02a7760f-3324-4254-8558-3712c4440389", "value": 42604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311379, "uuid": "0149acbc-0c7c-4e04-a486-029edfc63a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311379, "uuid": "ba4b7898-8cae-4df3-9270-ef9fca8c4d73", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9980f3f7-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278674, "uuid": "85e457ba-1f6f-41ba-9c6b-689de4daba09", "comment": "Malware payload (SilentNet)", "value": "78a95e88a42c54a09ff97f8221a943e7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278674, "uuid": "57764c20-1539-4dec-89b6-539b72763700", "comment": "Malware payload (SilentNet)", "value": "61a574f58f0ff9e1ceeb6088d726c604d43c6e7323c702ea90a69de3cf00402b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278674, "uuid": "3b8b6808-7d23-4e0a-8e5d-027bb6be90cd", "comment": "Malware payload (SilentNet)", "value": "4a69f338571c49fb5c8b7cab988f8f3160d7abb1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278674, "uuid": "723ad9cc-5c2e-4397-a6c1-f1fc5c023721", "comment": "Malware payload (SilentNet)", "value": "0a0ba7fc373391c1ec54b1964940b8088098b6387ad004febcabda5dbe87112859dfca7533785d336ef2b598b488bb42", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278674, "uuid": "5c9b343b-9561-444f-b621-1e7c3ed47243", "value": "T1A27533A154021AEFE7FF54380BC20FE796A738F9B2D14C7A21A11FB4367C217A25B456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278674, "uuid": "4db339de-5b18-40bd-be6f-70c744e60eb3", "value": "49152:AYCnH5cnUhHDVHDkcAPvFn3czrQzzsh/ScfbIISB0:eHKMHrY3czSYh/SaSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278674, "uuid": "3d66008b-f728-4086-a11f-0eea4a732c5a", "value": 1650105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278674, "uuid": "73d03206-e8dc-4d33-8880-6924b1fcd912", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278674, "uuid": "7bfac793-f662-4920-b722-b60ebd474ed0", "value": "Kryptonclient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de45e69-823b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784332718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332718, "uuid": "af314d80-cd78-4052-a361-d2fb8f9d3ea7", "comment": "Malware payload", "value": "e261745902c9039c29cdc8e6e1c4c55c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332718, "uuid": "83c93801-907b-453b-99b2-301a2c182bf2", "comment": "Malware payload", "value": "61eb8e47031b9c5ac19f887926f3a03604ae1dec521dad76db3136a1469be7b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332718, "uuid": "1e2b6462-c9d2-427f-ba2e-0705ce55d068", "comment": "Malware payload", "value": "a9ecdb339591ebc296912bba8c4a1d32bb03f765", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332718, "uuid": "6f21a012-d672-46a2-a3c1-74d12474e7fd", "comment": "Malware payload", "value": "b44941a347ad27fc14ed4eb5a6873ecfb839793b30ad83c7cf4dc1848c7dc7ec4a8fb1aeac8483a2ae75ef588227bff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332718, "uuid": "f6f4a600-7c63-4c9c-a4a0-becf808e9c14", "value": "T11323F12401F66E54B21F87F7595EFB1A2F2464566621C6C731E0E070A2F3B3F0B386A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332718, "uuid": "b80b634f-bc76-4047-b9b1-e40769957709", "value": "768:vYcUTiSFnR+ZW54r03UK12jc8/xCrNhRQeccxdk05pHFFGxhUWVuA5cF/1nbcuyL:vYcUTiMnR+1rKm9gTRRcyplFGxn35cjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332718, "uuid": "9e655d80-8e6f-4f42-82ed-86c6db58202a", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332718, "uuid": "3f0382fb-d938-45dc-9d5b-8356437eb5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332718, "uuid": "63310290-eec3-4dab-be74-e18db63bf507", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbba6657-8208-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784310944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310944, "uuid": "38e22dcb-cd57-4a1a-810d-e3cc1fa54094", "comment": "Malware payload (Vidar)", "value": "d69c6b53fb12df8ad12ca6711fe87c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310944, "uuid": "79b42946-4e90-49d6-a9f2-bf35fdd8b223", "comment": "Malware payload (Vidar)", "value": "6263a5f329150fb5cc67a8ebac6c011d385dbfd6e1492b0b133f7061eacbde00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310944, "uuid": "61c09c0a-ce76-4c0d-bf09-39e101cde453", "comment": "Malware payload (Vidar)", "value": "b9f2d506b8aae15f951117e78bfe7bdf2bcfd788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310944, "uuid": "2265e310-b478-482f-b525-e4eb303d9457", "comment": "Malware payload (Vidar)", "value": "01c82c1442b6bb46139f51cb612df978b109d1cf4b5d52c684b9ffc7e8cf843aebc82b854eb9725bf81e630eddf63d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310944, "uuid": "fbccfcf6-a940-4049-9c26-36ab7ccb9b54", "value": "T154F59D06BCE048EAC0AD633188B752A2BB74BC080B3527D72E90B7782F767D55C76B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310944, "uuid": "4a9b0d04-cf5c-48e1-b80b-7683d53c6547", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310944, "uuid": "8a5baca6-50d1-4d99-8bbf-e2096b0a218d", "value": "49152:N5IjEu7vsyLIS50Q7jT4kh8t4a3FwIlNDMbO8Kl:NPXqPXh8rW6NYO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310944, "uuid": "4757fc7f-1985-497c-b25f-a87cf28d96b6", "value": 3341696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310944, "uuid": "318ea749-ffc1-4e13-b94f-5e7fb10a8632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310944, "uuid": "3778ff4a-ac42-4988-8d6e-f08e150b95ff", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa01ad0-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267088, "uuid": "ca303ed0-e764-457e-bfee-99d21141c3bb", "comment": "Malware payload (Mirai)", "value": "939b5a7d3862ecdcdf704ea7e1b19e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267088, "uuid": "df8bcbcb-d18e-4373-ae7e-f1d3302acae5", "comment": "Malware payload (Mirai)", "value": "6365c8fc3654408b130a5b5709cd8ee3dacf992e251d981e5ef74fec7fb9f6c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267088, "uuid": "003ffe83-c13c-4f2b-a9a4-8fabc97176b0", "comment": "Malware payload (Mirai)", "value": "d95646baf298f3064c1fcb52d9495893da68e3de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267088, "uuid": "69bb5b1c-560d-4c36-b4f7-b2132ee06f04", "comment": "Malware payload (Mirai)", "value": "86f4cf4d792b1f0cc9ca8c2195fbac98cc19ae5c7834cfa4945295757adadd883368cc7165a09788d78de0dbf2ce690b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267088, "uuid": "5a0fbf08-a542-4a9b-8677-20ad93d2135f", "value": "T1A0933952FD818662C6C126B7FB5E028D376663A9E2EE3203EC155F2133C796B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267088, "uuid": "1cc3cf7c-e959-4cd1-9a2b-eb6d498f52b7", "value": "1536:Rx3pYvtYMQMAryZ7K19sZCwzXns/mPM99BrvQ8CPLIrWZJe2K2+ks:Rx3pY1YMQ87quns/Jj1vQeqZJfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267088, "uuid": "fe181be8-b5ef-4345-acf0-ef4a7b66a5a3", "value": 89716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267088, "uuid": "69975c2d-effc-4bd0-8850-350340c5e6de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267088, "uuid": "83de4e51-5226-4570-8f60-53de6a25ed71", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdcc0ef-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284134, "uuid": "51b81705-1c68-41f5-ad53-e28ae08db11c", "comment": "Malware payload (Gafgyt)", "value": "a048df7395f78cc396c940b48fb38588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284134, "uuid": "285a1686-2209-41b1-ba19-a3d91a4ec959", "comment": "Malware payload (Gafgyt)", "value": "63b4ffcfdeae1393bc3781441dd08a9195913de46dcef0fd41f7c043357e957a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284134, "uuid": "4e2406a7-4747-4f80-8ef2-966f63f461b8", "comment": "Malware payload (Gafgyt)", "value": "a1b9a5f53fc9d70fb64d4e8b2bf6f7641a87a80f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284134, "uuid": "30d684bb-0e75-42eb-80bd-f0e38cd01f6d", "comment": "Malware payload (Gafgyt)", "value": "979d10a9b413f225149388d22be1ac3f70cc1c96d31d6aa89a5c9f71784a73851c8bbff0078bb392bcc79c6789c59eba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284134, "uuid": "fa3bba1d-f0ce-40ba-967f-ec7e37241346", "value": "T1D3C39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284134, "uuid": "357242e4-9b37-4b6e-8234-74b32cab7b66", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpG+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Es+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284134, "uuid": "3c581f6a-33cf-484a-ae23-431a2660fc44", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284134, "uuid": "3d16495d-ddaa-4118-a2bb-57cdb0216908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284134, "uuid": "30f626d7-fc93-489e-bd06-363bf62e0b1f", "value": "mipsel.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87323f62-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784329754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329754, "uuid": "ee9f2651-b805-4f65-af4d-59cb812027e5", "comment": "Malware payload", "value": "831da6b052361d372c7b31cfa23a3a45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329754, "uuid": "0662a823-74f6-4140-b5c9-80f4a0dc5363", "comment": "Malware payload", "value": "63cf5ade631557478a2cf13fce75b593b76edfca7a991889b8b11f52fc05f631", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329754, "uuid": "01776cc1-00fb-4c5b-9294-a1b1f0e77ef1", "comment": "Malware payload", "value": "333d9dd910a2e54c5e3690c8b5953903c1095868", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329754, "uuid": "9ff124cc-2dfe-4b52-a3bf-289d804048bb", "comment": "Malware payload", "value": "3e02caca1f553c05830901e163094d1c99a226eb0f6ae6c95cf461bcafd4c46a160a65d5989d8e9f1107a23d3a4685d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329754, "uuid": "8e739ef7-0871-4f56-8f1b-8eb320857f1c", "value": "T10DF0F4C4217120B075A7E8EA4A731C5C30E5A45A3ED72CFC3CB6F4DA56E5C14A0821ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329754, "uuid": "63f3c7bf-4107-485a-8e4e-beedf6c37594", "value": "12:YkF1kcClZF70SaHFgHF3HFWpFSpFM5gFrpFSXFMDgFvA1LRPb:ZDkH/FbaHFgHF3HFWpFQFM5gFrpF+FMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329754, "uuid": "62f34de5-c6c6-4065-99ce-1f439f514187", "value": 636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329754, "uuid": "e92b9997-824e-4b84-94da-c380fb7b5193", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329754, "uuid": "59f6aeff-0497-4249-b968-6df0d121caa8", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c11dbd-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "16929ca9-dd77-40b6-b5a4-d1d5e52c64e0", "comment": "Malware payload (SilentNet)", "value": "ca3dc13352ae77d6c79ec30c1b4bcc5c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "9d0e3aa7-da1e-48ae-9319-a6942ff40299", "comment": "Malware payload (SilentNet)", "value": "63f93d1d274a3a079333b260accae55338eae7293203cdbdcc9b87872d574af0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "a20d613a-8a8d-44b0-aa2d-42d298ec3ddf", "comment": "Malware payload (SilentNet)", "value": "d66fdce33a95a8fbf0ba06af40486470c2511b85", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278665, "uuid": "a318667e-4fc2-4797-ac31-6c7d3cfe79d6", "comment": "Malware payload (SilentNet)", "value": "efc24a24dd931824898b69a6fadcebdc9d976ca0c617c934fe445fd2aa1965a76a9ea1f99210716930234779e19f624d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "e062a860-502d-4c14-a681-cc4793e71ffb", "value": "T1F3C36E5CAD296E6CF9864CF065C1AF4052A0FD1DF1DBD277A9AEC0807F84E4C79882D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "1c71be7c-e6bc-471d-86bf-b95b5b7989b3", "value": "1536:Mspk3N2yhd/6qtYwdhIcqiqf07K70mj32Q2QIG5:MVV/3bacqH07K70mjmQqG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278665, "uuid": "b65eb968-ae0b-419c-9913-2617c81bb793", "value": 121222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278665, "uuid": "fee1cc56-e609-4f61-ab85-4c73df445d5f", "value": "application/x-java-applet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278665, "uuid": "74ca30da-7a86-4252-ad23-7b2072ae5177", "value": "frostclientby.xzhoo.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd0ec5a-8177-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784248372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248372, "uuid": "c52c8e4c-ccdb-4a73-b143-054064042010", "comment": "Malware payload", "value": "72ae0bc75d6a38213b9317ab00ec07cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248372, "uuid": "63ff35ac-ad35-44dd-a468-9cb466beb2be", "comment": "Malware payload", "value": "64e65bae703a6b848b5cbd19bfd6f56cf085fea6341a1dc03fbf3fa520ed8da4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248372, "uuid": "edb104ac-ee62-4e8a-b477-8fa9be911d76", "comment": "Malware payload", "value": "f6a723c97014ec53196f8d3d1ff776d6013cd664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248372, "uuid": "eb1665c5-1efc-4d9d-9d51-5327f9ab7c23", "comment": "Malware payload", "value": "d128bd4718ec065ab239dc9d04a9e0f493d8c4ce85406c599a749894d27b1cb05bf9e41420df36d62f59c09ae2e53f5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248372, "uuid": "5fa2fa82-49fb-4f3b-9cc2-959f642fd723", "value": "T1D763C74A6E228FEDF66C833047B74B20E76963D623E1D685E29CD5041F6034D685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248372, "uuid": "8016fb02-ce9c-4f75-bf8e-7a3b6d5c1f78", "value": "1536:E25iZVSKiVIsHv3AynvuOeFLWSgGiRyuv:E1sHv3AavuDg5yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248372, "uuid": "46c1bdfd-d7ca-4d38-ae93-7ac15f0270bc", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248372, "uuid": "c56c706d-4734-4e50-87fd-c03f77ce77e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248372, "uuid": "0d4ffbe3-59b7-46d1-a856-0092f680485c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2a1587-81a4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784267812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267812, "uuid": "27eedde4-f121-4aa7-b171-19d1b1a6398b", "comment": "Malware payload", "value": "4b2d8761f4a71962c44116a657c7ac77", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267812, "uuid": "96122799-5ae0-4af7-8788-23c8e5095803", "comment": "Malware payload", "value": "64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267812, "uuid": "a68b4e0f-aa92-4f04-a0e4-45748324fb54", "comment": "Malware payload", "value": "545a5b785b40744a780044debb9c12cb202fe858", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267812, "uuid": "bc56beff-311b-42ce-9c87-47e1a67c9d23", "comment": "Malware payload", "value": "d5901a7ae0a50c415ed28bbad780a9aa2a1727508a533cda6f768b91acca0b4c1af91f4f6bd8cd90f531dba8ca2fb8cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267812, "uuid": "7ed08fb6-de66-448d-9c4b-c91fda0defe0", "value": "T1E901ABCAD560490040EAD95D22D75064F871C3C7164B8F79BF6DB43DEB9CE04B066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267812, "uuid": "a44c03a5-ba6b-4fc1-9022-c9ed1c1727dc", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkapKCtXiMOCxfmSCHgNjC0/0W4CFXIX:kXCKysE2hi0ziQvZohaIHRKrF/kxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267812, "uuid": "201b6866-5dbf-4b86-9839-949ca90a8384", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267812, "uuid": "ceeb171c-d5d9-4acb-a6ed-7061b9ccfee1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267812, "uuid": "9ef695fc-45a3-4254-becd-498e66ed2fca", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f5631c-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325140, "uuid": "9805f41f-3852-4cc9-b229-d233f24cc4da", "comment": "Malware payload (Mirai)", "value": "95d1f7c49c25d18307ea3df8b66a17a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325140, "uuid": "1e143937-c51c-4c65-967c-7b2e0339f250", "comment": "Malware payload (Mirai)", "value": "663c08658f4683471f3b1ed46b343a95adc850f62c564cfc176af8c476227fdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325140, "uuid": "933fd1d4-2af2-4f3c-846d-25aeba64e3ff", "comment": "Malware payload (Mirai)", "value": "0e805d348aa93bfa5ef2065977bf69f643fab771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325140, "uuid": "d9b684c6-640a-49d8-82fd-36c8565ccba4", "comment": "Malware payload (Mirai)", "value": "b56d8b542366a1443d5670cc9562cd6b48dab1c09e742d8524d9663d45862521d61da42129ac65016da3a2c4123c7c0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325140, "uuid": "eab6e26a-4051-4b00-af38-6f2e6ee0a98b", "value": "T152736C22B9751D2BC4D4A87A61F30321F2F2479A25ACCA1A7D720D4EFF35A4032577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325140, "uuid": "e59fda73-e74d-4941-94f8-8d82cd6a2bde", "value": "1536:l15SSeEvcWMj3t1TqocFQxtpHPN95IaAoOYtwe8/Wk:XA+Mx53vNPPKyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325140, "uuid": "c336eaef-9006-4558-b5bb-5cb40ca30823", "value": 78600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325140, "uuid": "e3407b21-05ae-413f-b2e9-d90c375d800e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325140, "uuid": "c0e447dc-9d17-4dc8-a3bf-42bb7fe83656", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172ff756-8173-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246673, "uuid": "eac06caa-c0f3-47df-9104-df141640c6f5", "comment": "Malware payload (Mirai)", "value": "7ff805e2db0c798a0a93c88e3f0eb07f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246673, "uuid": "e5ad2616-5e8f-4390-938a-cae291bac23b", "comment": "Malware payload (Mirai)", "value": "667d249e882f6e189bb1ef23aa29b147d89bf7de8820c2ea7b98ad12a1c78f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246673, "uuid": "538bccb5-6ab5-4274-b676-0432467a5e7f", "comment": "Malware payload (Mirai)", "value": "4a9f3303a431ff8c31265c1b15a3c74c1d728a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246673, "uuid": "20b4ef29-6dfd-4d83-859b-4b02d0a79c53", "comment": "Malware payload (Mirai)", "value": "c5600c8f537ec22276e8e6fd4e739263425758d3a5197a1610015ba683ad8ab98c86c3240e258a63cba919364871755b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246673, "uuid": "8af7d8de-f5c7-409a-bbac-b0cb6ec813ac", "value": "T17823F2E7827FEA3EC511E676948F9650AA3E88092550C39B3FF422AD4FF7D4A1C10E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246673, "uuid": "97c62361-8c91-4259-8809-4ca29b2847f3", "value": "768:k+an3RY7qKS4o2SeAgPBOAcLorb6T8/s/hOMBtE47fJmfHq2BwyNIbiFj7QFix0S:03+7k4oZCAonl/aTE47BmAh6j0kx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246673, "uuid": "f42966e5-e7e5-4032-aebc-1da5f869b639", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246673, "uuid": "d5db0a42-94c6-47cd-bc64-e6889c6a2714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246673, "uuid": "e1e37be3-fccf-4b9e-8134-9efd3710aef9", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020e3fa6-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784314928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314928, "uuid": "c782f162-ba43-479f-8e73-545006795b6d", "comment": "Malware payload (Mirai)", "value": "71c0d01b96fd5974e467bdad156a496d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314928, "uuid": "37f22c20-c42a-45dd-bf33-57989dbbaba7", "comment": "Malware payload (Mirai)", "value": "67463e220c2d10998b0a0dd428c01a2d0d8ef9a4131420a3b75e10e0550d4041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314928, "uuid": "54f621a4-111a-45a6-8d30-0231088b2f5a", "comment": "Malware payload (Mirai)", "value": "565d6a0181c7b50475d262a0d4d21e9898d5ad5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314928, "uuid": "5febd82a-41ce-4767-b7e5-d8b5f4dff539", "comment": "Malware payload (Mirai)", "value": "7fe58b762cf50f16be54f9fdda47aab5e13cb8300b89f4e7d58807033343dd3b40f3cc1bfb41a2e02af5247e7d351854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314928, "uuid": "33b5fd6c-e649-4699-b40f-9c7c3f6f3a70", "value": "T19743F180E36EDD2DE665807294DFF86A0C03DA8BA8E0D6C159CEA8F45745F437C4ED62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314928, "uuid": "abd35522-c6ca-4954-a5dc-23fc2689c71d", "value": "1536:EA3YQBKn9bvYItYTkyNvmoKy/BKguTcKOlzm7X9Ur9KHoQl3nouy8DMp:EA34gI6o9AKgDa7X96KISoutDMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314928, "uuid": "c0c72a92-7bb1-4977-82a0-b928bf9cba36", "value": 60012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314928, "uuid": "8bb910be-0d8e-41ec-a32f-ce8b973472bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314928, "uuid": "fefe5bdd-a772-4dc6-a26c-e9dc25b5aa84", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bf0453-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272229, "uuid": "acc74abe-4c41-4e1e-a0d6-e18fb6e73b88", "comment": "Malware payload (Mirai)", "value": "109fb761dcc93d8a1a53ab6787cc37c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272229, "uuid": "7d1a47cf-e83a-40e4-bff3-a3231f32491d", "comment": "Malware payload (Mirai)", "value": "675b741aa298899b3a1035e9a6dfecdb2c0ea7f4091bbad9d885033d57b75c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272229, "uuid": "ecc05e0c-ffbf-4499-a359-9ae4e01e0aed", "comment": "Malware payload (Mirai)", "value": "285b65a376641bdea6dfdc21cfc2b451dad6df15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272229, "uuid": "bd0f01fa-c12c-4eb4-bf35-e2d3235641cc", "comment": "Malware payload (Mirai)", "value": "6e38aa460c454a11d3a6acd7541e25f46476ba797944c740a22007b3dc70f0a9a92b55ae16ceada297cc9d90cd8937db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272229, "uuid": "5fedd357-2498-4c81-b90f-a27151ebbd96", "value": "T147732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272229, "uuid": "0a6c00cb-c59e-4c0a-8d30-c8dcfeb27eb9", "value": "1536:86dz9MTC0XU66EeIpZ5brAMjztPz+Sbjt+UvAs/hY:86dS6EVFrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272229, "uuid": "f1d146a5-55f9-4b19-840d-1113e18435c1", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272229, "uuid": "0a9dabeb-7738-4ab7-b315-47c3d9f2b376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272229, "uuid": "f6635166-fecc-4406-bb6c-4bb744c029d9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dbbd84-820d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784313135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313135, "uuid": "a6d6b5d9-eab5-47a2-a4b5-4c504ca9e55d", "comment": "Malware payload (Mirai)", "value": "ee4aef08a042771d27d988ae4b10e92f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313135, "uuid": "8c01125c-1bf1-4356-961f-baa6a861278c", "comment": "Malware payload (Mirai)", "value": "67e3c2871368724b892b4342529bec6354378e57c0da40eeaff4e9bffde8b785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313135, "uuid": "2fd29f79-d65c-4e40-b06f-dab9792541b8", "comment": "Malware payload (Mirai)", "value": "5375d5354383efe0055bcb7d0b8279250ca489da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313135, "uuid": "369ae9b8-2353-4b96-9dfb-6f2efc86e38b", "comment": "Malware payload (Mirai)", "value": "4ba8b109eb297688f77dcf79238132f13ca23c375a79fe7893dc1021ef3b9170ada07472ec54cc6c7fead8218c74b620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313135, "uuid": "8247928b-207e-4e1d-bd2f-dab45909dfc8", "value": "T1C4E3075AF881AF11D4C626BAFE5E518D331327ACE3EE7212DD245B2533CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313135, "uuid": "c214135b-9a84-4727-915b-63860813a9bf", "value": "3072:bSASTW9VlOY0OnNBptThGuz420Ga+K6IKUQbpqiwoKd2c+d0nb9I:btSTW9Hn02pDG1xGa+K6IKUQ1qqKwxK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313135, "uuid": "95de2b4f-4b72-4e71-a94f-9db8a70bb32c", "value": 149012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313135, "uuid": "a0275885-b3c9-4c11-bd3d-74b66b052852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313135, "uuid": "6a150b6c-a5c9-453a-a080-db71eafbf2ed", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2d9a3f-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312371, "uuid": "7119c068-b746-466a-a9d8-f9baa7f0e45b", "comment": "Malware payload (Mirai)", "value": "9afd25cb0cd45bbb7fe0810c1c4903de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312371, "uuid": "d8608190-d09c-4e1b-a2ec-50da629b2036", "comment": "Malware payload (Mirai)", "value": "67e3d52e5d61608ced6a2200d9fd1149c99f0ab75a321398db025079500866fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312371, "uuid": "58e0cd9a-7bd9-444d-b7d0-6509ee20df17", "comment": "Malware payload (Mirai)", "value": "750757bb51d3c4e1622615cf8f897b67927727f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312371, "uuid": "87a68d44-0acc-4498-a737-2660c5f17648", "comment": "Malware payload (Mirai)", "value": "8b45707d8baec580d63aace047c255a4a170794ac40fef466d704c028d58a978c5eb82c210a408c2aee53eba2ee15381", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312371, "uuid": "09036fcc-27e1-406f-8341-de59966dfc82", "value": "T1EB931C46B9528E12C5C212BEFAAE415D33136F7CD3EE7212DD206FA063865EB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312371, "uuid": "f91d7d0e-aa89-47e0-94db-a447305ed627", "value": "1536:870nsiH2CMqbaVl3EVZgOFnAQRfGBg3MQBlrgSReYJCdV8absTvGa/Qyi2W7uf7Q:/WCCVqVZgOFnHfGBg3XHrZRebdV8abX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312371, "uuid": "b78663c7-79b8-4392-8e15-5ea03da7400b", "value": 96872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312371, "uuid": "3f6bad9f-1252-41cb-81b5-63c29210ad95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312371, "uuid": "8b788d31-6cbd-43a8-a851-f6a100c6d014", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9926e6-8174-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247224, "uuid": "0eae9bf2-1486-40a6-9318-85593d53a189", "comment": "Malware payload (Mirai)", "value": "2322a4a63b4480f278b264988d32c0a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247224, "uuid": "aafce96f-bbb7-45e7-949a-d00e41682db1", "comment": "Malware payload (Mirai)", "value": "685da3603fe49eb177b07a7c10b1da1dccdb99ff4d421c1cf299eea55107837a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247224, "uuid": "2946fd25-c589-4996-9f4e-6fd9c3da180c", "comment": "Malware payload (Mirai)", "value": "76eef747a4d53d837aeaa163a2e794c5b8725ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247224, "uuid": "45aa3253-6ebe-4149-8c09-251dfeae67d9", "comment": "Malware payload (Mirai)", "value": "97dfb9070521dc31519677179481d460c0fa800e999ff2f4a5a03dc39b186de7b2912ef755a591e1b57202abf86bea12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247224, "uuid": "580c2c1d-144b-45e4-80a0-01dd1cfd6b3f", "value": "T13B043B496E756BEBD05FCE30162D830712DDA44FA2F6A73EA678CC4C3D9A20859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247224, "uuid": "b06b53ab-6fed-495f-8579-b96fee18fa1e", "value": "3072:yej0n2FfuPdvkPXCVgaSGqcNIrcVcfF8XOn7HYQi1DR8:Za2FfuPpkPXUgaSGqcjVcfF8XOn7DYt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247224, "uuid": "f4c01105-3f21-46fa-b90a-75aba82399f6", "value": 183624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247224, "uuid": "a0374708-f52e-4154-aeb7-b013282adc18", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247224, "uuid": "a2f12005-3d42-4df8-983c-5e66e3be1361", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fdeef9-81d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784289861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289861, "uuid": "b65a3b96-a2d9-4595-a047-d6c9a232e020", "comment": "Malware payload", "value": "ef2a9f5d74ea6361d05689e684b6b208", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289861, "uuid": "88988e24-98a4-429b-90c1-6ea92aeb21f3", "comment": "Malware payload", "value": "6958d8a2349d1860a4140dc2f3a2b64b995c3047e4c6d0802ef8565c86399942", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289861, "uuid": "b17c9ae1-9345-46dd-8e51-574b334324cf", "comment": "Malware payload", "value": "7ea8d732535b0a36207ec1b7937e4c49f129f1ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289861, "uuid": "2b643e50-511a-4a71-97d0-07d6b972d903", "comment": "Malware payload", "value": "b9e2c6c5336523dcd12473630289734b8637dd9bb5ed0f3a70ce701cee8390b5de9ddda8f9f3b4d62e3f5ffaab99d525", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289861, "uuid": "3114604c-d9c2-4c32-a84f-974d2457c226", "value": "T16DC27C966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289861, "uuid": "d8b390d7-b87a-4917-849d-3dea2ea4a79a", "value": "768:p8vCB+25j6es8RS9FYpMSUpi+20qUpi+20YQX:p8l25J0d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289861, "uuid": "62fd001f-27f4-4504-9aac-587555fe5bfc", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289861, "uuid": "7d447172-6100-4ec2-ae7d-f978f720e141", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289861, "uuid": "ebfb4fc7-1dfc-4a66-85df-a17e80e612e2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e776f88b-81b8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784276658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276658, "uuid": "ec82e14e-6576-44ef-9195-45345d62f714", "comment": "Malware payload", "value": "dbb8071faf5200f2ca74666afb1215d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276658, "uuid": "e2b5c5f8-e889-4a2a-a11b-a4dbed91fd92", "comment": "Malware payload", "value": "69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276658, "uuid": "07767502-e747-4730-b138-727871aa7c56", "comment": "Malware payload", "value": "a6481a7412ee5a601aab2d38b69203db5e7ace0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784276658, "uuid": "33a0019e-8b32-4e4a-af8a-f0eb9fa98046", "comment": "Malware payload", "value": "0e99eb962c5da6787791a59fa3599dfef6ebc1e388451379b431d91b2e362fa8a5a579ab0373219514f807e8c60cef4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276658, "uuid": "cc1df5a5-3432-4b53-8876-567d573f6cd3", "value": "T19E01AFCFD2545A0050A9C95C279B50A4F830C3CF67870B69BFACA47D9BC8E14B067F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276658, "uuid": "26be449b-d93f-4349-b8ba-e79c74c75731", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkatFCoFWFCpVJ1CxgKCDVPSCb84uX:kXCKysE2hi0ziQvZoha3FAFO1qF5+8/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784276658, "uuid": "cb538962-9ce9-4c7f-bcf5-1a7324bc2ce8", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784276658, "uuid": "2ac18f50-9ed3-4387-b55e-d925d0ff12bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784276658, "uuid": "f591d529-9d5f-4daf-a6cb-68f966fae289", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74eab37-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267101, "uuid": "f93031ed-e945-44e8-a2b7-f69ad116f8f0", "comment": "Malware payload (Mirai)", "value": "322bf469c1bbcab84e9ca8260743cd8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267101, "uuid": "e2091e70-a651-49fd-bcbc-ae80745fdf66", "comment": "Malware payload (Mirai)", "value": "69e3fabf9318bc0e18f72fb48ea3e194c72df9c454e208b4ab15bb8b493d3b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267101, "uuid": "006ed079-ded1-4149-8c08-34880d64e97f", "comment": "Malware payload (Mirai)", "value": "a3fcb89176b08e82ca4fccec7e872af76059e5ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267101, "uuid": "01770ea5-0685-4e92-85d0-370474cec4f4", "comment": "Malware payload (Mirai)", "value": "b7f988637befe4b2f9ff4ace08bd394beb9c8345d74a7486c19e911c6b64b9f066aa68456d473d10dcfe36ce7b7c4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267101, "uuid": "435e0b41-b7cb-4308-8f00-6bbd161c2eb0", "value": "T143333A0295BC1A2BC4E0A77711A74363E2FA2B854184E64FBD660D4FEF593501ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267101, "uuid": "f8f099ce-f89e-4d64-95d9-ac123edb8b2e", "value": "768:ztg5d3bozLSew6LrcJVo+Ykz3KODgRHwDWODqUsUJy7IJomxQvPzVYGMIZNT1p:i3buLPw8wn73JDgRHAWlUsUMpmxkPKwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267101, "uuid": "a3a08630-84bc-4bda-9870-65902be93f6d", "value": 53676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267101, "uuid": "78be24ae-4916-42c8-9381-b91553c5b4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267101, "uuid": "08d01b32-2aa4-4afd-95e3-967bd035ac9b", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c606c63-820b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311965, "uuid": "4ec27e1d-1de3-4887-ac30-c74dfb3ff3c7", "comment": "Malware payload (Mirai)", "value": "ca5af4e6f3b33e2904e93856db8c509e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311965, "uuid": "9340c35e-bf46-492a-a3ca-986a9d67793c", "comment": "Malware payload (Mirai)", "value": "69f4c89d26d241068a60222ef422b7218418e0f12c60e9310b8a2cb3963e0003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311965, "uuid": "2a51dee4-76d5-4201-bfe9-82464717abcd", "comment": "Malware payload (Mirai)", "value": "e124b464cb21a9c4b9582293f915107e1bcf8fa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311965, "uuid": "632a150c-1f27-4edf-88ac-4ed8f20b67ec", "comment": "Malware payload (Mirai)", "value": "2fe882ccb1ca913fb3acfffe92dc1c00edd9642a59fa37e8c34f17825897c86212e61331263535706e757c3e41583a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311965, "uuid": "5951d080-fcac-466b-a880-64bd54a868bc", "value": "T158F3D60E6E258F3DF679C73487F74E25979873C72AE1C645D1ACE5011E2028EA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311965, "uuid": "5d86c6e2-659d-4a6e-8e5a-e216a90c8d21", "value": "3072:l2bpjre4HVfVHLRJ2YNw94eqkgzJD2HHTai/Iqnbhoyr8:l2bpG4HVfVHNq4eeMzaTG+yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311965, "uuid": "6576a1b2-4977-48b3-833c-2ca147170bae", "value": 167392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311965, "uuid": "1fc5ce92-fd94-4a4f-8caf-b4c8d82d5073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311965, "uuid": "8e28dc6f-bf1b-4ec4-b561-e6011aba2922", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842f6ad3-81d4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784288517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288517, "uuid": "4be5b60b-8d7b-4371-9d8a-0d2fdcb8b0ca", "comment": "Malware payload (PureLogsStealer)", "value": "0444dfa4bd00c74c8335cbcba1b667ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288517, "uuid": "caf571ce-bfee-4e90-8bbc-05838b8a0345", "comment": "Malware payload (PureLogsStealer)", "value": "6a0fb35b3584468d5395c3d1402ae9ac568e04a883febd2ce495e3da7599e6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288517, "uuid": "60085fc7-751c-4a3f-a4ad-a5794b7ac472", "comment": "Malware payload (PureLogsStealer)", "value": "d88346deaec3d03a09ba430630dda992decd5bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288517, "uuid": "7ff83b3d-839b-4d28-a615-3def4f74ba6e", "comment": "Malware payload (PureLogsStealer)", "value": "735ceeedcb6200d9d20e0e6bb62ef5c8952cf289ccabbe7562f73da9bbe864aa8edff0c751e16d839c2a0b923062bb73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288517, "uuid": "dc5b4a98-fa30-4c08-8d03-6c677e04865e", "value": "T1DF05BF6636614E20D6880637D1D71411D3F5AA47BAA7F30F7A8813AA1D033FEEE07697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288517, "uuid": "8afe4451-3562-4498-9a28-825edc32dde6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288517, "uuid": "2d6c3455-a9ac-4d27-91db-18ec05bebab8", "value": "12288:DkzkOyI+68ROvBloxnjgvs8j/PC0W0kNZab+WeOMZSBTfCN6h:Dxh68IZ8jKsYanu+WeOEkCN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288517, "uuid": "7bc50428-8ce7-4027-8903-9ea5c8ccbcf7", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288517, "uuid": "882337cc-369e-456a-aed8-8ee6c65a34bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288517, "uuid": "0f76a649-ae5c-4dfa-9e86-1be33fa1675d", "value": "6a0fb35b3584468d5395c3d1402ae9ac568e04a883febd2ce495e3da7599e6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fd4f22-818a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784256729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256729, "uuid": "996446f7-bd4c-4754-8252-24c23ca0d6ca", "comment": "Malware payload (Efimer)", "value": "5e7b7f30d00410ba40932d012d0c40b5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256729, "uuid": "ad0d42d6-e0bc-4733-bb7b-28ccbb7fe473", "comment": "Malware payload (Efimer)", "value": "6affd6590f618b2ae670f46f6351036f419eea08e139d06354354d74be857ca6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256729, "uuid": "5ce18db7-5da9-4804-9f8f-a7248c44c038", "comment": "Malware payload (Efimer)", "value": "b5b756209921adf2fe44385cdf2cfd43f0567589", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784256729, "uuid": "809c84b1-397a-460c-98de-c7377045c572", "comment": "Malware payload (Efimer)", "value": "b7cf1ab7df32828b39e54fe2fe861a089b110d695448cfec60f0b7a86c258d7df679cd422ef0fb5670c3b12c8eb5d7a8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256729, "uuid": "a3179aca-d2c3-4494-a568-b910f82b89cd", "value": "T1C8E63308AEE511EDEAB7413CAED15745F299B0B99B70C98F0B6CC722AD131F54D3DA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256729, "uuid": "6183bc1d-bf08-496d-bf37-e2020c83e9f6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256729, "uuid": "62d81d8c-5be5-4ac4-852b-9b91e2ab7de0", "value": "393216:4yhgNqS+zMJut7GOzpXMCHWUjXccuI3/PGTAI:9XSWMUFXpXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784256729, "uuid": "81b50bd6-14f5-4b7d-98ba-e75aa2a85d8d", "value": 14325952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784256729, "uuid": "59a55c62-effb-4dcf-8bca-657c5d615664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784256729, "uuid": "ee4941e7-1da5-45a1-a251-f44d500a8d9b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f22d65-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "b67579e9-7389-400b-aa9a-72045ac0e7dc", "comment": "Malware payload (Mirai)", "value": "4026c4faa1f2c4698180bd8ac918b031", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "a2c9d015-7152-4425-845b-05f50745c874", "comment": "Malware payload (Mirai)", "value": "6b16e59d7420d636dceda0dfc9fd657758ba7a0537cb78f61ab9b9101172f940", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "8b5d560e-cc7c-4a6c-904f-6ea630635740", "comment": "Malware payload (Mirai)", "value": "75a3c7dfd29444adbd7c1934ba8cd2ccfa43eee2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "5ae8ef93-f1a3-46ed-bbef-edfcf2d65e34", "comment": "Malware payload (Mirai)", "value": "fe56e6c400adbbbb4d9cd882179ca331c6ef39dcb4ca28c4cf1156cb4704551d0911395ed20fb9626e24fae91657c219", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "aee7d0aa-e31c-4504-9a9e-d52716038604", "value": "T1C5D37B72CC6A6F98CA24D078F0618E395B23A51485475FFE58ABC2B18087DDCF5097BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "b08b978f-0fd5-430d-993a-dd1ec4b941b1", "value": "3072:k0+Ibx1srPKmf37L7COl7ogkOuNn3Wgs1x3:k0+o1srSmf3j17ogORGgSx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311369, "uuid": "b13f8516-2a7a-496a-acda-7dca019653b4", "value": 131436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311369, "uuid": "5ee32d6c-e2c6-4591-a112-48b305672400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "378a4740-05ad-48ba-b0eb-58a034a91ad8", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daf4bf2-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784315189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315189, "uuid": "ade4f6b6-ef17-4741-ab4a-7902c099730a", "comment": "Malware payload", "value": "fb8a451d1382c6d8fa6ecbb94c02c428", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "navegadorpj-com", "colour": "#D546DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315189, "uuid": "c375c4b5-dd95-40ef-833d-9c78352f8cc0", "comment": "Malware payload", "value": "6b89dd9022af219e0dff48934087535dc47824a9921eab7bf8244ae2f0451dc5", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "navegadorpj-com", "colour": "#D546DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315189, "uuid": "c02bdc75-4b0d-42af-95ae-a5652ef2d434", "comment": "Malware payload", "value": "39eba9070c044de3254b026c74ef9b70f7390e93", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "navegadorpj-com", "colour": "#D546DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315189, "uuid": "a894cb79-b605-450d-9e82-84521d57df34", "comment": "Malware payload", "value": "23adc08c16058d8102ba43495272221b803dbc014f577cc0393b196bfa0bb3a34a9f0a2f0b76f131b74d649de8899348", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "navegadorpj-com", "colour": "#D546DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315189, "uuid": "41766239-bed6-4d83-982d-f42172286d90", "value": "T1707723597DF4CB8DEB9732BC24F8D2AA1360B417DDA2592E10CA4F5E4FA9D470780722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315189, "uuid": "576875e5-8094-4d23-a06f-37127f952653", "value": "0a274bd307be6658e9f8db2906d4022b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315189, "uuid": "359f6158-05e8-4225-a743-10aa1b50b8d9", "value": "393216:b/jQKMxEdhRhyFygSLFTWhawzHW/nJJCTXXay:b/k16dhR8FygEFThUW/nb6X5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315189, "uuid": "3f15282a-937d-4109-9071-73f82c493b27", "value": 33079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315189, "uuid": "c4e857ec-c3e4-47e7-94ab-920a7eefaedb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315189, "uuid": "88bdcb13-088e-438e-9ad0-6ba5aa30c47a", "value": "avutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5348b592-818f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1784258800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258800, "uuid": "fbeb1b11-3994-40de-8fe8-fe7e5be993c2", "comment": "Malware payload (Joker)", "value": "17177abe07442152b6876b17096401bf", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258800, "uuid": "12a987df-2281-4bb0-b480-23c3f7c65fcc", "comment": "Malware payload (Joker)", "value": "6b9650bb8feaa29b1fdf076cf0b4f6aecdbe2bbcb40782a71b015ce6512c61f8", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258800, "uuid": "ad6f35de-231b-409a-89d8-1d691fd12ec4", "comment": "Malware payload (Joker)", "value": "44fd0f681ef520d3bf157db32c9c6d5e9a213f6d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258800, "uuid": "6a9f5970-764e-4561-bf04-9d69b46af881", "comment": "Malware payload (Joker)", "value": "9509d841d42a04dab8981725f10eeb816b25ca8e85d17f2498b6d75e4fc8106a7567e7becf1ebaaaf518ca5c642476e0", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258800, "uuid": "994f6410-d10e-4449-a1e5-485a6ba69ecc", "value": "T15677E14EE60CD93ADDCAF0BD4E8D05A3A0577D0416B1C1DA2C16960CFB936E44A76FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258800, "uuid": "dd476219-db3b-49ba-b040-d984d76b85f1", "value": "786432:x9f7cuLzDkfCT+57YI9QIN53Rv0xRG49Juw1c0sg421goOTq4cUX:jDJDkK+Bjf5hSiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784258800, "uuid": "9ea6593a-7708-4f01-baaa-6fe903fbb3c7", "value": 33783058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784258800, "uuid": "57be7921-b2ec-4ca6-be7a-b9d90e04ba88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258800, "uuid": "b803856b-5461-4813-88d2-9450f2734fc4", "value": "com.empir.cist.camera_1.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934079b7-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784329774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329774, "uuid": "c8d4a732-00a1-4685-aa96-24a911c2b855", "comment": "Malware payload", "value": "15b9f1c2406640652b3c0a01afb27dc2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329774, "uuid": "59f96329-902f-4805-8bdb-f3365ac30b1b", "comment": "Malware payload", "value": "6bba47b8780a872fca03c7776396e13def783ee4ce13deff1fdfce75e32f1346", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329774, "uuid": "de1400a3-65dc-4c29-840d-661a64808eef", "comment": "Malware payload", "value": "083c3e96fa5f867554277a7588529d87dd525ae0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329774, "uuid": "97ca0244-b4db-45cc-9483-34c16cec107d", "comment": "Malware payload", "value": "e0240f6a65cec2bbd11bfb65f1dc4989cd376c4a708a3f26bb4bf34f058d3912f2bb60720414f2b92f6572091cdcec6c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329774, "uuid": "e9d4a5b8-1cad-45d9-a43d-8fb430971a48", "value": "T1B201F4EF049808691641F90EF9638C36711FBFD964C62B8F9DCD6E75118DA18B421FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329774, "uuid": "e1aa6347-259c-4ba1-a5ca-5b99b9df0144", "value": "12:t9Eh3DoZDeh3DhHWPh3uyeh3uhHWPh3a0zveh3a0zMHWPh3aQ5IjDeh3aQ5IMHWf:t9ExMZyx9WPxuLxuRWPxnz2xnzGWPx1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329774, "uuid": "4f2d6bfc-3f8d-40a1-b021-f84d3bce0b4a", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329774, "uuid": "87c34150-3ad6-4b1e-b4b0-76fcd7d14bca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329774, "uuid": "a86697ad-a25a-4c46-a288-101ddc18533e", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e4b6b7-8221-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784321556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784321556, "uuid": "033574dd-e059-415e-a360-a56220fe0d52", "comment": "Malware payload", "value": "74adad46df86377e604250f234c15b59", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784321556, "uuid": "af833a71-13a3-4592-b840-19d740e557c5", "comment": "Malware payload", "value": "6cb0a8e59c97cbc4eeb6bea68ad0856178fb77b86bd40b9beb09cd95bdf91e8f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784321556, "uuid": "3d58ff9a-65ed-41b1-8003-6b156e83015b", "comment": "Malware payload", "value": "8ba17bd3384b95e4043411179d0972e230eeed91", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784321556, "uuid": "4caab973-7aae-4014-8421-191e4202409f", "comment": "Malware payload", "value": "9c1eb00eafc4a761dcc6be11196dbdf96ee2f36fd55398b35569b8aded9218421ca3b449a210e97f58a7f42feb28b6d8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784321556, "uuid": "af168a8f-6c9f-483f-8996-197d1defa4b3", "value": "T17FE6335857D112FEED73403CEEE19666B8A538714B32C6E70BB88FA55C5B0E0093DA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784321556, "uuid": "f5b4f8ef-ac2b-436e-8dec-17269cc06a6b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784321556, "uuid": "9c96a20d-7f19-4af9-a7bd-1827cce14f7a", "value": "393216:lhBFmXnmnepgl7yf/JXMCHWUjXicuI3/PGTAI:l5mXmepglmfRXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784321556, "uuid": "c44e7064-8d69-4e27-9d63-6e8ad22db836", "value": 14266434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784321556, "uuid": "c866944c-22eb-43ce-8c0e-a0ddac446a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784321556, "uuid": "08c5bf62-2932-4dd6-8807-d26ac6af74ed", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44b2c04-81d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784289564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289564, "uuid": "47f19eb7-5f43-4c09-ae38-8188fe9c735a", "comment": "Malware payload (Vidar)", "value": "116d77575574b35db7c38e9a93c155ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289564, "uuid": "7e96accb-41ad-4089-9b4e-79a6b3efa8d0", "comment": "Malware payload (Vidar)", "value": "6ce947aeb71697f76349632b89d9f13f6aee8979a9e86817f3219ed8000aa888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289564, "uuid": "076ee37a-9d0e-4eea-a033-3cd95db63564", "comment": "Malware payload (Vidar)", "value": "0a888a0bb474fc0daa26b4de86a3926f3219831d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289564, "uuid": "5a16ea7e-a148-44f2-a09b-e179207437e6", "comment": "Malware payload (Vidar)", "value": "8e8b7e9066b91bec2ecfbd88ed106491ced36a669e45b05ffd558609f69049c3f85bf886074c7da2f55d8b14d1d18e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "micronsoftwares-com", "colour": "#5EC30A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289564, "uuid": "9d2930d9-ba05-4f49-8bce-cf1dedf1008b", "value": "T118167B07BDA614E9C1A9A73589B24142BB74BC4D4B3133E32E50AB382F773D1AD35B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289564, "uuid": "ace309e1-3e61-4783-a9de-3ef035dccefd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289564, "uuid": "003027b0-c46d-404f-9fb1-1f087622ad6b", "value": "49152:lcSIwg/Ii3MK0FGIk4AX6m8NU838770nRYSgOCN6lqga9QgHm4AapamZaJ0a:lgeMY7leiaf1N6lqwYHMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289564, "uuid": "18359725-7f4c-442d-840d-1a485e69b278", "value": 4401504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289564, "uuid": "576f3a3e-0678-48cc-a5df-05897b51409b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289564, "uuid": "e2e4cbb8-ca9c-4c16-838f-20761368382b", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f3ea78-81ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271117, "uuid": "f6531fb2-9cf8-4ea2-aeb4-ea72d00c640b", "comment": "Malware payload (Mirai)", "value": "379d6cca6b48b6d0fb20f106597d725e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271117, "uuid": "2126ee61-618c-4195-bcea-45bf4f4a4a4c", "comment": "Malware payload (Mirai)", "value": "6d48dbd0691be1bb62718a44d750ae96843be4f06f4f92a6c4ec74f3ad17af3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271117, "uuid": "b05bb02e-69d1-4035-9342-fcccd0c0d168", "comment": "Malware payload (Mirai)", "value": "17137c5eaf260380e97259735ef09da3d36655d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271117, "uuid": "b4b887ff-c0fc-4424-86e8-7f8406ee479b", "comment": "Malware payload (Mirai)", "value": "837ed871b9d5e0e88a9136a004911ea49605439034ba6e8c82a5ef6b593f4fbf54dbe42b56e23a4edc0f7ad17228956d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271117, "uuid": "97e9a6a7-493f-4d3d-bbcc-4a790ccec125", "value": "T149D31A89B8416B20C6D22EBBFE0F014A33574BBCD7EB7331A9540B6477CA91B4E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271117, "uuid": "aa673aff-b3f8-4a9e-9cc0-0d7cd17186e3", "value": "3072:gCRsrwI7mc+mFMI1uIOinEktqcJ41uat8P0uWKLzRZNT/UwKp:gCuic+mFMIAUfneuat8P0uWQzBip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271117, "uuid": "d21469b8-12f7-4ad8-a0b8-8e698d1ae3f7", "value": 130032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271117, "uuid": "29eafac0-0e9f-4fad-9ef9-244518d9641c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271117, "uuid": "a80e5056-bae0-4805-a139-259debb22808", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43df7dc-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267096, "uuid": "790bff71-95df-4781-b08f-deac78787962", "comment": "Malware payload (Mirai)", "value": "bfbeab642b62326485b0eb86b7566976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267096, "uuid": "99a13441-fed0-4162-bf51-a39ac9b4f77b", "comment": "Malware payload (Mirai)", "value": "6ed672fca21389249f344df217665bd4244d5d8607812cae374a2923d5c35d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267096, "uuid": "23a00b05-1066-4065-9dcf-01cb3b59e0d7", "comment": "Malware payload (Mirai)", "value": "0d88b2c957d90be3e7a92a81c0929fb1342a539b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267096, "uuid": "543d09c0-2345-4d68-8a65-3f9e0077d009", "comment": "Malware payload (Mirai)", "value": "16553abea55df3f0456f137d05af8cb115dfaa1670f8aaa8654255d2a7d3eebab7be39908a9a176396fe71ed9c008e61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267096, "uuid": "3822f811-6894-434f-9a65-627fcafab938", "value": "T12F937D85FB83E0F0DD0609B011ABF7798A31DD362024DD6BEB98FD76AD326129116B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267096, "uuid": "c16870ab-38b7-451b-8b6f-7dd936cd0eab", "value": "1536:JUj89KwKFRAXmDRDDCczb7JoQ4z8GGIYqoBcQaU331QUHLaEiKixr:w4KFRA2dDDCczb7JoQ4I3xuiG1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267096, "uuid": "752bc5b7-c591-41fb-9231-e72138ae94d1", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267096, "uuid": "07d7ff43-2596-4a1d-af72-a6a4bacf4312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267096, "uuid": "54ee9bad-cc74-4c01-9a6d-87883b616380", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f8548a-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311439, "uuid": "e7497d7e-f288-4b81-a691-f1292954cb73", "comment": "Malware payload (Mirai)", "value": "49ae3040017aaae83818cc8e24e6b71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311439, "uuid": "f55887b6-4965-40d0-963a-583e9426737e", "comment": "Malware payload (Mirai)", "value": "7016c0773029bd7934ee9e63ed528e91c7581bf7eee6daf23f568b34d45bdee1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311439, "uuid": "b5ec0ed5-5b87-4a34-bfd9-2b90ea4d9e71", "comment": "Malware payload (Mirai)", "value": "68185e7c2694e3737d6d3256b9ba42c48b324e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311439, "uuid": "b72febc0-4208-43eb-9aad-e7e873245d69", "comment": "Malware payload (Mirai)", "value": "6db1e43cf1dd703894775addac33d8a47832fa8c42d379dd98ede55e6a8725939489276ef9ddb5c186c51004d7429df3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311439, "uuid": "ce04231a-88d8-4e52-9a8d-474ef13605e9", "value": "T13483028768F973ECE1F3A9705EB7579F2DA87368708DE61F1C483DD54A768842006C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311439, "uuid": "a0072404-bead-4b5a-a71f-d483c8b9b31d", "value": "1536:gs30bqawv86OLR5jvWXSFlXZnQPiBLbzs1GURDGyoJPNExbbWGwSrdJFJ0B6:X30bqXv86OLL74SFBq61bzs1GURKXcxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311439, "uuid": "82c1c7bb-385e-4e51-879c-a900c624ef5b", "value": 81564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311439, "uuid": "1aec43b8-aabc-4058-8e83-ce5bfd44aab4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311439, "uuid": "64ac7ac9-5276-4166-8d29-109be01de292", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd26b88a-820b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784312262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312262, "uuid": "93a99b17-739a-45dc-b39b-06d60f1fb03c", "comment": "Malware payload (Vidar)", "value": "c45f291fda8740a843202a77180a15a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312262, "uuid": "fcb8ce7b-df26-4d22-b323-b6cda8499bfa", "comment": "Malware payload (Vidar)", "value": "7073018596b174f584299d5152cf90f89a1f4e3bf072b778fc3342fda5c82f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312262, "uuid": "f8e403ae-d279-4758-a353-070fcd1fe569", "comment": "Malware payload (Vidar)", "value": "915456ad1037056f7b542db11a97011da74d710f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312262, "uuid": "bff28107-4092-4f69-9146-0e08cf51e1e6", "comment": "Malware payload (Vidar)", "value": "58dbac415a93b8fd2f8516ae88216c2844b633a52365addcf1ce5af2fbcc9599386ad69da2a7b220d82e0ce0d2daedee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312262, "uuid": "1aca9500-dd6c-4d1b-b678-6b386b8827bb", "value": "T13EE58C177CA088F9D4A966728CB661917B35FC194B3A23D72E40B7382F727D09C36B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312262, "uuid": "0ef7586f-2b59-487b-920d-907b4150725b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312262, "uuid": "1b06f8e0-aeb8-4bee-989e-f3d1481c3451", "value": "49152:Z3ASOB6kxPF9NQeev3alqcQGNH3NeW2bM85G2p16LjIYJ:Z3AxQpcQPbVH6LjTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312262, "uuid": "cee159ef-19a3-4e35-a9d8-4becd0296eec", "value": 3092400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312262, "uuid": "a93a0fcd-91c1-4393-b745-9b1f5cc7c242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312262, "uuid": "2f575078-e94c-4acb-8d77-5823bdefa0ba", "value": "a4cf9d8ac7bf416ebe66db6ab0118a96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2e14e5-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311272, "uuid": "034dc63f-171e-4918-976a-60fa948c6d82", "comment": "Malware payload (Mirai)", "value": "91a43891119c687e9889dcac3616e2c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311272, "uuid": "372cfecc-8561-43f8-91fb-337bd1fb1679", "comment": "Malware payload (Mirai)", "value": "71192d928c5f9b8f6b45c2f669aac5e700626c68f23797361777ade132d7122f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311272, "uuid": "b4328902-8490-488f-9bf9-6a6e94258fa9", "comment": "Malware payload (Mirai)", "value": "88874044fb1ff724d72dddfe0b172c2d932bcfa6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311272, "uuid": "bf11c972-292a-4532-8bb7-27caaaf65d86", "comment": "Malware payload (Mirai)", "value": "dd59d08c79a9cea6a6aeea4748716fe101e6ccf5648ba0c3119ee3756641dc9228baf0a98d7543c77a68d0b575ef7f2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311272, "uuid": "81ceaab4-1924-4105-bfb0-32daa8dc0b20", "value": "T19EB3D709BB650FF7DC6FCC374AA9170229CD651B12A87B757634C828F64B24F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311272, "uuid": "e217d81b-a447-4ad5-b00c-771d26439030", "value": "1536:Q5OcReqtFrROlUi+MLhoaYhX+z/exTYZbY9qrmsERE9FqIqtYL1A:Q5OcReqtFrJi4F+z+TYG9/ESoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311272, "uuid": "d401aa0a-1068-4d1e-ab58-361c5fd46b11", "value": 114012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311272, "uuid": "cf73efe2-c02d-4356-9e1f-2de021b4e1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311272, "uuid": "10b306e5-9892-4cee-9783-dff9be7cfaff", "value": "byroom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44481e17-81e6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784296141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784296141, "uuid": "f16c868e-1ac8-4efe-8af8-87eb72fee787", "comment": "Malware payload (Mirai)", "value": "5d260f517583196937684f717d3f4473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784296141, "uuid": "551f87f7-e05a-49ef-9097-ee380cdf6910", "comment": "Malware payload (Mirai)", "value": "71803092f14ba263295279f7855f0a4455a56ca6c0602a555fba6c33cd8bf29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784296141, "uuid": "610f53b8-57cf-4c79-97bb-fb95acda318b", "comment": "Malware payload (Mirai)", "value": "9b7710ac1cd10ac9e1c92d39ee98a81320c9d1b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784296141, "uuid": "6b36726c-58b2-4c89-b8fa-492b1a817f44", "comment": "Malware payload (Mirai)", "value": "3ff40ae0a8afe6cba2a87db8df47e77043a85378ce9616950a94f58b3f87f6e872e145c8e0cc704dfd23f09e345c2e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784296141, "uuid": "86ef119b-4878-4b71-b788-edbe004a4d13", "value": "T16D053A03AF805FEBC4AFCD30492EC75714DDE9C752C5A62A71FC4A8DBA5D25A0AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784296141, "uuid": "efcddc98-dc07-4ddc-a5f1-1664cc644ee4", "value": "24576:HyXTrFWeCD/vscIvtOFfcQKFSsI0osKRdd5b:HcrFe8Ou/osKRdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784296141, "uuid": "16ca962d-201c-480f-be6a-b3226c24bb18", "value": 831856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784296141, "uuid": "253dbc14-18a5-41ac-858c-204c430971a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784296141, "uuid": "15764847-6a08-412a-997e-ad61396c66eb", "value": "volar.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c04e59-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "a329c4f3-a00b-4405-8aec-7e7c9f38bf3d", "comment": "Malware payload (Mirai)", "value": "d3a5e85bd72ac1ac4ff643918de973f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "1c8a5807-0ac1-4fc8-979d-ce8885396fbf", "comment": "Malware payload (Mirai)", "value": "7437affcea1a50cba4859aefb2b95541ce1a21a9244507e6171cacf3a12f1ab0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "a052ad2f-8e42-4281-b111-62294830cbab", "comment": "Malware payload (Mirai)", "value": "639b151747e11a3392dae7b3a2c32c6792132734", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "e1539456-3e35-42b0-9c76-3eb9595eefde", "comment": "Malware payload (Mirai)", "value": "b00dc6916a0370e425a4d57d708222974f9c6c7401a406f5088c6d141a428f169af0b66d80fe775061439370b30d5dea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "d18598d1-b1e4-475c-aefd-ca57f805ede5", "value": "T1F0932845E793E5F1D80705B001ABF73A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "58f475d7-f931-49c1-876d-1687c2e0f4d4", "value": "1536:NJaUfdQD/bb2sJfiI3eQo2Uu3100x7u/ohHuELb11ro:NJNYn2K6IX6kpIEHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312375, "uuid": "b34111a9-3476-4e96-8692-b994296ade5d", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312375, "uuid": "cbc1666e-2818-4bd0-8e5d-2b0e8c64bfbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "0ba8115e-32d2-4f62-be46-ce4e1ca86447", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52da8a2b-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284139, "uuid": "32daaf2a-d4dd-46d0-a393-2c66a9692352", "comment": "Malware payload (Gafgyt)", "value": "9c6ab48177cdb78d5ee3fefbcc517a1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284139, "uuid": "27dc274c-b7bc-4ba4-8a34-7ec699880d68", "comment": "Malware payload (Gafgyt)", "value": "7451dfa2ff69beabbf11b9a68a235d85dca200d29ec6341831d07fb2bdcc09c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284139, "uuid": "fc1898c1-b0a7-442b-987d-76a3357581e8", "comment": "Malware payload (Gafgyt)", "value": "35554393941350267150864a0bb9df94774d9dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284139, "uuid": "acba645e-2881-469d-b453-84b908c5ee8d", "comment": "Malware payload (Gafgyt)", "value": "cef2d98bb6939ef788dac1bb40b281e9ce24e7d44de59e2a771a393b1e8eb92793309f5dae590baa66a568cf8d2e04bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284139, "uuid": "4f48ee85-a91b-442a-b457-3d4068952101", "value": "T1D9B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284139, "uuid": "8b4e0f2b-283d-4a7d-bb05-58a2f88d4dd5", "value": "3072:MSY+46m1qOzssDFPPKNy+AmkZrQAhPDCXFke:06mgOzJDFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284139, "uuid": "10a52c1a-6c83-4f3a-9021-16099801eb03", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284139, "uuid": "54208e28-f22b-4dfd-8e70-8db985cadb4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284139, "uuid": "747689c2-e243-42d7-b225-e0ac98d58fbe", "value": "arm4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae6fb20-817c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250894, "uuid": "54a02c6c-b2af-4be2-8302-70babbcecfc9", "comment": "Malware payload (Mirai)", "value": "588ac7b4b964ceae35ca3ee57cf0a1f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250894, "uuid": "1e04ca51-fc96-4311-a8c4-8f7a561d1fba", "comment": "Malware payload (Mirai)", "value": "76feca35c0f4edbce47b970cf3dea5cfe4ec3af628bb3baa4efa32c22cb195fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250894, "uuid": "f4d9bad6-6dbd-46cf-aa9f-1bc8f0ef8f12", "comment": "Malware payload (Mirai)", "value": "d418decc049557544024a0b7088d7ca49acfde4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250894, "uuid": "00b43247-6732-4006-9400-47ff2a7dab92", "comment": "Malware payload (Mirai)", "value": "ae79bf99b44a64f4f05e086c0ab1f8a252f264572e39a52bac7558b17a3d9ea00d68fdfec62240f8d4fd95b7bd6ba71c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250894, "uuid": "3a3e9b30-dda6-4353-9fed-df4d1475cf0d", "value": "T10DC37CC2B10D7EADE4933E7DC20527176E1C9A519C83511150B5FE072ABB6E72E32ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250894, "uuid": "7126e039-829a-4cb0-9f25-9b73950de79d", "value": "3072:ZIPI2h11W3WMnPpDBGadr5BrFN1lUvkov5NQLLjyoI:ePI2hUplh9BrDUvkoxNQXvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250894, "uuid": "19b11e8b-8b32-4f68-bd22-77b201fd2283", "value": 125268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250894, "uuid": "de41afeb-07f8-4ba3-a23e-c2e07dc1253c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250894, "uuid": "f50f7f5c-3f7c-4100-b1d0-a88ae251e461", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692e53ea-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315101, "uuid": "a7b59873-2c76-4529-96c7-438793efe05d", "comment": "Malware payload (Mirai)", "value": "16f66a7fb8965e207624d98ea031a4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315101, "uuid": "5101bda8-3699-4d53-9569-05c524e06423", "comment": "Malware payload (Mirai)", "value": "77f281c802d698c6830d2cfcf02b8ec9c0f91fc485e190918b18adf43e1e8f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315101, "uuid": "ece76f10-4a2a-4738-b98e-13233e84a8a1", "comment": "Malware payload (Mirai)", "value": "56c8415c200ae5491533c1d0ab1f0aa1add2b965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315101, "uuid": "aa2c0f54-c7ad-436a-842b-dfe1098179ad", "comment": "Malware payload (Mirai)", "value": "ca348a6279df692380cce2bf71647ca1bed6baaf5f150acf6357f927e26ab500ac4bed000d1537daa0cf99257409a866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315101, "uuid": "f3fbef0c-46de-498f-84ef-93c0a9f59553", "value": "T129C33AA9F880DE52C6D126BAF75E518C33231778C3DE7106CE149E3467EBD5A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315101, "uuid": "1d62482d-3b98-47fb-8a72-4e5f74ac1292", "value": "3072:ub/jjtOjapNT96thy/Koh6WbgcYEEUQs7pEx2dzZ5aFP7gUknD+2f1Dl:ubroAoV8gcYEEUQs7pC217aFVSS295", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315101, "uuid": "725f49f2-841d-4be4-a831-6ea13f98a508", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315101, "uuid": "6ad2b6c7-b7ce-475e-b8da-026c5d3e215f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315101, "uuid": "ec7b7d15-60ed-4771-99e4-7acdd4daac9b", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61afbe57-8181-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252811, "uuid": "1edbb859-512e-4e1d-9a1a-12efc2c04ef0", "comment": "Malware payload (Mirai)", "value": "15accbb84473e4d8acce18393a4a3ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252811, "uuid": "28a551e2-739f-418b-bfb1-7062b5333d80", "comment": "Malware payload (Mirai)", "value": "7873a2d6270b9eb4b775d3a95a2b358d36ce2021fb09dc50ee538ff0782b8b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252811, "uuid": "af02d217-c929-49b2-b3a4-e3c71e265a7e", "comment": "Malware payload (Mirai)", "value": "75923c8ecf134bcd108a1389269af549d52ad7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252811, "uuid": "12522fc1-9b0c-43ad-98d7-7cbb8fd18a9a", "comment": "Malware payload (Mirai)", "value": "8374cd8e14b8a9bf59a146f303f408eab1ec525bd70491aed2a467110bee7bc5794392e9576db581f585da0dc4bdf0fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252811, "uuid": "38de87e5-a2fc-4d60-81b7-4b6308cbc2da", "value": "T1CD433A95FD42AA12C6C545BBFF0E428C7727439CE2EA33039E256F21378B56A0E3B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252811, "uuid": "f2b914eb-48b8-4d98-b05b-8712f7905f04", "value": "768:a94iNIIgQyGs4+BQj368TFAWM/Q4wulPj+ORQhZsK69Y2Vujjblcu25j8vx0RnI:ZiKQWEj1y/QYPaORtK69j4N4wvx0Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252811, "uuid": "28c0bddf-629c-4527-afeb-603f07cf1878", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252811, "uuid": "3accc8b0-5181-4364-923f-f76de7359608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252811, "uuid": "f28ee066-12b0-46a8-8f1f-daa8cdfbafea", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34815ba-8172-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246532, "uuid": "324fc1a6-231c-4d30-8fa0-8ed29cfd1ee4", "comment": "Malware payload (Mirai)", "value": "6a3d2bb882f413f4dfeda169d545eb7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246532, "uuid": "aa7a3308-d006-47ec-b667-63751c9be063", "comment": "Malware payload (Mirai)", "value": "79e70f6eeddc2cb6a68a125ce45e985100cb51e35f66a327d97d5fa0e308327c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246532, "uuid": "f0c663c5-9c0b-40e9-a8b0-72b285b51324", "comment": "Malware payload (Mirai)", "value": "840473bf6a313352b00d467bcda70c66c0467c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246532, "uuid": "b9c560d5-4169-4fc0-9b0e-37a41277f2b3", "comment": "Malware payload (Mirai)", "value": "2b171b7701a0f22ed4aded711819033a045ac0367a5600346a2fc639ddc13168c9d982430cac6b38cef0edd92d033cb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246532, "uuid": "326c8c28-262a-48a3-a7c3-4d21132da7e9", "value": "T108838D68AA0F6D81C2C7E3BEBD5A0FA370273CB48364C1B15A00E69DD4E9ED48D95167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246532, "uuid": "775a0c20-6235-4569-8f2b-5a8bec15b16b", "value": "1536:bM9QcaqFqe2zYOa7gC+2zR+xWX7/FSKOC54L6AzIr:QeRq71wcRmWLFSKhRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246532, "uuid": "4dfcc05c-9510-486c-bef0-ba012ad688a6", "value": 83384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246532, "uuid": "1cee6cff-6c1d-4004-981f-30946134c469", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246532, "uuid": "73f90a33-2aeb-42ef-aba8-ade8be3e8700", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b2cee1-81a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784269811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269811, "uuid": "dbeb3b39-4310-448f-a081-0cf7ef0ca39c", "comment": "Malware payload", "value": "b451890da03447b77f1b15cd17b49cbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269811, "uuid": "5e088a94-2f9e-410d-aad4-68b601a168f7", "comment": "Malware payload", "value": "7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269811, "uuid": "8b3d515a-d038-4efb-863f-1f8eb507895b", "comment": "Malware payload", "value": "7b2e3a27c09f4d53903a8ca4c88747fe703848e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269811, "uuid": "de15c371-5b03-43f8-9527-7a9ba9dcd638", "comment": "Malware payload", "value": "696fdd4324c15a90393bb7dee5d473a49b1b4bab0d31deb6b655d390e26534f4cddd1ade6ed772233ba94024a91a61af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269811, "uuid": "51984879-fb39-4cd6-b6cb-63f5ef8bf4d7", "value": "T17A01CECAD6604900406ADD5E22D791B0B871D3C7064B4F787F9DA43DFB9CE04B026F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269811, "uuid": "b9534373-b1ec-457f-a52a-e973b524de6f", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkapKCtXiWOCxhFmSCHKNjC0/0bs4CF0auD:kXCKysE2hi0ziQvZohaIHrEfnF/YL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784269811, "uuid": "9edd8f2c-ecf4-4f13-93b2-1123cf80d6d7", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784269811, "uuid": "d64f9140-deac-4d77-9072-8b91325069c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269811, "uuid": "6811c832-bf32-483c-9538-ec7e3ccbe159", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056f856e-81b4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784274561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274561, "uuid": "28846942-4c66-4406-8816-4c61851166db", "comment": "Malware payload", "value": "e26b1a7774db9d2c11b036b02a32b297", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274561, "uuid": "129e063d-e15c-4e35-9d0a-ce166922352d", "comment": "Malware payload", "value": "7ace56b1d76a675ba5bf0cfb1d9742496198b700466c9b5d46c643da37d5d28a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274561, "uuid": "ff8def4f-f4ab-44fc-a6c5-f3960227ca87", "comment": "Malware payload", "value": "785c3decd772f38868d90f270ace03eb9464c43e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274561, "uuid": "9117c533-d9e1-4eef-97c8-487d9f4dc3ff", "comment": "Malware payload", "value": "792d9bbd6d5e0e0fb94665745edf1ee991e3d0a2a9e2db8c7439e625d18c1e87f29482003cf44bfd62ddda60e5db7494", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274561, "uuid": "253195a3-824b-4c7e-be5e-a1bf78db4076", "value": "T1C2235C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274561, "uuid": "96c2ef16-93f8-413a-b57e-03cefb5cdb42", "value": "768:cJFWzZx5x9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:SkzIcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274561, "uuid": "952a0cf1-5d9e-4a0c-a33c-4f18096c3e81", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274561, "uuid": "13ff0b47-4454-4c57-a94e-6a48e9b8628d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274561, "uuid": "d2efb554-3db6-4b3f-a7a0-8d5a3f416983", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cbb87a-81df-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784293140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293140, "uuid": "2367a620-7588-4d76-8c38-87055e13389a", "comment": "Malware payload", "value": "1bc37e71b52b7ca1309973756f03848b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293140, "uuid": "ed4d5278-34cf-4853-a892-383390b3fadc", "comment": "Malware payload", "value": "7b11efea22ff6bbe1b881e9c07f7b70886b342448ae2a511f766c52b7e6f98c7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293140, "uuid": "e06e9a7c-2fe9-4fd1-8b0d-dd8c98bca518", "comment": "Malware payload", "value": "7a661fa42d492d193ec7a4da3e81ee2be6b95722", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293140, "uuid": "58ded311-e12b-4dd0-8138-da2df013cd8f", "comment": "Malware payload", "value": "1b19197051aac7474c46dd3339d27a3cc824001843a002b5524f4bf83d22542cd02d494ad1286db64941d88b6deb8b09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293140, "uuid": "046da29d-b873-4a79-af9f-b9efd40059fb", "value": "T18D016BDA4610A910502A9A2D72DB61A0B411C3CF555E0FA8BFDC2D3DFB88914B066F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293140, "uuid": "70e2630f-8f80-4938-b7f1-e5f076ef691c", "value": "24:kXCKysE2hi0ziQvZohaqFxCDUBLzi+G76O7:e9Qp+MsqFwsLziH17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784293140, "uuid": "3441eb27-df0b-48e5-bd0d-3c178006b594", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784293140, "uuid": "75e0b8d7-d665-4f76-bdfc-337710db7e2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293140, "uuid": "37dc78d2-3d79-4142-ab08-b6453e2a8188", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0c4a78-8210-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784314114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314114, "uuid": "17285c25-04ed-403d-b5fb-a4c4d8523138", "comment": "Malware payload (Mirai)", "value": "75399fedd22f855b8ef8367ca7afebb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314114, "uuid": "cc0786d1-4df6-452e-9602-474a8e2602f7", "comment": "Malware payload (Mirai)", "value": "7c384aba11244bf1050e6e5fc9d97afc9439036e51250d1b2a0769e10fca4199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314114, "uuid": "0c9d60fb-c8b2-48a1-b420-f8945be92b82", "comment": "Malware payload (Mirai)", "value": "7d12f553346c7be9eed1324ea4c8beedb1922667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314114, "uuid": "4198d9b5-47f9-4692-9e3a-8daaa1fa6aeb", "comment": "Malware payload (Mirai)", "value": "315d772345400742d432eaa565f10eaec604afe9c65ce092a5a755b9ffd99ba3368b00ca8f48658f00f3ad483e985ef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314114, "uuid": "3f22e670-47ea-431a-aa1d-cac41f9b428a", "value": "T195F3C40E6E258F7DF679C7348BF74E21975873C326E1C545D1ACE9111E2028EA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314114, "uuid": "5920aaac-f9c8-4e8b-874a-51e621a5a226", "value": "3072:AUV9teTtY3yA5unlzsc6xEFc2uWK2boYR3U3nbks/m:AUV9WY3yA5uaPxEF+eEYWLd/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314114, "uuid": "0d6837ba-9aca-4dc4-bcfa-63fad7169d30", "value": 165972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314114, "uuid": "bdf5bb37-7f26-4105-ad7c-45cf9dca501d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314114, "uuid": "cf53f4d9-3d2b-4826-b12e-97408afed41b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a9b01c-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325206, "uuid": "12ec584e-e64d-4842-bef6-265ef1789f61", "comment": "Malware payload (Mirai)", "value": "2479fb32d628103ad3777547311eef28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325206, "uuid": "5b969b53-2772-4b56-ba1a-4246cb27a187", "comment": "Malware payload (Mirai)", "value": "7d602737620d4425fc7a1a66d7a9e7e62fe626eee737fb44887e51dffcd261b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325206, "uuid": "e00ea5c9-cc7c-4646-8a16-29fe2b59bfcc", "comment": "Malware payload (Mirai)", "value": "20f519a046afc57cce26190f4090cf202c7d256a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325206, "uuid": "971e1a48-3efa-4a60-8045-27b996156b05", "comment": "Malware payload (Mirai)", "value": "44bad1bc84b8454e4c57dce0ea50baeb94efd23d1b43e083ccc308f14b324bafaf62eee78e2703e5ed7157b038ab78df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325206, "uuid": "021c758b-482a-4014-8e0e-e8e070ab37f6", "value": "T160A3F606BB650FF7DC6FCD3706A90B0225CC651B22B83B767674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325206, "uuid": "90a8874b-ea2e-4e08-bbf2-eb35cca0301b", "value": "1536:SvGefaZSdB7hiKul4ySOv1/yR5ZNodZi51dLeVQ/ts/KZ4B:SOefaZSdB41/K5ppH/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325206, "uuid": "a71e1b7b-0908-4fee-9a31-0cbdcaef7ac6", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325206, "uuid": "49ea12af-5163-49f8-ac4c-dae8c122cc69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325206, "uuid": "752f3326-1504-4122-9fed-aec9e5dfbb14", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e37be97-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311512, "uuid": "bddd1199-e9cd-4f2d-8005-872d0d44bb2b", "comment": "Malware payload (Mirai)", "value": "30a73554e2cb5b074fd3ea7ba7d14780", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311512, "uuid": "9e3175a2-9da7-4ceb-85e7-378588fcb4c9", "comment": "Malware payload (Mirai)", "value": "7dad833edee280e7f382b03f55ed38b2a3bce4ed6e168a82b20b51e259c26bce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311512, "uuid": "cb95435b-04b2-429f-8675-dde59fad69e7", "comment": "Malware payload (Mirai)", "value": "9dea2121cf9271890112ef9c5e9d523ce05601d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311512, "uuid": "77165b51-55c7-49a3-b0c7-1d22f6ca7b04", "comment": "Malware payload (Mirai)", "value": "16a855d72bfea2c9e6f8312408d5101ad34af3276b0680b131b09add3b9053b90bf43a0049e5ebe20de1671f32b73812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311512, "uuid": "f8f71d6b-4df3-4781-ac69-a7a01ca0a845", "value": "T1E2F30846FC818F16D5D512BAFA2E128E33131B7CE2DEB2039D146B24778A86F0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311512, "uuid": "4e2cc52a-d4bc-4451-ae08-3c3d9ea6b88d", "value": "3072:54BclEoLmpMguHcUxVUHalw7WVuH01sfClEZyQniU7XAAaitg5DcnS7kgIhre:WBpoLmpMguHcUxVUHalw7WVuH01sfCT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311512, "uuid": "880964b7-2d71-4e2e-afd5-e676e7cee239", "value": 160048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311512, "uuid": "33f59c57-2523-4536-ada5-b73b5ec9dd38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311512, "uuid": "6e160604-2375-43a7-8ec0-7cf6f7266b12", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f0a388-81f9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784304282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304282, "uuid": "8e85da8b-7e56-46f4-93e6-f06725bbce7d", "comment": "Malware payload (Stealc)", "value": "3758fdfb9d7f2a7ea33de37f312b9187", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304282, "uuid": "8597961b-7d36-4440-99d6-b84a4b691aec", "comment": "Malware payload (Stealc)", "value": "7ef71165b0dd233fd0f5642d2a4e1e36fddc5656a209236d80460d50417fae76", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304282, "uuid": "7d96fb38-a4cf-43c9-8f6f-10da6e4f7ed4", "comment": "Malware payload (Stealc)", "value": "181aad55a1fe38dd5ec67dca6ebcbad2590215a3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304282, "uuid": "c7869fd3-0076-4be0-b739-dca77c3ae041", "comment": "Malware payload (Stealc)", "value": "583cdddef917d8f8a5707a7e80cb2cc402c09ee7886a322d77905dc856e73bfc6fe68b574e60faa17a4e41aad9fcfbae", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304282, "uuid": "d19251d1-0259-4fc6-9819-aa747f2604c3", "value": "T1D675280BBCD005F6D4AA9232896761517BB2BC490F3127D73AA0B27C2F727E49E75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304282, "uuid": "196d841d-9863-4d63-8fff-ec21e0173e40", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304282, "uuid": "cb13d05d-3dc8-4359-b357-702d0131b44d", "value": "24576:zCR9cpa51QhL5NrEs/dhYga/QBele5yKD9e++vRbui:zC/oanQjN3/dh+2KvRbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784304282, "uuid": "a4cdf1a2-9273-43ec-abba-09e5ea53b40b", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784304282, "uuid": "c739a105-4cd2-407a-88f2-b164d60afd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304282, "uuid": "0ee5b1a6-18c4-4b1a-88a4-c155cbfcf6e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cf7324-81c1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NodeStealer)", "timestamp": 1784280437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280437, "uuid": "142bdb45-da03-4f03-83ba-b9a657cb3e29", "comment": "Malware payload (NodeStealer)", "value": "d84608df8858012a0973ada6fcf8cc84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeStealer", "colour": "#E92F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280437, "uuid": "944d7f67-c140-4187-90dc-f0311dff4754", "comment": "Malware payload (NodeStealer)", "value": "7fdd6fde6ea2e3d40119544558b89ec7d1f295a2b00e2f1383cb728caae1af74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeStealer", "colour": "#E92F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280437, "uuid": "eec9cee6-ff95-466b-8d27-245b48f13f82", "comment": "Malware payload (NodeStealer)", "value": "7459af2d0be84580a0c273f709d0f60f2c2eafa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeStealer", "colour": "#E92F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280437, "uuid": "fb5d2a8b-4c86-46e6-aa9e-fe0c52bec991", "comment": "Malware payload (NodeStealer)", "value": "e37b333de178452bcbb08e9faaa0e8ed4b921e7d410c9bb256b42fa7da78ac0f8e8a47004fb6f4756649516c2baa32a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeStealer", "colour": "#E92F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280437, "uuid": "61377899-3b93-4118-a743-b73349eaa987", "value": "T1261833A44C25C5A1DB3405729266B463AFB90F018AD71CD2418C3DBA37BCBBC696F5F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280437, "uuid": "3070343f-0191-42c9-86a1-739352e63654", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280437, "uuid": "cccfcf70-2fb5-4e36-b098-33c606e8dc4c", "value": "1572864:RD+BaWatprfMFHjfem8aI32PYUBFyTAzA83iXNJpX0UN6OC5vk61wPlxyOui/8ai:p+ZCrfMFHC6QyFaAyXNJpEk3MvB1OyOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784280437, "uuid": "a67a60be-1d9c-49e0-ad35-fb4e75ea12c1", "value": 86065735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784280437, "uuid": "04d20152-fee8-4852-8486-dace19d69ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280437, "uuid": "ddc71407-3385-4cdd-a75a-16d37770e030", "value": "mpextms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e51f23d-81b0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784272857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272857, "uuid": "43001dcd-909f-46e2-a942-2d45be2ea7e5", "comment": "Malware payload", "value": "0e8538a4790c73f3ffe23ff032c93e6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272857, "uuid": "3c83066c-5839-4f8b-ad39-11cb49f12b8e", "comment": "Malware payload", "value": "80d64e87d51dab90ef7a3b3c21b03995dee9e00f27a07657068881d74e4d4aeb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272857, "uuid": "0170423c-5437-4959-b9e8-0594ed82f6f8", "comment": "Malware payload", "value": "767fbf4aee334a88418f7be8bd0ee3295e2831b7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272857, "uuid": "0b7b9536-2780-4d23-9c3a-138db7dec4b4", "comment": "Malware payload", "value": "be4ea89b591507fc480cacdd04a20b548bbede2bde227177c790e59eb511df19d337de550138fd52510dcd47e3b43f26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272857, "uuid": "466135a2-4ca3-4e39-a652-3975442874e7", "value": "T1FEC27D966A867C40BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272857, "uuid": "b4d6598a-3778-453a-9325-be6dc61e39da", "value": "768:Mn8vCB+25j6es8RvY9FYpMSUpi+20qUpi+20YQX:w8l25JWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272857, "uuid": "90e1ff02-956e-4502-90e5-6b90097b61df", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272857, "uuid": "0dd50c41-4674-4c90-90e4-bf25a542a913", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272857, "uuid": "906a7e00-8124-461b-b55d-352312f5f33d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ef7301-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315330, "uuid": "e1251f93-14a3-4f41-8db6-8ab1b2c628b2", "comment": "Malware payload (Mirai)", "value": "62d71b4b14282a8cd4a6cc213a3e83c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315330, "uuid": "2a55236f-eb4e-4258-b36b-ba0c538b30a0", "comment": "Malware payload (Mirai)", "value": "80fd8412be2b53ccbae4cc490eace95cd0594fcf3b8617dc21816300b2af43cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315330, "uuid": "a9ee756a-d74d-46bf-b9d4-1533948a6ef7", "comment": "Malware payload (Mirai)", "value": "b9ba5bc063e300ae1d487e2cab0ac989a31d42d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315330, "uuid": "da505564-98a8-4290-bbfa-3a3e3007589a", "comment": "Malware payload (Mirai)", "value": "bd8c56e0b6953d237b251462828b3349f4136f77f911eca201102ac9c0d2d504d570aca83690565bed907af8a2de5dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315330, "uuid": "1326830d-1b80-44a5-bc94-75b1cc96aa92", "value": "T188C33AA9F880DE52C6D126BAF75E518C33231778C3DE7106CE149E3467EBD5A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315330, "uuid": "9054759f-8674-4b97-a39f-6d12f2664eaa", "value": "3072:ub/jjtOjapNT96thy/Koh6WbgcYEEUQs7pEx2dzZ5aFP7gUknD+df1Dl:ubroAoV8gcYEEUQs7pC217aFVSSd95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315330, "uuid": "cfc329ef-373c-4ff7-ac2a-dee09e77d9f8", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315330, "uuid": "440b42d2-879e-4762-8500-9e294dc615b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315330, "uuid": "bb66b872-00ee-4b98-b174-aa87ab34248b", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b58e56a-8177-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248613, "uuid": "ce160290-d62e-4aac-8d41-33e00a540e11", "comment": "Malware payload (Mirai)", "value": "7096945864afc2e99f5b447f8c7b5705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248613, "uuid": "55f1520c-ef0a-49a4-b396-92ee896887ce", "comment": "Malware payload (Mirai)", "value": "815d37f2c17fbed0d44554177fc338f577901fecf43e101b8809b5540777095d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248613, "uuid": "d8e82279-de5b-4188-849f-ac0dd39245f0", "comment": "Malware payload (Mirai)", "value": "0b155c87dd0de14487f7e1d4f08105f6d7547628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248613, "uuid": "f18a45a3-cf50-434c-80e3-705fc75f08cd", "comment": "Malware payload (Mirai)", "value": "d68e50fda16bb72620e0e812026fb432bd8d0e868abe6ffa2cfa118ca4f4bca91941efa33369e5fb79bc530528cf41c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248613, "uuid": "dc08c3f5-d7c2-4eee-85c3-ab3c509df9b5", "value": "T1A2B3AE36E81968F4C06E8574E5A4BE790BA3F48052931EF716E6C6B65047EE4F806BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248613, "uuid": "056c1e88-1f1b-4eb9-b417-729100b2934a", "value": "1536:t/juy48gLDajwrmRZ2QprowQi1YKiC7p74Pe/9C/6otd1pH+:t7uy7eaMYZProwQi1fiQye/93efpH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248613, "uuid": "6e52c82d-c4a5-492d-aafe-3daf464b39ae", "value": 109776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248613, "uuid": "efd64781-6a3a-4edf-9ff3-ddcf68759d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248613, "uuid": "77fb6e6c-d810-4269-8a62-cf2410c0ce2e", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e56d368-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284132, "uuid": "98cda88b-caa5-4ceb-b264-f4259ad9d501", "comment": "Malware payload (Gafgyt)", "value": "d39c1a192b7a34906e94187b4ff348a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284132, "uuid": "c5737813-761b-435c-99aa-bb0ff703dd56", "comment": "Malware payload (Gafgyt)", "value": "838c172ad103c5b8113e037167b610cf4d1abf9237bf58288bbab177062f95f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284132, "uuid": "a9fa5d3e-5615-41b9-996b-38cb4fb1c12a", "comment": "Malware payload (Gafgyt)", "value": "b4a162803dbfa06e5e62592e82b09d814c232e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284132, "uuid": "f96a0834-bbb9-4cb3-829c-d8b449e9ecc1", "comment": "Malware payload (Gafgyt)", "value": "9f022db035ba4d1da12f6691c74a2367bfb1abc5e845b00987cf4eb3113ffbc133dbfd46e2f315b819a43e7834b58e82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284132, "uuid": "112e7136-8234-4404-be7f-e5f6d5d78fa3", "value": "T164A30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284132, "uuid": "65b62e14-4743-4674-846a-b4e02bac9ced", "value": "3072:nkrWBIvC/IymEdH8ffR6OKmuxVqDr78fz1e:nkrWBIrym+8h6OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284132, "uuid": "94f9b1fa-6b7c-4f40-939b-de01a34cf37a", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284132, "uuid": "f3fff408-5170-4a1c-844d-7c52da60ba84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284132, "uuid": "dc0a08c6-a2c4-4615-abef-fe5cc823aa5f", "value": "m68k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dc8a7d-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272009, "uuid": "f4bc672e-b5ef-446e-a239-d26dc73c662c", "comment": "Malware payload (Mirai)", "value": "bcc12f5d7a51723ded0a8defce750b3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272009, "uuid": "430a171f-897e-4ec8-b82b-9f253159572c", "comment": "Malware payload (Mirai)", "value": "854da1097f13e304367806c298e077103a8519d4102acce5c46aaa98c0995ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272009, "uuid": "6eae4f9b-9fdc-4a5c-890f-020f530cb34e", "comment": "Malware payload (Mirai)", "value": "9386f4ff141d9b4b6c8bba505407c7d5654d94ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272009, "uuid": "838dde3e-bd91-403f-9c3d-6f310a1971cb", "comment": "Malware payload (Mirai)", "value": "5f29b73403fd7601abab7628ac7e9ce1ffa20721d57550587967f090c06da975c0af8b7df53645d5cf2ee96ca3debf31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272009, "uuid": "0e2006d9-a8b3-49a9-b108-7a58383c3b3a", "value": "T1AEA3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272009, "uuid": "ddeadc49-30e2-4ae8-9c47-8c02cf90957d", "value": "1536:LvGefaZSdt/t4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdM59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272009, "uuid": "1ba68c41-3c12-44c4-934a-2537452691f3", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272009, "uuid": "24e13da4-fe8e-4ea2-ad78-07b804b842f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272009, "uuid": "769345ac-c05a-4e3a-97fb-89686dcc9448", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b0636f-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784329778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329778, "uuid": "19a6a7e9-e60d-4de2-9c5f-a5f4a266c0a7", "comment": "Malware payload", "value": "3fdeaf02d78f931d20874f8bda9d7c98", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329778, "uuid": "40004f2b-bb91-47d3-82a9-828205cb6c62", "comment": "Malware payload", "value": "8689dd49ac380c1a3c15509eb1fa842ab69374c00f453a1f7f86e4693958606d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329778, "uuid": "c337fbe2-71df-4754-90a6-8edebb1def89", "comment": "Malware payload", "value": "f99c5762f4deb50c119685a159f6d40de68d746d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329778, "uuid": "d7ec9c61-d419-479b-816c-919d161aee7f", "comment": "Malware payload", "value": "bd6a51d8897bfbb1c81cca5ff6449228bbbb1e2951ca7ed903332c1a0236944f29f754f6a6447783fa383998c9d16edb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329778, "uuid": "12e25b35-6509-48cf-80b1-310ada653c42", "value": "T1BC01C8AF805140D16F84E90879A34924B20ABBDA34F68F8C9C8E287511DD998F831F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329778, "uuid": "90b3bd38-85c9-4633-b1c1-45b06ca6a2fc", "value": "12:t9hZDmHWxnHWxzvazMHW3IjDWIMHWyDiHWq:t9hZkWlWxzCzGW3rhWywWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329778, "uuid": "deb99647-d0cc-460a-be4d-894ae424a425", "value": 667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329778, "uuid": "89ca9ee1-0441-46c2-8594-4732387e304e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329778, "uuid": "3694f6ca-ac6d-446f-b446-9e1d47dc8d02", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4f4b58-81c5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784281957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281957, "uuid": "6ce845da-e09f-407d-a82e-bd61097fb1a0", "comment": "Malware payload (RemcosRAT)", "value": "6a89d5fe905b1c226edc42b382f94d08", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281957, "uuid": "33359091-308f-4682-a4a6-5d53e8412f85", "comment": "Malware payload (RemcosRAT)", "value": "8765f214c14f45783e4e25d808f87a84cdfebebfb5e3480f4e44f043f2d00713", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281957, "uuid": "74ae0c3e-c1a7-4adb-b55c-392ab5516d4d", "comment": "Malware payload (RemcosRAT)", "value": "4496bb59bcc465d060f7e6cb38610df3c9008fda", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281957, "uuid": "1e26280f-9e7a-4951-aee2-7383d515e9d2", "comment": "Malware payload (RemcosRAT)", "value": "ca9c6763b1d2f79cc9f567fe9e0b684b3bec250f1a362577bfbf743be1c60d1dc67e9bfddeba1181cca835865c3893af", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281957, "uuid": "404efa82-cd47-4090-9a2c-37703759411f", "value": "T191C21862BF4105534ECBB6A2CA7CCF2B9DA4E9914531BC60ADFC3B19C845B0C367D51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281957, "uuid": "22a63e42-072b-4e9e-b863-138ba01dd721", "value": "768:RJPA4WMPvJujcqwWve4JP9Bdv0i1BCNHZ5lgJDOsy1oiB:knANK3JP9Bl0i1BCN5HgJDOtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784281957, "uuid": "a1a774a4-70f4-4af6-900a-aa339125cd7c", "value": 26884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784281957, "uuid": "0180eb55-5d68-4e72-b049-2f747b2bc009", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281957, "uuid": "684f0518-85d8-4e2d-a63b-362093a3c92f", "value": "INV35 INV38.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153d55ea-820b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784311953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311953, "uuid": "8b852c37-0482-41e7-a21e-c2b84bc99c68", "comment": "Malware payload", "value": "3b52411202288830c092ad8296c4e07c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "run-key", "colour": "#D656BE", "exportable": true, "hide_tag": false }, { "name": "stage3", "colour": "#3229BB", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311953, "uuid": "399b5801-379e-4586-86fe-855e735b0edb", "comment": "Malware payload", "value": "88821243a9e1eb2a094809552693af8a35f1cb67504d78b2f300091e4d0bc89f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "run-key", "colour": "#D656BE", "exportable": true, "hide_tag": false }, { "name": "stage3", "colour": "#3229BB", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311953, "uuid": "83052acb-9316-4a34-aa2a-38f6f919271f", "comment": "Malware payload", "value": "fe58ec3013e5202861e6949e10ddb2eeeb3f4019", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "run-key", "colour": "#D656BE", "exportable": true, "hide_tag": false }, { "name": "stage3", "colour": "#3229BB", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311953, "uuid": "a7b28f91-bcb2-4103-969c-542ab7f41b09", "comment": "Malware payload", "value": "ea5b5748cab1728953632fdbede9532d57aa899a2fca9eb5f2eb0af44b957a3c9f4121bb35209cbb95e1d46c1aaa7bd9", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "run-key", "colour": "#D656BE", "exportable": true, "hide_tag": false }, { "name": "stage3", "colour": "#3229BB", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311953, "uuid": "c430ce87-4bcb-410f-911d-937a3abb294f", "value": "T10673C36973FC528EF5AF1B7EA8F013D18BB9FD233102D25E564950956821BC96E00BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311953, "uuid": "079e54fc-80bb-45bd-af7a-9401dd6e3b6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311953, "uuid": "bb179484-ffa3-4cb7-8f6f-ccaea88eb575", "value": "1536:7LfrGskjToj6C2NyHuDQ0ubv/ewJVXLTyL0oBb2HWtp1xps2x:3TI0a9DQ7bdJJ3yL0oBb2HWL1xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311953, "uuid": "952de6d6-7018-40b2-9349-3e425a15f377", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311953, "uuid": "d680c314-802e-4865-8f25-e91833d41ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311953, "uuid": "2fcb2305-f6e5-4ec0-b848-65063ca3a922", "value": "67sSMhFVwqb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32248006-8230-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784327893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327893, "uuid": "4845863f-de6f-4d53-895c-5ca3c465791e", "comment": "Malware payload", "value": "c413d7a78b2830e89965c7b3e7e3139e", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327893, "uuid": "dd2602ee-3153-4787-9eea-0e65968c06b9", "comment": "Malware payload", "value": "89ce478cd3190b040eaab88adddfa43c166a00371d83b7875c08d109d7e5569a", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327893, "uuid": "269ccbce-c67f-4d8c-94fc-c93de1815151", "comment": "Malware payload", "value": "ae72e3532aa10f18984fe5263f8297da85234dbe", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327893, "uuid": "c925bd06-f97d-4c02-abbb-b526f727ab43", "comment": "Malware payload", "value": "f1e04d27df4a346ee9b01e59d0cab4d429de27c38aad1868d7ac6c5abdae572b9f4415f5ab010a92ff2b97f8228dae98", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327893, "uuid": "c11997d5-b497-4ca5-9370-fef652b3ef8a", "value": "T1B4D512463F00E806D4951E759AA8CBF86371FD5C9B56934734E3AE2BBCDE6C32E01285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327893, "uuid": "943ecea4-85da-4171-b2d7-9a974718c697", "value": "47e1b6c93da00245a33e9a81299262d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327893, "uuid": "5d49b57b-4007-42c3-9530-3fbf9192e55e", "value": "49152:8SJ8j5Hk4plhcy/T3fX5ZoOLJj81ibk7OB4nTnyvBSss7Na9:7J0Bkghc2XxJj81ZT4BSFRa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784327893, "uuid": "e4c472c2-713e-4fc5-9050-ac40b7aa439d", "value": 2878760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784327893, "uuid": "63544fc5-af6c-4546-a712-214d2ccec2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327893, "uuid": "c0a7dd49-52c3-4481-9f28-13f75be18d57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0d9703-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272079, "uuid": "6070304a-0de5-4bd6-8246-3aa6692ac5c8", "comment": "Malware payload (Mirai)", "value": "a8d0c8ade4a27fa64c4ffa3469e2f56c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272079, "uuid": "81ab0c29-9743-4b4c-9562-34c765e21905", "comment": "Malware payload (Mirai)", "value": "89e039db362ecd0f3b24b85ecf7f06bf9908f331ca35ad455d00bb2c271bbdca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272079, "uuid": "dc06efe1-18c7-42ab-8924-80592158e389", "comment": "Malware payload (Mirai)", "value": "ac5f2e65b1c3248db6cf69b8829d71e231ac634a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272079, "uuid": "71169dd6-3f01-43f0-8c1d-f4b8df0a1bea", "comment": "Malware payload (Mirai)", "value": "9e7c0f326ac6eb6ed5071383bfcaf4a55f3f8b9baf63f4833a5564ca46a5ab0def4266d81cd33ee7e19f47b4a8a2e48a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272079, "uuid": "ea3a0935-d718-48b0-8fbc-c2e45b761af6", "value": "T10C831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272079, "uuid": "84b31fe6-c793-4013-aa8b-4e47073fb1e2", "value": "1536:ijna/CzPC7fG7bnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Um+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272079, "uuid": "655865d9-afc6-41b5-adc0-1ffa5505c782", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272079, "uuid": "79323fce-8491-4598-a979-ee3ddcb10dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272079, "uuid": "e1c0d40f-cf0d-40e4-ae3f-d6c2a58b197b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e0b90c-81c4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784281671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281671, "uuid": "2c99a8ae-9524-473d-913d-c91655d38712", "comment": "Malware payload (Gh0stRAT)", "value": "ff9fe52dbc73558bd33afcabc927499c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281671, "uuid": "3baa1954-b9c9-4d69-b785-c08227b4df95", "comment": "Malware payload (Gh0stRAT)", "value": "8a72afcb3bdd892ae106b2e6c7bd3df4e4be98f151342509603e31d7efd555f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281671, "uuid": "8cfa7116-900a-45fd-9fb7-455ca86f0598", "comment": "Malware payload (Gh0stRAT)", "value": "6eb863d1b0f876758b57fde87ad574f4749f8783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281671, "uuid": "df1777e0-cdbb-4605-8e85-d7aece9e0a84", "comment": "Malware payload (Gh0stRAT)", "value": "1dca94e8c99d8752139d992bfe6bc6ed28dae1a2b649f9a4860e761efb2d84cbcca34d1464687b1c8c116aef9edca449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281671, "uuid": "274d1238-2cd5-42c2-ad3c-ab0da6ba2d58", "value": "T1DA273313F2CFA53EF45E0B330A72A15950F766546623AE6787E488BCCF294601E3E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281671, "uuid": "6fccad81-b920-4f14-856b-60f16852ab82", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281671, "uuid": "9f2d963b-b33d-48ad-8fc1-a47abf3e38ac", "value": "393216:iXI03ReENxGFrR+6yfAU7ILQAVxkAYAhaSjuP3b3a0Hw:KhPNiDKMLQADDJaSKP3Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784281671, "uuid": "cd502ecf-dbef-4012-82bc-f361420eef9e", "value": 21319441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784281671, "uuid": "b6088b19-6c9c-4315-91af-144d6e13e67b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281671, "uuid": "20b08f21-1475-4f93-8bd2-744f612fe671", "value": "PROPERTY LEASING AGENCY AGREEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d94591-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315597, "uuid": "c3491fe4-15b0-448c-a96b-ab9cb9feb909", "comment": "Malware payload (Mirai)", "value": "4ae0b281d84f68a0b440ef847e883297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315597, "uuid": "3fe080cb-4d55-4b79-8b3b-b64430269e50", "comment": "Malware payload (Mirai)", "value": "8b55984017290d153ba01a21b06114ec235bd153f7c7df90c28944fb81b52c50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315597, "uuid": "f915cbd6-c8e4-4cc7-92f5-a05c8f569407", "comment": "Malware payload (Mirai)", "value": "71cf15b5cd1581b9d8515f4e092fe722b71c785c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315597, "uuid": "0b7da9aa-e113-49cf-b9a1-ebc92f630f6a", "comment": "Malware payload (Mirai)", "value": "3a7cc3135548ea9d2b3c4c8a94af8749488b1cad0e415d45f2142f6e3154dea90cc43a39c720798959530641bcec608a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315597, "uuid": "cc060e45-1152-40b9-ae31-74001a8a36cb", "value": "T177F3F80AAF610EF7D86FCC3745E9470625CC645722A93BB93534E928FA0A54F4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315597, "uuid": "b82f4cdb-b5b3-432d-be86-fa587b244a68", "value": "3072:SuaSS2wgFHVNMW9KrtcLtkpc0rXx3/HvpQXhDdnbJgn3:XakgW9KritkpNzV/HvYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315597, "uuid": "2e67aa19-1a85-49f3-ac14-77f0363576f3", "value": 168516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315597, "uuid": "096e07e6-cd41-42e6-a576-148967f26537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315597, "uuid": "cd15f88a-181a-4972-ad17-40e1a2001b98", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc00bc8f-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784272344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272344, "uuid": "cdf884c3-a487-432c-af41-2bba1fbadeb3", "comment": "Malware payload", "value": "e150ef28bade6e989f644f008b115dbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272344, "uuid": "fab63e41-3b26-48cc-a7cb-358af6a423e2", "comment": "Malware payload", "value": "8b85b12f3dc058338cff0f4142f7cc8fa02e48ecb806b0d056cc958f791d56d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272344, "uuid": "4fdb3d76-b147-4d9b-ad46-634df654b38d", "comment": "Malware payload", "value": "bae14ac1897fd365d499b269986d50af2a56f3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272344, "uuid": "0dadf6f3-0ce2-4fec-b20b-44f6ae4db150", "comment": "Malware payload", "value": "5705094d0633cc0f44344760a4325454f0bd2b60ec4957b0b0fa3a361de2506bc7667ff6d48105710b2e7460e832ff09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272344, "uuid": "fc7984d9-281d-432e-98df-de7721011895", "value": "T1F2D3C50E6E618F6DF669C73447B7BE35A35833C726E1C645D1ACE6101E2038EA41FB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272344, "uuid": "ce639de3-c5d9-4030-a420-0ea00c2489f1", "value": "1536:SJJQhR1PUtLuA1dat9gNRfzLPUyL7IB1WrsF6E79O/+teHi+jcfJeCWGV3X8Wgns:SoR1caogAvPUyAWa79O/+teH1cT3Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272344, "uuid": "2478db2e-4a89-48ba-bf33-17e1d6061083", "value": 138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272344, "uuid": "13eb4095-e108-470a-ba62-bb31bbfe3c08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272344, "uuid": "284e3593-bab1-43af-b69c-2943e23d4478", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b9f127-8215-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784316221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316221, "uuid": "85839654-bf99-488f-9742-16e8ce0349f1", "comment": "Malware payload (Mirai)", "value": "adf27f73ad47dc322f8e9de0a4fcd65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316221, "uuid": "d3c0c8fe-58e8-4d9b-8503-3cfbfa443a24", "comment": "Malware payload (Mirai)", "value": "8bebfa6b5bf0848c559bcf738cc7519489c0ce5426a124956cdcb78c440ac22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316221, "uuid": "4559def5-54d4-41d5-ade0-e6dc17055167", "comment": "Malware payload (Mirai)", "value": "43a5c7ef4c6f490d96debb53658f83ca41f4973d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316221, "uuid": "b26c92c0-4cef-49d0-b24c-0f7232284b4a", "comment": "Malware payload (Mirai)", "value": "6bc3dcac1c30ddb171e6d0a00e727d47eb766859c22140da54e5de5a93df732cc45da91f7ab902636d07878433a9fa74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316221, "uuid": "de20a99a-7937-4fb4-a3a7-5c7b60065a05", "value": "T1D04302F2525CAAD4E13336B15E4A87945D6C7443E00FDE8D08C278FFA869B9534487EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316221, "uuid": "eba2f6e9-ad3e-41fc-ade1-c6045ae4a52e", "value": "768:y52ZYIVlXwYfY5HX+rOUQf9MR4KnNSMQ1szDlZqkgM8wSK+O/r0gcJz5Mhk5izdJ:bZXXjqHOBEMRE1s1tgl9Bwr0gcJihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784316221, "uuid": "6aefd2d4-1ee5-4673-b89d-dd31b7aebb4d", "value": 59376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784316221, "uuid": "ecec51d0-8f49-4353-a043-a90cbd11819a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316221, "uuid": "1682619e-a169-4a8b-87c2-738b604792e0", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bf1cdb-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784312513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312513, "uuid": "3cfa8040-46d0-44df-be5a-62f640c148b2", "comment": "Malware payload (Vidar)", "value": "240861bb6ee7723f0a7449ec501c466b", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312513, "uuid": "903627b5-49f8-4601-ab7a-6ddf16085326", "comment": "Malware payload (Vidar)", "value": "8ca5069041a3de3536f0be3b8f1b9044a0dfffd0295d7495cbd57d6a312af0b5", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312513, "uuid": "becce79f-4d1c-4523-b6e9-c3f13e0dd18d", "comment": "Malware payload (Vidar)", "value": "f6d6bf43990bde77af73d24f237c86889adacbfd", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312513, "uuid": "269f5876-291b-4ced-9163-f36e482c49da", "comment": "Malware payload (Vidar)", "value": "47e0319fa903c796cfe5f854e2e5fe52c80ed283311df1ba24873d44314f55989bd8219ae7efcc03c2967dc3bf97faca", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312513, "uuid": "fc24369c-99f8-4f3a-8b2c-5ad2694ba7f8", "value": "T1C2F7338083558755D0CB5FF8617F0FE3AE2A0DE0A72DA0BB46A78831F5A9467C69C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312513, "uuid": "1a612a33-dff9-4955-af82-0f68c832d1e4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312513, "uuid": "abfc1ffd-bac1-4700-b719-e6e7090ec65c", "value": "1572864:VLdkzxkqDfQFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7K7:V2FoaABZVPArg/bXeB7K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312513, "uuid": "661a598e-9e8c-4a6a-b662-8422dd48f248", "value": 71357910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312513, "uuid": "b94488e0-c5a2-4b2c-8ff5-8e4f039eb7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312513, "uuid": "0ad0f100-754f-4d43-a7c2-79505af5568f", "value": "ggwpcheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa96b6-8219-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784317967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317967, "uuid": "9d520495-1030-4c86-908b-d4e15d121246", "comment": "Malware payload (Vidar)", "value": "7514a13877ee29b842859862663a03ed", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317967, "uuid": "ecdbe2a2-1170-4b44-8a6b-d551ddc0f8cf", "comment": "Malware payload (Vidar)", "value": "8d5025b2ab7917dc3283738d91634a741d1bc3e03196d2855a1fd81fd9d80381", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317967, "uuid": "35eb93e0-e07d-4438-bfe3-14f1c38bcb47", "comment": "Malware payload (Vidar)", "value": "7df07eb1b7ba163c1a97b2120f15fdfb4bbc0cd6", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317967, "uuid": "896515fc-6b92-4a8b-b9ba-65042727e97e", "comment": "Malware payload (Vidar)", "value": "cd7555e76b2aedd6e5284f84b08dc322092f6042473afe20e3cb588bfdb82144562528e8c09c6fc076ff9ce196e73416", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317967, "uuid": "75ed006c-018d-47e1-bf3f-d39d2305584f", "value": "T117F7338AAE22F03FF453D473E11856E9625AE054D7338FA7122E90DEF8F27106B441A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317967, "uuid": "47f59b13-fb24-4dc9-9f22-08221cdd9211", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317967, "uuid": "1fa0212e-ac6e-4ee1-a602-353305ea56d6", "value": "1572864:cR2um44HiYzg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXy5:cRTm4vx9NYJo+sUifljLcs22/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317967, "uuid": "b0e933ce-a314-4e65-86f8-99258a2472b0", "value": 77112690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317967, "uuid": "39140cae-5d98-49fb-995f-4bb86a790887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317967, "uuid": "050ad9f4-c9f9-4621-86c1-6f75af21d555", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107b311a-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "ba08a9a3-0cbe-4f44-9dbd-5b9b5c1e6c74", "comment": "Malware payload (Mirai)", "value": "3c0ec326aa16034987b460d78aad5c96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "6aa8e226-148f-4ec2-a791-9a5b802913cf", "comment": "Malware payload (Mirai)", "value": "8ec2961d98fd77f7398d57349f0ad43e8a2029f4bb206eccab7312750e06cb57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "733c43ff-292b-483c-881a-007a791b2229", "comment": "Malware payload (Mirai)", "value": "ced61c300536af31db0995686ca4f99dbec1b074", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312375, "uuid": "26a878bc-0354-432c-b6ce-2e21d5068795", "comment": "Malware payload (Mirai)", "value": "a05f59e6a9ea997637aabdeb9b5e7cfa7fefe8f055b42f66d1f15de0ead2f69667e2a1889e3be452f6a5bdb6b3dae860", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "18a224ae-efb6-42d1-af18-df0939db4410", "value": "T17F631B07BA428BAFC14FC1F407F7663A9922BDBE0A36F1E5E3A4FD865901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "2175a2b4-a4a2-41ec-b6d6-dca9c43b72cd", "value": "1536:GnHkHRxHBFPSWGz5GAlOy5TGpWE7wH9OXEL9qj:mHkHvBFVGz58ytJE7wwXEcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312375, "uuid": "65143515-635f-4b28-a557-82c5b40dcf87", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312375, "uuid": "9419ee6f-3cd1-4030-87ad-8d9519dba2d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312375, "uuid": "821cca90-c4a9-468f-b5aa-cc397f2cd07a", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d31d6a3-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784329764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329764, "uuid": "7a5a72bb-a55e-4906-baf9-d1d16ca15145", "comment": "Malware payload (Mirai)", "value": "6621db9c84163ec9dc1dd34ba567d93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329764, "uuid": "6d75bb10-d549-4c85-988a-7345db60303e", "comment": "Malware payload (Mirai)", "value": "902b6affb47b3a6d9f8d618d4dae85730a6d6eadc3c4a8cf66c81f5375f9b8ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329764, "uuid": "2a057ad7-629c-41cc-80a3-cafd4162f0bd", "comment": "Malware payload (Mirai)", "value": "fca6e34ac7cb27e1b092d6cc8bf977e7248445e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329764, "uuid": "89954ad4-74e0-4cf7-9efe-588587b05086", "comment": "Malware payload (Mirai)", "value": "a30c14380f75c4c524d8da5fd2eb694593d649e74c0d6c286c065e099f1397d26e1ba164cff330c10ce446e9d001d4ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329764, "uuid": "d71f17e8-2d1b-4654-9742-f9b517b8be0e", "value": "T1C831CAA1A7D09DBDC4F451BE9E5B0310B3799F00E0C67222870C636A6C1AE3CAD27446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329764, "uuid": "78d136cd-d453-4636-8a3d-76064765a999", "value": "24:uTcRKGpa7Urz/jlfo+XK1hZVev3gRGaJ9ixBBuLlTO9gjSq:uARKGpa7UrLZos+JCBu1OZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329764, "uuid": "49fe6b22-d3d3-4168-85e5-4f9b083dc1a8", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329764, "uuid": "60a3bbef-fa79-423b-b068-2a7f579ade65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329764, "uuid": "e2365823-8adc-4de1-ac44-a9493d83e477", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d044794d-81df-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784293369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293369, "uuid": "9450b50b-1fd9-4d5e-9ed3-886bac2478a1", "comment": "Malware payload", "value": "a505716d241525ca14e456ce520c25fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293369, "uuid": "8bd3f5bb-7223-4372-ad51-3109d5bcd6c8", "comment": "Malware payload", "value": "90c36e87a63017304566312f77df1e01df74eb9ede8bf381a9590b5f867b5f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293369, "uuid": "c0fe89f7-d01f-4d62-bc7b-7aae3d2ebef3", "comment": "Malware payload", "value": "7aee95c4efe0a9773a183e935d54195dda6f6aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293369, "uuid": "18742d56-f17b-469e-b247-1409c176ebdd", "comment": "Malware payload", "value": "6740d49652a86be52c832acb4ef24c6555db7ca7bf59e7b75cbdc2ef8701bd741494f1b6c723fe96ffd879ea872228af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293369, "uuid": "6b2bc1fc-9058-44a1-a505-3e9e2355c37f", "value": "T11E08333B0235E396D3E19E7421F63279F161972D6B339C8EF10C50B86FA8345B66486B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293369, "uuid": "51915298-6bfe-4307-9e18-bb349dad0109", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293369, "uuid": "b17ecbef-cf05-48da-a0fa-6ea14352efa8", "value": "1572864:Pt9IKP6DpHBRWYi4ZRyxMlMcGBc3kdUF91CAnpbOu/57:PUKSDjRWH+LlMJBSkGFGAnJOu/57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784293369, "uuid": "0b6fea02-9b91-44e1-ae9f-ba52f7520774", "value": 77203211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784293369, "uuid": "cd3cf57b-167e-4ba0-bf02-3f6a8fa7352d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293369, "uuid": "f0c77d6c-5e88-44e1-87ac-db40ec100608", "value": "Game_win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3dc23d-81f9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1784304212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304212, "uuid": "7539ab79-4200-4345-9e3d-753dc0ef4192", "comment": "Malware payload (MassLogger)", "value": "aece944483b7b6529ffb7561baeb4b40", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304212, "uuid": "f4e487a0-0dcb-43de-a6d2-a7356da2421f", "comment": "Malware payload (MassLogger)", "value": "9174fe7f2addfc20d8409a83eb3f5958a9c7b0ac86405929771a16a6ccabc921", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304212, "uuid": "70dac338-a8dd-43dc-9a7f-6e106a5157db", "comment": "Malware payload (MassLogger)", "value": "04e8dd9ae656f3dcdf54b022ede7dd42e3fc0ace", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784304212, "uuid": "d71ce8ce-aed2-4af2-be98-445bc14937ca", "comment": "Malware payload (MassLogger)", "value": "a03fc0b087b7525260656d42f4e8bd5bdbaed9f872f4d2adbe5bcac4d793e2e9a46cd6f589440bfcd6d435cc7d8af7bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304212, "uuid": "317bb554-0bbe-454c-91e1-f20bd45e6b84", "value": "T1C375F14155C03EA8E7EE973541BEA5A7F3B10CCA682C6946E732FD45EEB3500C31627A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304212, "uuid": "e4e907a0-fcbe-44a2-abc5-5f7d7e5ec888", "value": "24576:VzoJ+YuM7IZDalZFikBPzoJ+YuM7IZDalZFikBzb:8n/D2n/DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784304212, "uuid": "245d7fe1-bbbf-4e04-a8bf-c089f1a9d37a", "value": 1585430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784304212, "uuid": "e3a54ae5-c3de-4140-8f08-de6f4ed1c859", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784304212, "uuid": "7f3965e2-7fe5-4c4a-ae61-b84873b81f42", "value": "PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4dd0e6-81ce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784286142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286142, "uuid": "28ad4aac-424d-43f0-93c1-2b1bf8a252be", "comment": "Malware payload (RemusStealer)", "value": "8479ec3617da30d1b176924dc7a612e7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286142, "uuid": "e6334fca-b86c-4ec9-99f6-4129361a3643", "comment": "Malware payload (RemusStealer)", "value": "91cd2a441412b79d75d75f708c51147533c5dddafaff0c065cf0ee626946aa90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286142, "uuid": "149c99dd-eee0-4d0a-a641-4852e13fd27c", "comment": "Malware payload (RemusStealer)", "value": "cc603f65829dc0b2b5bdb31cea2f639f15adbe49", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286142, "uuid": "98484247-fd01-4a04-b72a-221045c4ecf7", "comment": "Malware payload (RemusStealer)", "value": "237b5c93e25557820b9fa8a943df8cc4f1f7f7424fe55ad42fe29b43c1c8cf4bc398a64ea36ab0548684b7b5bf195aa9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286142, "uuid": "bf3b7aa9-dc36-4f1e-a013-8dee8dd37f97", "value": "T1B9462201F1EADE39C4A18771105FBEB1AF185CBB5A7694CF260F7984837E7875423AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286142, "uuid": "6bb2634c-8b55-401e-afd0-25014752d831", "value": "98304:5/elenLBFGlMSFt6cLvoAaVgdek9ABA4q2g4kYauF0mqn6MSvvO965J:telenLBFUF5LRaVlVjPkYHGmaSv29sJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784286142, "uuid": "a74cc5bf-5737-4231-97b3-324aab78860c", "value": 5669888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784286142, "uuid": "38a0f6d4-9f94-4ddf-9f84-3650c291fff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286142, "uuid": "b19b6e15-ca2c-4931-b2bb-1cf01600729e", "value": "Kanzas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8e6a55-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278653, "uuid": "7faa19bf-03a9-4172-8968-7460aec6435a", "comment": "Malware payload (SilentNet)", "value": "3db2efa54d2712fbdfa2232e6de8f01f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278653, "uuid": "855676ce-e09c-48ef-800a-50ac660676a7", "comment": "Malware payload (SilentNet)", "value": "92537d0207b223f7743a734b2ffadd794a54238be605a8b48e0b1c18b0f81781", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278653, "uuid": "c1edcbe6-79ef-4c7d-bebd-37a43bbc1368", "comment": "Malware payload (SilentNet)", "value": "bc6062a19172856a86be704dcbbae117ac20b5c7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278653, "uuid": "eae1c803-9ed9-44fc-88a6-ff8832076a50", "comment": "Malware payload (SilentNet)", "value": "c0d719babf89ea4c46d0ad3dab3a7522bd3a6c90ec12e6cafdfe5f787fae3bf14626e08c9139b32b7c0e94b0f0946b90", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278653, "uuid": "e58e2aa0-8a27-4c9d-879f-aa0f49f90b6f", "value": "T1D545330818DDC4988D8288F6E2DD582087DEBA5F820757E468336DD176C99C7B9BFCE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278653, "uuid": "4490b068-a230-4449-9456-acff28af872f", "value": "24576:2wg3T7pqW6yjFzCvSfBNWPPb5wNIsQmXNEBSU75Z0M130KT0iq:ziT7pqG1CMWb5w+uEUUPSKwiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278653, "uuid": "8ac290fd-12a1-4c11-8f6f-475e0f8cf594", "value": 1205898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278653, "uuid": "6dd9b362-8d6d-44fa-b35d-c0afc4b6cc6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278653, "uuid": "a72e5ca8-c97b-454d-ac30-6d1bcbca5ffb", "value": "camomods1.21.1 - Copy (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151f0879-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312383, "uuid": "55d695ad-c490-46b0-bb26-fa94fd486518", "comment": "Malware payload (Mirai)", "value": "a4d24832533a0be72255da13646a2046", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312383, "uuid": "64f199b0-272b-40c5-8443-6d7c1e70e720", "comment": "Malware payload (Mirai)", "value": "92daba84333e1fbf9fb95735d90c4a42c1473aac820821d4c25f270561aaf869", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312383, "uuid": "a12a7889-95d9-4467-8697-b4654d05b638", "comment": "Malware payload (Mirai)", "value": "cc30887783e1db74053d30e37717f172f6b6a7ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312383, "uuid": "7eae8f5f-3f59-41a8-a167-17d818e3e680", "comment": "Malware payload (Mirai)", "value": "b72bbc71d170d9c8d91ddfe335edc2d283a60bc8e4209448effba0e00855d9173723700fb586db7581e360af38fc6fb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312383, "uuid": "cd02592e-52d8-4424-9ac3-9129e1ecebfc", "value": "T13E93180377080F07D06329F426BB5BF187AABD6119F5B284751AFEC99271EF26046F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312383, "uuid": "f0ab9c85-1c81-4419-8c42-90a357bae31c", "value": "1536:iLDGQo6k3raYiSrxsoP/W93z5zfntTwfq2AUNqz4tNnrLmvdhxe9:iH+2YvKW25nSNqzMr+S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312383, "uuid": "f350f7df-debf-4880-a85a-909e401bee17", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312383, "uuid": "0a2b2a4c-1e0a-41bb-abdb-b719d17d1693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312383, "uuid": "5d412b62-28c0-4762-b21c-64d1fd8d2290", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bc6c2b-81d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (StealeriumStealer)", "timestamp": 1784290399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290399, "uuid": "7c7bcf5c-395d-483b-b18f-e9f864f41e94", "comment": "Malware payload (StealeriumStealer)", "value": "5123d3cc830d4acd49dafb1ba472a90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290399, "uuid": "25670963-e6fd-47df-a887-f6308d113d3e", "comment": "Malware payload (StealeriumStealer)", "value": "93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290399, "uuid": "4c536073-d1e1-4c60-b5f2-33cfe0016441", "comment": "Malware payload (StealeriumStealer)", "value": "4bc13337342c06f7b156904544be65bc74e5a0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290399, "uuid": "0ff6fd29-4f71-4061-9823-1614b861f88a", "comment": "Malware payload (StealeriumStealer)", "value": "653bb6374adda6f29b06fcc1a81fc42c70bd537b1df808d2aef6f9d83634f83fc545f798a955d682df05d99d2922782e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290399, "uuid": "ca265099-35d3-400e-b14e-b96e5daa24ab", "value": "T1EE76334463FC0659F1BF6B78E87162119E32B613D43AE78D198C119C0A72B82EDA1F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290399, "uuid": "7014bdd3-ec9d-4200-9894-f2a06eb31bcb", "value": "196608:rr9uV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:1A403qakSoR7tfI7ZtXADu8X9Y95GQLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290399, "uuid": "8d8371f1-8ae8-4036-8e1f-6ae8cd5d8a79", "value": 7371776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290399, "uuid": "578b22c8-87f3-467f-844f-86d92e198392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290399, "uuid": "2552546e-f33e-40d4-93ef-3dc715b28ac3", "value": "matchacracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62ce1df-8228-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1784324706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324706, "uuid": "c625c36a-8355-42d2-b32c-22c991c950d7", "comment": "Malware payload (AsyncRAT)", "value": "81961b2997cdf859ab8b96c3dd0afb07", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324706, "uuid": "0832b025-3371-405f-97ac-2b63472dcbc9", "comment": "Malware payload (AsyncRAT)", "value": "938a9136aa1f128c6462899bac6ab7a6a7cfd3a1bcc79fb38bfb207032d8515b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324706, "uuid": "144842b7-98fb-4071-8431-e2fb04d1e051", "comment": "Malware payload (AsyncRAT)", "value": "d9572b10599730d1c7b68f510258037f70c0cd36", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324706, "uuid": "0ebda47e-e008-4a47-849f-d6f6bf2c11d0", "comment": "Malware payload (AsyncRAT)", "value": "7a23bbad75f3706a69dbd0cbe4e72765ff469a842a38f2eeaaa648641b7974fe1b97a6d67940f0b7d5a7548b9678e7fd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324706, "uuid": "bb58e271-ce4a-48e3-b2ed-c15de67b9741", "value": "T196F412485647E103C915273A4EA2F27C16B9AFE87803D227A7DD7EAFB973B158D40183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324706, "uuid": "62d72df8-509e-499e-a3a6-bce4b57375a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324706, "uuid": "9b9547cb-0af6-41dc-8344-c47df7dd4d64", "value": "12288:vbXlJdb3Xj4hUmmIW0IoFlaG9+7dQrIuPUjY61OaXoaYZdoF094dxODtJNV9Yj8Z:jX6XmT0I8laG9KiIuMj/1RbYZWF0ydxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784324706, "uuid": "b99011fe-7d5a-41a6-9076-d3fa40c95946", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784324706, "uuid": "93f903ab-e5de-489e-a4d4-6f29be946ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324706, "uuid": "fe89439d-3c2d-4f2e-b46d-1013306a149c", "value": "81961B2997CDF859AB8B96C3DD0AFB07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd75db2-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284129, "uuid": "ff25ac8b-d238-4b7c-9381-f49752b1bcf3", "comment": "Malware payload (Gafgyt)", "value": "48b6ccb434f583bbbc4e3342d51155b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284129, "uuid": "9ec5b757-548b-49d1-a3e9-ef206d2fff19", "comment": "Malware payload (Gafgyt)", "value": "93a2c46adb598b51997c8866f4093a66922a1f7e2bfb89b7bc3c8f4eca4a8e77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284129, "uuid": "ba73b077-d51b-4524-ba4b-5f53769f6a02", "comment": "Malware payload (Gafgyt)", "value": "07f66ee540621d5287aef441c580040b9434c1b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284129, "uuid": "0b89c6a4-053f-4d66-a108-8ba6b227811b", "comment": "Malware payload (Gafgyt)", "value": "5a52f148bf0796e91e3dd8c4c51831886060d7dc905d713c852bb245a2fca2b260769a55ed68f620d957e5a2f5f3e180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284129, "uuid": "3f83b585-9129-4c48-b6e4-36d1674fd6e3", "value": "T1A8833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284129, "uuid": "a2e97b4d-e39a-4a45-b57a-6173488b7ca9", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LdWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yp2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284129, "uuid": "df8fae40-0a5f-4ce5-b804-57a7122bce2e", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284129, "uuid": "cb430d41-2793-4637-9647-986029ac99d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284129, "uuid": "3f2a38e7-c935-4fdb-8b63-1cce0cb47570", "value": "i686.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89de82cb-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784329758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329758, "uuid": "303040e5-b5ad-4bb4-8936-10ab7a2a84f9", "comment": "Malware payload", "value": "76fb40944c1ab98f5cfcaf0d3517cfae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329758, "uuid": "01eac482-ca99-41fe-b49b-0c6d9d5ba741", "comment": "Malware payload", "value": "93a9c2cbd2840685150eb1e794fad854df870b2a444c6049b6836340cad95d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329758, "uuid": "4c844852-79ce-4257-8bca-f0236458a210", "comment": "Malware payload", "value": "23c98f0811ee210e59191f358dd4ee6e9cfda635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329758, "uuid": "cad98ede-0d56-4d95-a750-dfb096bbec08", "comment": "Malware payload", "value": "c31bd29cc30734e7e67604a6a4ffa0c52a677ea4fc2989948c3df7824072d589a343df39e29653835318907c58162056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329758, "uuid": "4979fe15-fee9-43d2-bba7-33522eed44f3", "value": "T13E23FB127A61EFFBD45AD2304BF38A2016E476A51EA1534EF25CEB5C0F216CC2C5B7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329758, "uuid": "f65b63cf-5dfd-45c3-9def-8be14beec85b", "value": "768:Zam4xZV0K2XLyyL/ee5y3r8IYW7hV/awLHv9Qhvp1+sG:ZamCZV0Jee5lGRv9Qhvp1+sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329758, "uuid": "a38f0971-c55e-4409-b740-36aa65022344", "value": 46621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329758, "uuid": "624b7a1c-0a20-4156-87c3-62a278c060c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329758, "uuid": "789f4a47-e1b0-4bb9-a551-0960c08337db", "value": "shell", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25dacc4-8181-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784253054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253054, "uuid": "a7682f3b-1cfe-4603-8dbf-a77a2fd1c797", "comment": "Malware payload (Mirai)", "value": "56da8a8b5981071db11ba15f633cdc3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253054, "uuid": "1657fbda-681f-46b5-ab31-f9f3ec2bc086", "comment": "Malware payload (Mirai)", "value": "94a7cc706c15d397c1269f95c40b34d0ad7b9d4a90289bc1a133fc77323a3e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253054, "uuid": "9f9ca16c-54d4-4efc-982a-056d07b55774", "comment": "Malware payload (Mirai)", "value": "3be7631d7e8dcae60dbaf3e43ca73e4c9d07646d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784253054, "uuid": "ad39c228-91e7-4370-a602-aa2dcc3da008", "comment": "Malware payload (Mirai)", "value": "fa29ef425121675927a3b3302ebed8817745e5abd8b17a689adca03bdd0cbecb0f3cf11b5d812cadd56c05c4367aa60b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253054, "uuid": "00b40334-8826-4407-b23b-4275b8061a44", "value": "T12123F142659E24B1DEF8133C7EADE98F621A0BE082C5731B17292BB8779871D1B77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253054, "uuid": "84726594-4a0d-4680-a6be-f80234b5602e", "value": "768:2a4qwsMicR0iSKWLgPZEmWI/rMSUqJQb6PldfHny0HKAUGqXL7/ldQ6Gs3Uoz8:2qGR0/ELJUG0KXX5ML7/zXrz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784253054, "uuid": "8fd1e41b-be20-463a-b8ab-b9ec55d40e73", "value": 49264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784253054, "uuid": "4891f433-502d-480e-a462-f7e3d7817515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784253054, "uuid": "a9880d81-ef6b-4d98-bc87-110e812dad54", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2156a81-8207-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784310472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310472, "uuid": "3c801851-06b1-404a-8977-75d3950b9035", "comment": "Malware payload (Mirai)", "value": "79cd84b258b58d854c733d035c195796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310472, "uuid": "6534e3b9-d8d7-45dc-9815-c93884be5512", "comment": "Malware payload (Mirai)", "value": "9561069bdad96d84b76cfb2ec48ce3dcac0b48222967abd04aa4bd3989ae39cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310472, "uuid": "cc6420b6-108b-4a37-9a60-a24fc874cb41", "comment": "Malware payload (Mirai)", "value": "c95b0e1fca61b68c0b11b3b6b09936a518cb95fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310472, "uuid": "27960eb5-4d40-4f14-b2bb-de895d585ba4", "comment": "Malware payload (Mirai)", "value": "a456c97d3f5a917945f9a076a1a925ec1aa5d2611829728cc879e733ad03e49eaa5e313e8c4bcc948e51926b8e901157", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310472, "uuid": "dd29234c-588f-4c7b-9968-c616c84b4a13", "value": "T147B37DC5EA43D8F1E9521AB0043B736B9A72D5365139EF86D7A52D32EC13F009A0BB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310472, "uuid": "6a0ca297-f66b-4447-8513-f3de356caae1", "value": "3072:urCVq/YjRGkwoyyJUiIkuYJQRuIWe19maNHCT:urb/YjRGdoy0cYJorzNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310472, "uuid": "580b8c93-a075-46b8-965d-e1c1bcf48790", "value": 107664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310472, "uuid": "cfb8f25f-2028-43ea-9f81-2a86b2f49e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310472, "uuid": "2b9dcc46-9575-4086-aa0c-210e4996a9c9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcda62d-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784271998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271998, "uuid": "fd51692b-fbd6-40be-acee-5ff1d49b3cd9", "comment": "Malware payload", "value": "767246385bca2e2a70bfdecad406e718", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271998, "uuid": "f0c98e88-1b53-4ea2-ab8b-48051f63430c", "comment": "Malware payload", "value": "96e584b581f775cbe8aa8e388bd141564b6835ffeb93408a7a308c424996601d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271998, "uuid": "16bfea6c-6a06-4dfb-99c1-810cc79962de", "comment": "Malware payload", "value": "df36fd471eae0a6a9c93f162e2290edd979eff60", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271998, "uuid": "1f5b8b90-f9ef-4769-9169-58695be6a98f", "comment": "Malware payload", "value": "110cf321c52f70866b6ec81b28b2b5f65002f1c16bc4b2c2b10dd594f9a96fde7a3d2c256db11b6d12158697e4ffa04c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271998, "uuid": "d68ee45a-63d7-4daf-a852-796052c919e3", "value": "T187C28D956A967C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271998, "uuid": "e4dd9e81-129b-435e-8ef3-c30c222f828c", "value": "768:58vCB+25j6es8RK9FYpMSUpi+20qUpi+20YQX:58l25J8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271998, "uuid": "1fe9ab08-be39-4294-888f-504165d867aa", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271998, "uuid": "c832229e-e064-4d03-9e00-ae83ef3b0786", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271998, "uuid": "15705152-266e-4062-af67-d364e1a74f97", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cbb085-81b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784273962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273962, "uuid": "265ed34e-2a01-49c7-83f3-df7685f79790", "comment": "Malware payload", "value": "9694294addbe58be93ddbb6cabc499ce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273962, "uuid": "c431060c-a3b8-45db-88be-d79cc2cd36ca", "comment": "Malware payload", "value": "974974cb3771f3511b28056d6170d30536eefe022304eeaac4e47d4b598f76b0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273962, "uuid": "0f0ccba9-f7da-439e-aa7a-79745525be09", "comment": "Malware payload", "value": "775bf9e9fcacc39125e5584312e1728b6d80d468", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273962, "uuid": "1d1da525-7015-43eb-9067-0752a2c81f2e", "comment": "Malware payload", "value": "379b1da5d6340b5cfc07900663a931acea8b02ae3c276549211ee706ced5f27ff13d23f7e90de09bd2854dc76748d9e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273962, "uuid": "90a9a6a1-9203-4cec-9359-5719f594f925", "value": "T16827220AEFC4BA3AC9F75232197B59194C474C414787D983DD59382C2CBB6E1AB1EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273962, "uuid": "53e7ffa7-a089-46de-aea7-2f988a4ee9e3", "value": "393216:a/WEjaEYEdI3GjGOB1/zoFW1775wKoisdp/9bp3Gdw:a9aWjGO7/MFiuT39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273962, "uuid": "47e34eea-4951-4297-8ae1-62aea9135be9", "value": 20763767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273962, "uuid": "9f6a9147-866f-421d-9092-006584fc9b9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273962, "uuid": "483f03dd-3a4e-4899-8da9-0597ca9d685a", "value": "Alert - Bahrain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50920e2c-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284136, "uuid": "f70c622d-e32e-4ead-a8b6-771fd33af475", "comment": "Malware payload (Gafgyt)", "value": "eb77f75efb5452bbc1e07ccd573c6673", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284136, "uuid": "4a266eb3-2aef-44a8-bb05-01cce2e5918a", "comment": "Malware payload (Gafgyt)", "value": "97c32ae8020f03640cba5290b28348be87d26f3d444b6d2817a22bd0d9ea3be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284136, "uuid": "51e01779-6212-4a12-b4f7-c65f892ca09f", "comment": "Malware payload (Gafgyt)", "value": "dc0ac63b5a8fac26da6f5a8622819357f39e1274", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284136, "uuid": "a5273f33-412d-4849-a6d6-ad80ec826796", "comment": "Malware payload (Gafgyt)", "value": "21e92a6c279bafe6a3d8849d4808c5beefb89b3cc50d059e40dfb76453d175a8404feca98bd6d78704838d3f6cc08e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284136, "uuid": "f6329a96-97e4-4132-bc33-87a326520dc5", "value": "T1EFA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284136, "uuid": "eb81455c-2987-4c46-bb44-0ad6bcd27603", "value": "3072:VSx+i6mqaObhNanPNKV+qKmZuqQ4DPwXXtse:y6mRObnanP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284136, "uuid": "edc6b30c-3fab-46c3-b8f0-23d4e2cee581", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284136, "uuid": "ad4b08a2-cdce-4067-b1b0-99005de075eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284136, "uuid": "88511358-86b0-4ee8-a027-96587f6fd1fc", "value": "arm5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900fb970-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315595, "uuid": "9d78c2b9-c21c-409e-8d4e-1a1a8716f166", "comment": "Malware payload (Mirai)", "value": "9ded2e39c2e62c39b5f9104e32a741e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315595, "uuid": "b35e6eea-5c15-439a-94d7-5352371a6419", "comment": "Malware payload (Mirai)", "value": "983901c109450f067920eb692a8c86a2f06e238d3ec41cf8b80568dee663464b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315595, "uuid": "68d297ab-e15b-4503-b22d-f88b69095f80", "comment": "Malware payload (Mirai)", "value": "fea413fcc29fa2103d96bfd9733c8dce672e8c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315595, "uuid": "b123370e-4cb8-4d11-b0b5-ffa068c675ba", "comment": "Malware payload (Mirai)", "value": "f73784b005099d958d43b0e2db17e3843b23be3f937e3cfd6d2284981023136a09eb8b64e65a8036f659a07ab2826fe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315595, "uuid": "b9e6a523-3f5f-472b-94f9-bdd4c1dc3169", "value": "T12E3301F099CE9B72CBBF0035803E97CD6A765A7D9A1A2F31E0195308F7706CA4D69258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315595, "uuid": "7f8ece5d-ac83-499e-a6ab-9e9b34a8d635", "value": "1536:uK0yJ7rWjxB/x1dgOPXmFYxKghH/ObUExA9uqXDfe:3WmOvwYxKghfvE+uqXD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315595, "uuid": "c5cccd88-d0bc-4407-899a-5bb941732187", "value": 55044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315595, "uuid": "47fc35a0-1c2b-4add-86e6-b39d90649962", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315595, "uuid": "f96211ef-f7d5-4d86-b7e4-3653c1ccbcc7", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112926eb-81ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784271144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271144, "uuid": "c0865ff2-47be-4dc6-bd75-d3cc5d866582", "comment": "Malware payload (ValleyRAT)", "value": "6283a64da1105a3871f09ccfed38982d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271144, "uuid": "b3e1c557-e7bd-429f-bea2-fc86ddd3d823", "comment": "Malware payload (ValleyRAT)", "value": "98b9fa50195ad5cde30b07452f04850c2b9021567af4b1484cf09a195b1b2691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271144, "uuid": "989c6bce-b9a5-411a-bd68-1950dd3ea5b9", "comment": "Malware payload (ValleyRAT)", "value": "373ac0e1a048bd934f67ae137453d6d627167a48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271144, "uuid": "fd9fb78c-168b-4c79-bc7b-ac3749907cb5", "comment": "Malware payload (ValleyRAT)", "value": "e9b4b4cd49361685ea70cbc18360f4a09cec0df9e17f0c74025f8570d62d17d773a50ba62f7632909a84c7e66592edd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271144, "uuid": "910536e6-e93d-47dc-b4bf-ff827efc7ed9", "value": "T16B74F1075EF4380DDD130F7A98C99D6DE52AFA042AA2717E0B5FBE03462E4D099FA071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271144, "uuid": "ef375e3d-ee0a-4663-9f4a-bb2a525dac7d", "value": "c89ff7990aba457ebaaf89ec77c1a99b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271144, "uuid": "d5582dc0-0668-4e2f-bf74-626dac003899", "value": "6144:tV0w3IOfqFS2mLNkMhGAu0PaNA65X5K/AwgdOn7bbfZ3dbQXHTi/laF:HIzA6MwA0Ac5I7qi73BAHtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271144, "uuid": "bf3e5f53-d962-41ae-b3ee-787dc184251f", "value": 355400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271144, "uuid": "5f07d961-195d-4496-8c3b-d9bb225b9505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271144, "uuid": "e6854d8d-2a49-4fcc-9076-ade8384747c8", "value": "sptsi_yo4o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98d2bab-81dc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784292016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292016, "uuid": "17a07647-c276-4336-a437-73d235d4de3c", "comment": "Malware payload", "value": "5640f4c02653e22dbfd410bbb7358a65", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292016, "uuid": "db4ac01b-d160-4f96-b505-4f6b72a432ae", "comment": "Malware payload", "value": "9900ad502f9d668157c3abdf5bb69035c7360a180d0df848b2987f2028cb1266", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292016, "uuid": "6a5e6b05-6808-46ea-9e94-da6f60a1570d", "comment": "Malware payload", "value": "0af184c7f2fa953b426fad14c45ff9623787a756", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292016, "uuid": "6fc8d36c-9bf2-426c-82ae-0e5eacff0b00", "comment": "Malware payload", "value": "08b07961d3d3fa12a1279c2a7ac525146b21c44d2ecd59e79d4671c8f54b823c49ac0997788acb513abd95a4f7d0a35a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292016, "uuid": "8006bee9-0648-4090-946e-f2403b857e7b", "value": "T1E5236D6126857C14AA99C8371D7E2F0CB9AD43E6320452EE7FCB3CF68C4A69DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292016, "uuid": "50616421-d3a7-4528-a69c-ad9aad3d5043", "value": "768:j6rDTPjH19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:mr3icr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784292016, "uuid": "8203ff63-48ab-451d-8c09-7d09b185b3fc", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784292016, "uuid": "f0cdefab-3494-4c58-b4e4-87d675e7da46", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292016, "uuid": "47653698-6b28-481c-b21d-d17df1fbd33d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13087b59-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312379, "uuid": "67c27a57-4161-4ea1-af9c-e36e0ecb9e66", "comment": "Malware payload (Mirai)", "value": "c182571dfbbe8209273002fbfd221e79", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312379, "uuid": "df787c91-3f61-481a-8e3b-f54e5133ab58", "comment": "Malware payload (Mirai)", "value": "991f6340c0f664e8ede2a0e8e05dff6c23874afe1b853fe50ce7fab4af6ee291", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312379, "uuid": "daba132a-1d6d-4b41-aa25-41f51eba01ad", "comment": "Malware payload (Mirai)", "value": "4a154630c37dcd940cd7c033b4028feeb9017b0f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312379, "uuid": "17c76f71-e237-453f-aed8-9dcf718fa88f", "comment": "Malware payload (Mirai)", "value": "bfc58bf9230bd5a3ef39527fc2d82c2d7b084cfb7a8d1fcba3190ab7bb402e0a2993157608c3d1ee28649ef4b69e70c6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312379, "uuid": "6ac12226-f4bf-4f63-a24b-6b3b7c5b8702", "value": "T146C3B91E6E11CFBEF65A827407F78E31965877D62AF1C685E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312379, "uuid": "2f1363ba-5f45-47c7-8fbb-2a828a58a01c", "value": "1536:tw4lPfv7d7Y/YLYdAo1OhNWHv7t9i2BPDoM1ISWlKvKevNeTheR:7lPfDdMLdAoKoHv7tLBPDoMCsvSheR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312379, "uuid": "07d81392-f565-4122-ab48-2e5bab0ab0cb", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312379, "uuid": "cb269644-9f1c-420e-afc2-7dbdc5da3e11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312379, "uuid": "4f216023-f039-4821-a2d3-9060e94db204", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0be6c8d-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315623, "uuid": "60647a06-613e-4136-8bdc-10a43bfd967b", "comment": "Malware payload (Mirai)", "value": "782ff68ef065d4b9fd0962ad74ce0e44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315623, "uuid": "5c7d84a7-121e-4b11-9c59-1e82c583a2a7", "comment": "Malware payload (Mirai)", "value": "99faef6cbdbd3886e782337196f77eaa0a5dd65d5b916e339f3dfe72df5574d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315623, "uuid": "3660f54c-24c6-4625-b371-48781ce0df3f", "comment": "Malware payload (Mirai)", "value": "50be1590f2247ea6dfc0e84607b801ea9e323986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315623, "uuid": "f250d8ae-19b4-4d05-9548-e3527408b194", "comment": "Malware payload (Mirai)", "value": "2888bb28abaa6122f4c2590102602f92ede716bff8787b548ecb22c37f0bbfc4a44e96d4054eaeacb91ba8cdd2a2947e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315623, "uuid": "36c1af94-5538-41a6-bf59-2a5e515c0859", "value": "T193C33AA9F880DE52C6D126BAF75E518C33231778C3DE7106CE149E3467EBD5A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315623, "uuid": "da6b6f8c-38ac-41b7-b81c-e76f5b91ef4e", "value": "3072:ub/jjtOjapNT96thy/Koh6WbgcYEEUQs7pEx2dzZ5aFP7gUknD+Af1Dl:ubroAoV8gcYEEUQs7pC217aFVSSA95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315623, "uuid": "7507fa94-c4ad-4a5e-8337-279da21a736c", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315623, "uuid": "598ea8ca-6ccd-4bb2-bfd5-95dc8a515199", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315623, "uuid": "0d8666ff-4917-4e1a-8644-fb467bb854c3", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6301dca-81a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784267529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267529, "uuid": "2af16f85-de09-48e8-8302-0eaf9d54c7e4", "comment": "Malware payload (Efimer)", "value": "72fb58810c5e9e98ab26d3996421977e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267529, "uuid": "668adc9a-c7a8-46d4-a288-02d830762389", "comment": "Malware payload (Efimer)", "value": "9a9c54408a1d2373aeefac87017e1532764ae54f95774acabcdba60aa6af01e0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267529, "uuid": "d2b7647e-0435-447d-8244-ce8408ea509d", "comment": "Malware payload (Efimer)", "value": "8b95508fcc1be3814a549d13714d064cd777dc7a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267529, "uuid": "75866230-e7f5-43a2-85ac-2bcd08ba29fd", "comment": "Malware payload (Efimer)", "value": "810865c40d35d53027faaac5f170d235275db82e80eb808b11626dae0cc64ed2522448170e1b2c905683d562f493a75b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267529, "uuid": "734f32f1-84e9-4b20-bd65-a0d980949dc0", "value": "T113E6331413D014EEFAA2913CE9F299A1F1B474B12735C65703E88A763E7B1D14D3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267529, "uuid": "3dd4e157-76b8-4c35-98bd-aec5e878b4c7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267529, "uuid": "ef49b8f4-24ad-455a-8ad2-c8c2840ecd8f", "value": "393216:7zBwMIIDgptcp1u9+SOo4GVTXMCHWUjXlcuI3/PGTAI:7NwjYgptcDqTXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267529, "uuid": "f0eab655-5b44-4958-ac3e-8f98c0c380b3", "value": 14312178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267529, "uuid": "9baf3f8c-db5d-4c2d-a588-11a058491418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267529, "uuid": "2ed651b2-acb0-4c4b-a39a-842722e8bc3e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f58f35-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325133, "uuid": "3a7ac175-cd67-4bb7-a022-027040e0c074", "comment": "Malware payload (Mirai)", "value": "3dd2825a3e256cac25f1fdcdcc7c1bf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325133, "uuid": "b7009598-2492-4736-81e3-942b53f58614", "comment": "Malware payload (Mirai)", "value": "9ac04b703bd01c1728793cb0fe45c8bc1704e4aed2d855cf866e489b5f32dcd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325133, "uuid": "68b6e253-a0f8-4feb-b357-37e8c4363718", "comment": "Malware payload (Mirai)", "value": "f21131a6c6d6b4ea4894c5a8971b431f33090853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325133, "uuid": "bd066f17-04fd-46f8-b134-e20e893d410f", "comment": "Malware payload (Mirai)", "value": "f113195761cf083f694ce7c8122058a7f30c26984b98a2195951584370c2f9d74811d0e7170c434521bf02980feb698e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325133, "uuid": "9b0ead2b-bfb3-4556-a5d0-e29c2fd8e3e9", "value": "T1E343F1527D69B9F0C27014B2F5D84C0A7540927BA23FE43B3EA95F3E88D161B5FA9280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325133, "uuid": "9e609b64-8050-4471-a01e-b1c2466a2004", "value": "1536:FAcYVnKZf+SQgBhuTUnw34I2ZvMLrVvStbTb9sGV:FWnKZfggm3S6LJvStbPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325133, "uuid": "b67b160b-91ba-4257-997a-80a6f1c11878", "value": 60172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325133, "uuid": "b4668a8f-143a-44f9-a1a5-72390723adda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325133, "uuid": "8c4d269f-8f0d-4b06-984f-3623b1709e9d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8783c225-81df-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784293247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293247, "uuid": "6b5dc5c9-1ed4-430c-baeb-cf31bfa163c6", "comment": "Malware payload (Prometei)", "value": "64d32a3ce176e5e90d6d107589158690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293247, "uuid": "8457f9a3-2dd8-4319-b943-3f190772661b", "comment": "Malware payload (Prometei)", "value": "9b181d40ede413858c14dfc8524dbc45315a5836129822922327f706bb07038b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293247, "uuid": "e5b6829d-c29e-4855-8a1f-7f89c5ace18d", "comment": "Malware payload (Prometei)", "value": "3d12134f8e92d83c68e55ae3f3afbe1e67c50a74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293247, "uuid": "adee4324-465f-483a-9107-85f260e74554", "comment": "Malware payload (Prometei)", "value": "84db257b9e371ea2d8f18f222e912ec2e5a8ab5bbbbed1517494e4748c0340f892f190622792e65639b3b85e1b936d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293247, "uuid": "893e5a33-cc01-4200-aca8-dec4150bef05", "value": "T15747DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293247, "uuid": "8b0d3f73-d752-4af9-a4ca-3a2091872f06", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQY:cqYUQuVDt0TZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784293247, "uuid": "53b8bf01-0489-43c1-808b-858c72e6ecca", "value": 25100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784293247, "uuid": "834043cd-1865-4e3c-819f-e3ec67b11691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293247, "uuid": "a7403643-84de-4de4-bfe5-e60668090659", "value": "9b181d40ede413858c14dfc8524dbc45315a5836129822922327f706bb07038b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dc1b72-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312384, "uuid": "a610ce91-713b-456e-8de8-367408355083", "comment": "Malware payload (Mirai)", "value": "d539235814a0dea47ef7b71c71dd4ce0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312384, "uuid": "f4cebc43-31be-460d-9e75-1885ab0a6b9e", "comment": "Malware payload (Mirai)", "value": "9cbc5d019003c879bded186d316d3b5866bdb5dd618e2ec5b632775cf8e5f953", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312384, "uuid": "128d8972-dd3b-4ffb-bac6-722b66c97aec", "comment": "Malware payload (Mirai)", "value": "4548582561b3c1f6852930fcdaeae6e3ca11d773", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312384, "uuid": "3159ecd6-335f-431d-a823-12d01b25d9cb", "comment": "Malware payload (Mirai)", "value": "5487601008b041e6e9495b7b812cb53f79051ff2cf1ad0ef72336e2dcee629d2f79daf36818238020109393ceff5f58f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312384, "uuid": "b6c44db0-e9d8-4cd8-b20a-3cdb5476cf4e", "value": "T1C5733923EA16AF46D14761F0A9F64E740B13FC2A8D671EFAA564EDE881439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312384, "uuid": "4682e353-ecde-4141-b3dc-00b7117b1b62", "value": "1536:upwtq/0FORx0SFXSRAJjnixAXNMkDKc2Hf7cuGgkKCqWUbdg2f:upv0QRxJsq/XSkmcaTGgkKswCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312384, "uuid": "fdd6130b-7589-4c31-8dae-293acd0ab5f6", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312384, "uuid": "ebfdb75f-150d-487f-82ec-0805a6288eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312384, "uuid": "4a81c17f-b12b-4dab-9824-6a0252da19a7", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf6c3f8-8224-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784322917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322917, "uuid": "bc193b52-8908-4570-acb1-d2dbec6363a6", "comment": "Malware payload (Mirai)", "value": "c777bb7c63e5056b89809a2923766c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322917, "uuid": "5964ed58-fa43-49a4-a6a7-3c5817da79c3", "comment": "Malware payload (Mirai)", "value": "9de551396fa12b1ffb76cdeff4b5c703fcf802550c8bd93f6d021dfdef1b2151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322917, "uuid": "cced4530-f1f4-402d-a70a-695e31319ca6", "comment": "Malware payload (Mirai)", "value": "7d64a60dfe36ad248c62dab0fa688d07927b1af8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784322917, "uuid": "c666f2c2-c1e0-4f3a-a89a-4c776e90c782", "comment": "Malware payload (Mirai)", "value": "288a3991e9bf91f0ddfa8f1477788ab0da35b0c1fe17af25cda61be7f1ce845f487de1c5c04dd0d0fb43055b3d25bed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322917, "uuid": "789c8e71-32bd-4055-bcfc-11a94903e8c8", "value": "T1B1E3075AF8819F11D4C626BAFE5E528D331327ACE3EE7112DD249F2532CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322917, "uuid": "2f8a72f8-3f53-4fce-8056-e8ee75c48661", "value": "3072:oa2UFC0tw9YNy24fod629fyTXfiGZZzQB29VfYaY4DuqI0g28E2hKnSiKEnb2:oalFC0tw2Ny24Ao5Xf5Zz7XfYaY4Duq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784322917, "uuid": "3bb58e31-6d7c-41d7-8e7d-2505ee0bb7ca", "value": 157204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784322917, "uuid": "a2332c28-6dcd-416e-a501-73afcce845de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784322917, "uuid": "bd3cefce-072a-474a-9907-416bc00b919c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1003c7-8179-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784249528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249528, "uuid": "67b68dae-2b70-443c-88df-2f84e977d16a", "comment": "Malware payload (Efimer)", "value": "ef71150d3850b8420428784c44ba6a66", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249528, "uuid": "087fabfe-360a-4b0d-bafa-722dcafdc21d", "comment": "Malware payload (Efimer)", "value": "9de680fe7c5e49f7e9192caf0f3432f8086e6de549c5737a9912a97cd69abac1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249528, "uuid": "d3cf9737-a29d-4dd1-9363-843b31dd6666", "comment": "Malware payload (Efimer)", "value": "48d9f2084c960a15755d560df105a3a312b6e9a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249528, "uuid": "61b2a8bd-c424-4da7-af5a-c0a5aada5b19", "comment": "Malware payload (Efimer)", "value": "5328b399d47eb0daf4a95f7fc78f2ce9f6799532b3bc4efd0e716e8ade0a2642fb9fd2819cc69088e38a0d2e7e2d4990", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249528, "uuid": "acd2ef6b-83b0-487a-9146-8a4e78244ad7", "value": "T1FEE63308A9E026FDE9B3017CACE25592D6A1F8769B77C9CF175847E0AD571A04C3E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249528, "uuid": "80b3f7e9-611c-4cfc-a8dc-0a4236943ad0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249528, "uuid": "a886e009-172a-4cb2-8c58-dcd75d7cfc48", "value": "393216:+ADa5ux8pmpzuQOBJlkSdkKXOMDXMCHWUjX0cuI3/PGTAI:+zMx8pozuRD7XRXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249528, "uuid": "e123f2a5-29b3-4bbf-8cbb-92e42439d970", "value": 14316800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249528, "uuid": "e61124e4-6646-48e6-8060-491bb438718b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249528, "uuid": "6086bda1-a431-4361-9cea-8a0d0f8a5363", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aecfdcd-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312365, "uuid": "4065c793-7697-472b-85a8-26ce8cb1fc44", "comment": "Malware payload (Mirai)", "value": "db10e3663a49551498d08e0d47e71aaa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312365, "uuid": "522d7c2f-e661-41b5-9dfd-c1411a0afacc", "comment": "Malware payload (Mirai)", "value": "9df642b7dfda8641fa3ea66ee98e7179865f3a080d64a2b72eaf5188570a5b46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312365, "uuid": "8f02d631-6166-474a-9e7c-ff70473e222d", "comment": "Malware payload (Mirai)", "value": "102631d7404960fb1f85f1477390a0d61349c746", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312365, "uuid": "bb843be6-2681-46b5-89fc-aabd7e452afb", "comment": "Malware payload (Mirai)", "value": "21d5dad12d6519d5cc560bc756f0e9a0a1d2b45a0e64439719d205218f487e660f211033e35d55b068b9f9f76d0b00d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312365, "uuid": "738ae861-f58d-4288-8d67-f1f5893e5288", "value": "T12715231AB18CAE14E87E0FB6CD5EB11BB769038715397F19EDD25901B3863AC07722C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312365, "uuid": "cb5d7f9a-2552-45a3-883c-3a847af95cd8", "value": "12288:G3OvmxrmQ5E+dfXNNMWcg5602ivkxuWpjUdKRwt2GqH/Z6NWVtJGbRL2+pFYSuxf:QcYEGVNsgFbWMKRX1TJGbouOxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312365, "uuid": "db0827f0-e421-43f9-92e3-79ffe40ab188", "value": 960009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312365, "uuid": "5cd5e200-5b32-479d-8a6e-ec64a445df26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312365, "uuid": "b358ddaa-8178-4c7b-8057-a61133f9171d", "value": "Services.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d7adcc-81a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268624, "uuid": "69b5c51d-e0cb-4e42-98fc-d2efa949aeea", "comment": "Malware payload (Mirai)", "value": "6d88fcf4982185dd44674dbd7866b8c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268624, "uuid": "27ddef92-f88c-4a0e-8b47-169a9674b852", "comment": "Malware payload (Mirai)", "value": "9e0906c0afddcf623c51db58880b8e0958cfd4ca532082e2030cccb89ef3b532", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268624, "uuid": "1e164934-80b8-4007-8918-1d92505832f4", "comment": "Malware payload (Mirai)", "value": "4487d896e98b3c0e89870227ad77279c3d97888a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268624, "uuid": "27505729-03db-42bf-a7bf-0ff66464157c", "comment": "Malware payload (Mirai)", "value": "7926863f17d6e88bc43266affa50b925d1f31149a35036fbb5aec2fd7703b9b12e312bdf90ac3d144552ab08d5737450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268624, "uuid": "f50b1bfa-6b73-48a3-8399-d0523c42d91d", "value": "T142D30816FB210EFBDC9BCD374AE91705258C651A22AE7F367934C928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268624, "uuid": "932b68fd-1061-411c-b882-9abf953af41a", "value": "3072:NXj17Jo82I/GFSiPep063GM51hERGjPrjz:NXFLOPX8rxERmfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268624, "uuid": "b0425cf4-7bb6-4398-9310-fa691dced1a9", "value": 141604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268624, "uuid": "4b4e3f38-f4a2-4b5a-9818-4af440b0b8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268624, "uuid": "b8d3315e-896e-402f-a8b8-5d6553b89687", "value": "nerv.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e759b92-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311271, "uuid": "418aa0b3-a1e5-4772-9c8b-cfeaf66a3fe2", "comment": "Malware payload (Mirai)", "value": "c6b1aa8ad67c5ff8dab3bb98aa059926", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311271, "uuid": "69ad8c11-21bc-49f4-ad58-228c40e1f783", "comment": "Malware payload (Mirai)", "value": "9f6dbee0e69f207e3c33fd767677130aacc5dadcbe21978ed1fb6f01eec22e9e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311271, "uuid": "8b290b54-89cb-401a-92ab-26ab0adfc77d", "comment": "Malware payload (Mirai)", "value": "42b2cf8880cb02e6a4d73f221cf9abcf59d7def0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311271, "uuid": "d5c4d75e-2714-4a05-ba96-81c9157045b4", "comment": "Malware payload (Mirai)", "value": "408aef91200adac3c05861119bdef7bf3694954f7958c892473f544870d7c07ff7fc4b313b57c600bfa6ecc5c6875ede", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311271, "uuid": "a1f568c8-3e13-4b0f-8ce8-47c3df3d854f", "value": "T11FB3C80E6E219F7CFBA8C3304BB74A25969833D637E1DA85D19CD6051E7034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311271, "uuid": "e63bd053-9786-4dcd-943a-eecf99962fc2", "value": "1536:SlipU+Ep+iuQXMGRdy9EdODETEZTFNyuMGd0HEGYeGATV4KT14UT+/:Yu4Pua89qOcEZTFNyuLaEG32KKUT+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311271, "uuid": "2e9c9c7f-d1fb-4633-88af-bd46e9739601", "value": 109964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311271, "uuid": "2ff48adf-6c5a-45ac-9fb8-5228ffa67ded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311271, "uuid": "4b336cd2-0115-486c-9b6c-33e040ddfc3a", "value": "byroom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd600ed-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250467, "uuid": "c574c39a-3968-46de-9916-a35d9afb60cd", "comment": "Malware payload (Mirai)", "value": "3ff2e67d41a53a94a50b7163d9c5875d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250467, "uuid": "1b1f9d80-dc74-47c9-a95d-9063304ec95c", "comment": "Malware payload (Mirai)", "value": "a12922f8f8906ee5ebc6f0612236307e24a2a53a5f26f34b23e2ddab998fc304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250467, "uuid": "35d8677a-ef50-4c91-9be9-e8193d50e7cd", "comment": "Malware payload (Mirai)", "value": "a37b62c043ca70f9c9b1d10c460917878c039dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250467, "uuid": "4bbf1158-7e7d-46a6-9b7e-f0a2d8216c7e", "comment": "Malware payload (Mirai)", "value": "17d7090c454dfb9de544a4309b1b7128241cf5ce5276689bf32faa47db80bf1a56a917745c072a7505325b6af6e5cc99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250467, "uuid": "9f1db5ce-96b3-4f12-8775-34a4882e6593", "value": "T1CFC32A06746158FDC15BC434C77FE937EA31B46D13243AAF2784AA712E22E751F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250467, "uuid": "b61a770f-d3d8-4664-9949-e5ef5e69f065", "value": "1536:bLvXvtUQsrSA4YaQ1piFKpGPZixR3PsBawxelU8Hht5RQC/6xp5U+zh5G44porzF:bL92rSA4V7mGxecERex7zh5G4FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250467, "uuid": "78b93c8f-f02a-4a36-9379-b68907048d2d", "value": 128888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250467, "uuid": "ed43cd9d-5ba2-4b6c-9bb3-61880c03c31a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250467, "uuid": "ae43f855-bf07-43ff-a6a3-003c0628fafa", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9393d4f-8176-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248260, "uuid": "c7641f08-ca0c-4472-9b6e-902bd00204d6", "comment": "Malware payload (Mirai)", "value": "5c33789241b8dfc6edfdacd1a650367b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248260, "uuid": "39d444fc-30aa-465f-b14a-4749e87ef649", "comment": "Malware payload (Mirai)", "value": "a1b7623d37a8540e38f18b56dffd692e84c1bcca672ed58bfec64921f7aa8e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248260, "uuid": "7281365f-f043-42be-809f-4e52ac69e28a", "comment": "Malware payload (Mirai)", "value": "c56185789153d1ffc11fc1d1f7ac82fa982ecc78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248260, "uuid": "98833b18-1a34-4488-a267-5d8f6779f78a", "comment": "Malware payload (Mirai)", "value": "a9406a6f158550dedd933e9d06b196a626b8b40bd102c6efce3d518495027a72607f40a5b29725bf1a7577c6c8b2a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248260, "uuid": "34dbf17e-ba89-4ac2-869f-37f354fd4f9c", "value": "T18FC339A9F890DE52C6D1267AF75E518C33231378C3DE7106CE249E3477EB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248260, "uuid": "820b1749-e879-447b-9a4d-4eaed9842639", "value": "3072:N2348J4ZU5Ng4EpPOoX9tUWcYEEUv57pMx2+jSOBFt7QUkZu+Af1Dl:N2oc6PuWcYEEUv57pK2GvBFzA5A95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248260, "uuid": "182fb5d8-9bf3-4934-83a0-6df2f3d24163", "value": 128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248260, "uuid": "f6380231-d224-44df-81d2-9f6318bfc1ba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248260, "uuid": "584a3f44-081d-45ce-a1f8-3276cf02c83e", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380ce3a2-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784291396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291396, "uuid": "d21a2f0b-3961-464e-84fb-7f801d8af3a3", "comment": "Malware payload", "value": "b3fffb46b2618e2551c5f52ae553f625", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291396, "uuid": "5a23bb23-d469-42f5-9f14-612957e57ac0", "comment": "Malware payload", "value": "a20782a81571519f30b77955d8991c916c8dda17710d0514f69da6d773281952", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291396, "uuid": "0dcd4e89-a782-4b24-a296-2b5526ce0f30", "comment": "Malware payload", "value": "759a05cfd3021a082972abea82f142b76ea26deb", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291396, "uuid": "afd4b1a4-af62-4613-948e-11c80de81d9d", "comment": "Malware payload", "value": "0e440c272ef07fa05b13eb5a6eb672fd3c6a27a0ff06adb563f6c14448c7eeafff95a487e9f5ce2944ca8915c328b40e", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291396, "uuid": "28610031-25a0-4145-b1e1-d0fec519b6fc", "value": "T1661733983AF50126CA735834A12D2838D59227FCCCC19D8EBD9E23DEF7E448D4597AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291396, "uuid": "945f59a5-56fc-4fea-bd94-3ea7d9d6fd6c", "value": "393216:6bMDzRR5F5MYAWX/PhQX09p1qf/DL+fHGIj0GwlSdqNnl:gMDuYpPeX4pJHGmESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291396, "uuid": "785ece0c-8029-44a1-be37-9f07be9b7444", "value": 19412992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291396, "uuid": "aefa790d-24ba-4c3e-a03b-4e052ddec53d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291396, "uuid": "237e4888-ba22-4557-8bdb-1c556bdf5976", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9244684d-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784329772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329772, "uuid": "65a509e4-2be3-4a82-a5d6-3d601f88d948", "comment": "Malware payload", "value": "ac6af3156b38400a15e7bcba1524bccd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329772, "uuid": "caf0b445-b78c-426a-b11d-dcd8299718e9", "comment": "Malware payload", "value": "a2dd8c859251c361c46d3670536e81d85acaa44ac938f3057bcecdf50b2ad5ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329772, "uuid": "3618080b-a14c-4d16-9cc8-41849c274d22", "comment": "Malware payload", "value": "89f9503020ff989369627a45d786c56a11d6a40b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329772, "uuid": "6cefc05d-49e9-4520-a8b9-20cbff1eafbe", "comment": "Malware payload", "value": "0b93b512d27e736ebfd8502a64cc5e4168eaa628c22b5107e787199329497af16380f740b0a9d02f75807cdb4c0f47ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329772, "uuid": "a93a003d-a000-49fd-95e3-72a82a39b372", "value": "T10E3101CD32B09251C649FF01F3E1CBD6AE45FDC866940E7AE4C11CB1486DE8D3865A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329772, "uuid": "51e0b5a5-75a1-45ea-a378-cec8541768ef", "value": "12:+kfc0dtnNaKl6KODOmLxf/TK1Sk1YgVbVVb1LBCN0UN0KvtuFe77bLBNCSwlLPTX:TfxHFmDzLxKUkb3A2U2Mtrbr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329772, "uuid": "15f1c1b8-365a-4b9a-b8ce-089cb34735f1", "value": 1834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329772, "uuid": "f5baea2c-ac88-48ab-b1af-dcc06840fc0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329772, "uuid": "cd0f6ebf-ed2b-44fc-b2e4-86c42ed77022", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2838ae-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271995, "uuid": "0d52476e-eac7-4314-9213-6bd115498e82", "comment": "Malware payload (Mirai)", "value": "7234b93fb73845ad11b85e16da85aa6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271995, "uuid": "69c5e5e0-5db8-4acf-979e-d4ae599e306e", "comment": "Malware payload (Mirai)", "value": "a3c0157407ae18cf80c507d617b48175d49cee4efd22f3868299a3b6014f9748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271995, "uuid": "86a79d9c-b706-40f2-98f9-27fe959ab0c5", "comment": "Malware payload (Mirai)", "value": "d1a37b134629c2a88824af0b9d5a3eb36aac537a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271995, "uuid": "b4b14e5d-2878-493b-937a-5c506649b0db", "comment": "Malware payload (Mirai)", "value": "11151cd807f91729af8d14785f1ef13abb0e42267459cf55f5d12051b75d5f87ed2bba81f349ea90cf0b3049a06ac733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271995, "uuid": "af188cd9-4f4a-4965-a15d-05d74f2ce148", "value": "T1A4F2E024D65B9E96FBA7BEB40F93C9C163909F4EB36D46906205CF412723C4A691DDC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271995, "uuid": "3854f4c6-678c-43aa-9980-30f379231db0", "value": "768:Uk9hrdmlHUOINyHornYspmFYLr1YFKy4uVcqgw09t:Uk9Nd6H63EK1UKy4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271995, "uuid": "da0f2304-85a3-49d8-82dc-d884b29f7834", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271995, "uuid": "95ed4cc9-e7b5-43f7-b698-85dc78102936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271995, "uuid": "9e7a3c2e-a290-420c-9777-3b4d141e4ce2", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e44c4f9-8201-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1784307647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307647, "uuid": "d4adb601-5759-454a-b43c-e49d9593231c", "comment": "Malware payload (SalatStealer)", "value": "2d069c83ad6d15ec4e98ab6811bec2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307647, "uuid": "e80ee9a3-4951-49b3-901b-4ca5d1c500bb", "comment": "Malware payload (SalatStealer)", "value": "a5481e564046c6e27c76121ac90b7e3acaf63958bbd22a01bcb7398ba24ea863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307647, "uuid": "626d59d0-59f8-4a5c-8d04-3d122f7d0ef3", "comment": "Malware payload (SalatStealer)", "value": "813863b344755b772e0eb2fb56d09aed191917f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784307647, "uuid": "575b209a-4af7-4507-8c20-49e193b73fd9", "comment": "Malware payload (SalatStealer)", "value": "7c35e1401c03c556f96efbeae932fb1319401b3b270d8d0ca8fa9e5efad4d418e36c880f34d82e0d48cd8ca3a4899d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307647, "uuid": "5cbbf73c-8005-43f9-beb5-db4cd75a4a9d", "value": "T187B633C56B768D5BD1A9423CCDF1BE38932ABD5A2B10CA8B63D076423F33ED44D21652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307647, "uuid": "74213124-817e-4e47-8a1d-2032c9521a27", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307647, "uuid": "a7429c1d-c6a8-424e-bde6-55b53632a425", "value": "196608:giakO7WQ9jjuWIbdt+jgdThIWtawia8Q5urErvI9pWjAPvzmx1EiE7:kqijS/bujehInR8urEUWjA3zY1FE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784307647, "uuid": "cc09cd2d-2b74-41c9-b88c-164b31bd104a", "value": 11137160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784307647, "uuid": "ca406cdc-7be9-4533-bd2e-a51e5c7e9bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784307647, "uuid": "dc93d01d-3700-4d8b-8526-9c47d222dbf4", "value": "TgProxy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2dd7f0-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312587, "uuid": "f6e3aa59-f5aa-484f-a04f-4ed3898bcea6", "comment": "Malware payload (Mirai)", "value": "84a79d4f1493a5f891dbab9e77f55c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312587, "uuid": "175c5701-297c-4bf8-9e4e-0ebf1cb36b90", "comment": "Malware payload (Mirai)", "value": "a582b99c9227c0d8d4c186a23cafed340483988e1be250cbd214f0fe6df9aeb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312587, "uuid": "a5dc0eab-caf8-4727-8138-b7c6e482def7", "comment": "Malware payload (Mirai)", "value": "45958c4571ec49f2343de9fbff8ccb8df359118f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312587, "uuid": "2caf39b3-f299-42e1-8ef5-4ec3c4b9fd21", "comment": "Malware payload (Mirai)", "value": "98a84e5e0453eae7d4210ac7b9665dc1fc99042502c5420dfca93222934b34bb18696258fcb2068c91a491c9ece5cb1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312587, "uuid": "cfa222e0-9844-48a2-ad05-349c75af0c95", "value": "T1CBC31A59FC819A12C6C216BBFA5E82CC772623E8D3DB7117CD159F25378B81B0E6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312587, "uuid": "e4cc0743-5693-4df2-9023-3a382a0106f7", "value": "3072:ILoW2/78oSKe5rg6J5uw6QIfYF86janbr:ioW2/D8cEuEwYe4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312587, "uuid": "0fc77904-7b90-45d1-b2c7-dbf60f7b1765", "value": 128332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312587, "uuid": "730b3e59-b309-4372-9999-f2b3e62426ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312587, "uuid": "0f16e6d7-6a93-4a67-80ac-ac9a8522f94f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a41472-81b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784273645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273645, "uuid": "2c4bbc46-b35e-4ac9-9adf-e36687dade45", "comment": "Malware payload (Mirai)", "value": "5b58c119173b967b26bf56c3cd70f525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273645, "uuid": "0caf0591-5b91-41c6-b86a-e507b920e01f", "comment": "Malware payload (Mirai)", "value": "a6668a53029147c050d38e2f8a1d1e0c89fef7861725829a4dd9c87fab56ce76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273645, "uuid": "dd03a95e-0b98-4264-8131-307d91342d1c", "comment": "Malware payload (Mirai)", "value": "2b8f26e5ec5112afe3d91b4bf96ec194ee2aac96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273645, "uuid": "c49f47ae-fe09-4577-80cb-2caa1f74ad99", "comment": "Malware payload (Mirai)", "value": "8ef65fe39f5e91bb0bf14172db301a9c4fac602cdd47bac0d5daac8aa4742d997e16a338b858192c0b1ae8ab637a5615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273645, "uuid": "9b6bfbbf-ab5e-4604-8fcb-b93bd5794037", "value": "T1C993AD33C92A6DD4E6519674E0F48AF81B63E50082671FBB19D8C5B95087EBCF2097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273645, "uuid": "0e7d1c10-ed3c-4920-957c-7dce770fa913", "value": "1536:iGKS0rFc8wtAGzd8qjeCckbJcNcnwCQQjCTFilbMaKGUYo7UjESsvChuJwAd68IJ:iG70rFc89GBxjeCcEeWnDWYM9GOWESs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273645, "uuid": "d290a1ad-7a43-4e51-bdda-fd1bafa0858f", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273645, "uuid": "e3b57451-0c37-4333-b813-29b0fe26d120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273645, "uuid": "5c5378ec-5578-4129-85e0-fc990c7e55ae", "value": "nerv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c1a188-8180-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252501, "uuid": "08b3ae90-6ab8-4860-934b-c2ffacfeba01", "comment": "Malware payload (Mirai)", "value": "be720fa7be18a370deec9fd9405f9379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252501, "uuid": "880658c8-62cc-470d-960e-0bcbff1731d5", "comment": "Malware payload (Mirai)", "value": "a784ce0b3b32c06ecfdf9f096bcb1876ed37ba124e393aeb03f1ca5ccf6dbf46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252501, "uuid": "ed7cd742-784a-482a-a45c-02e2662230cf", "comment": "Malware payload (Mirai)", "value": "56747aa3d67e5c375ed582521856d0380b039d11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252501, "uuid": "ebf2b012-4c3c-4801-ac76-1e365553d1b6", "comment": "Malware payload (Mirai)", "value": "c5127e910d2b257f3dade24435ae5130fec5bc3383cb2af6e2dfd0b2d194c9a6062c3b2c90922cf6ca9f51b628a22327", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252501, "uuid": "b328448d-45fa-481c-949f-8b89520c92dd", "value": "T18EF3F805BB610EF7E85FCC3706E9270128CDA51622B97B36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252501, "uuid": "d2c2b504-4f5f-4049-8e00-afb03e0537db", "value": "3072:ldrx+vzsw8TONAdQLty5l6Gm7UxbiuyZ6RlPP4FQQm8DrfIHB:lJx+vzXUONAdQLtKlTm7UxbiuyZ6RlPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252501, "uuid": "36cdcf81-7ac6-4f4f-8f9e-f9e22fcaa461", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252501, "uuid": "91856c4d-064c-45f2-bb50-6f799757d6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252501, "uuid": "b8f06061-0068-4d88-a623-bc438b0e4e0c", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd66e73-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311485, "uuid": "2f93d6bf-67ff-4907-925a-4d5ac24a72a4", "comment": "Malware payload (Mirai)", "value": "b9708a49ccc5979f821082f4eac6d056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311485, "uuid": "f09a93a3-d0c0-498c-ad6b-c1c6d7ecf4a6", "comment": "Malware payload (Mirai)", "value": "a7ad64d741a10d1a72dd55775bc63e4a610c58ecc5e5db060d4e6f5785d5b382", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311485, "uuid": "e508cd87-51ae-4cbb-975c-9df5960b6dfa", "comment": "Malware payload (Mirai)", "value": "d054847e831ab8f474f304ce678e6e4cba9fe784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311485, "uuid": "f0761c6a-7c65-4779-acf9-2292c6a34f17", "comment": "Malware payload (Mirai)", "value": "21f417567ef95953d4c215367d69a45c141bb683414d5ab5237e06c1c8e33f6a1800bbb40378b861ad1ce47e0d71532a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311485, "uuid": "02333bde-8c0c-451e-b53c-8db5dd0a8351", "value": "T16BE33A07B8C084FCC499C1748BBFB13ADA36B46D123CB29B2798AF271E4DE604B2D555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311485, "uuid": "c6901fd5-797f-411f-a37c-7818e29e9d13", "value": "3072:S5L41OdQsQzFvcOK4OA5UjV8g3tEhV2eKBHUskIC7iQIOYjm8r5Kh:S5L41OdQsQzFvcOK4OAyjXDUs8iQINX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311485, "uuid": "6fbf2b90-dba8-406d-bd95-26738d5ae25a", "value": 155288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311485, "uuid": "e474fbf0-cdb9-4fbd-af10-a9e4bdc5fe2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311485, "uuid": "4cc5afc4-7399-47a6-beb7-0c7f0ca70bdb", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807abb2a-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311274, "uuid": "b87c8386-d4f0-406b-8256-59af5cb7d1fd", "comment": "Malware payload (Mirai)", "value": "3aa9ea6f5a3d4fc125cacc6c4edbd9b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311274, "uuid": "4e143d2d-bd00-4eed-8940-4657b52c4120", "comment": "Malware payload (Mirai)", "value": "a82e8d574003c6f1caddfa94839dcf89a93ce0671109684ed55b2f4a3065e795", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311274, "uuid": "0a61fc08-2314-4f2f-bd8a-93cefba1ecbb", "comment": "Malware payload (Mirai)", "value": "f9b448026b7a1ea2f628a33c780d8725640a54d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311274, "uuid": "5142ec9e-ce29-46f6-8e99-f2162fbdb862", "comment": "Malware payload (Mirai)", "value": "66baa33cc5094080f2b44dae578f4d65e458bed0d5dfda09bdd63732cc6dd9f09ef0a970226a132a65cd8500545aa246", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311274, "uuid": "62f531a0-86e0-49be-9c6c-780ae4c8db27", "value": "T18C73AE27C81AAE58C02946B4F4F49E390B23F00486176EF66D5AC362E057DECF6463F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311274, "uuid": "192af6c5-0e68-4ce4-ba7c-cdd5aa4fe7c1", "value": "1536:j2a4/+WAvSgYmVIUDn8sqMBwd0oKJhG52udZCxoo/ZHN1ek:j2FmWZBUDn8sqSPJ9udZbstS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311274, "uuid": "cd57b33d-611d-4e6f-a925-ab0a03e165c5", "value": 75948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311274, "uuid": "9035f07d-ad8c-4939-9547-537f65c86fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311274, "uuid": "748d3ea0-d98c-41f2-9b90-05a487e3fa97", "value": "byroom.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1528d98-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311356, "uuid": "9a02a395-33de-41d8-80f0-96c19e9ea6c8", "comment": "Malware payload (Mirai)", "value": "afc67f68f3e2740ccbda15eaa8af8a72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311356, "uuid": "650a970f-ff3d-4a7e-9baf-4454605aa225", "comment": "Malware payload (Mirai)", "value": "a8918d40085eab7f1b0f93dd7fd7fcd136efafe66430338d6e53bb10b736de7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311356, "uuid": "9fa58f0b-f66a-41ce-acc6-d94654638100", "comment": "Malware payload (Mirai)", "value": "0dbe6d9aaf187fcedab0dbc1fd8ae88c13095769", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311356, "uuid": "5d4d0141-8b8c-49e4-a9f5-0c6dcc614e6b", "comment": "Malware payload (Mirai)", "value": "8040c717393132969d6f4459e0362842b489b59cc795302d069f70c569dd5fd18e9d93baaf72fa554ed86cf243b74caa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311356, "uuid": "a2f227ab-5232-4b6f-a9e8-b377e6ec8610", "value": "T1AAE39EA7B20F1081C42506F80BCB6BAD2F7325025DBB95E76CAE763E5A335DE05067E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311356, "uuid": "5df50200-d341-470b-bedf-70872f6ba9eb", "value": "3072:Ch8ZfupvUAPPW+FtICUxkQONXY9CHlfch7g5C+QsIhvq:g8WgCULOGOEhsC+Qs+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311356, "uuid": "c281dce8-5729-4509-8052-aaf281a6871c", "value": 148768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311356, "uuid": "c3b213a5-49b0-4405-9a3d-1e02de038bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311356, "uuid": "05260a34-f697-4dcd-a5fc-aa066bcc37bd", "value": "zero.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657d008b-8217-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784317242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317242, "uuid": "2baf40ee-f727-4961-8ff9-de234c0d694f", "comment": "Malware payload (Mirai)", "value": "20b083478fdafc67d56244980e67c77a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317242, "uuid": "ee97bf4b-c19e-4d2e-b063-7b012da1c876", "comment": "Malware payload (Mirai)", "value": "a92eff9facee7e09d3c4090355af7a0ab3777534d6658b5d44e4b7f475cc2d3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317242, "uuid": "f7b23f09-7f63-4fb8-a399-2082c1e667d8", "comment": "Malware payload (Mirai)", "value": "ec865f1d0bd1f9f1ea2939fa6ffae128cf9e04dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317242, "uuid": "469ab9df-1a0b-40c5-ac6c-ca16e8a40c11", "comment": "Malware payload (Mirai)", "value": "39aa4de5459d1b68b928b8fa7d1f3ee862424218d9bcad5f7f85cf13af6f50171a75a3cc24aa8aa2fdadf73b951547ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317242, "uuid": "cd4253a7-bb92-4ae0-a6a0-2ee11cbcf4da", "value": "T1A91186C7110503315FA6D9EABBBB455930D0D1DA54C37F6BA898B4E9828ED0CBC42553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317242, "uuid": "1e4c435c-4422-459c-be3e-2056e3907785", "value": "12:JCkp0FlkziHkzDX0FlkzLPxHkzLPIhOf0FlkzvHkzlVZX0FlkzHHkznNX0FlkzlX:ItSTfsS3+3IhOESoZPsSwySxTnxTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317242, "uuid": "a548c1d8-9018-477f-9da9-ca2b8280f5f5", "value": 964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317242, "uuid": "656cb43c-2859-4925-96ef-b486d31f9a16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317242, "uuid": "95eb6c3c-4115-461e-897d-055a9819d377", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd17624e-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311403, "uuid": "7b37b3f6-9710-4c3c-a815-f94efadc7ca5", "comment": "Malware payload (Mirai)", "value": "3c335885ee9ecb57b7cd782a72b5c027", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311403, "uuid": "e0fc5a8d-a638-4fd0-9feb-74c4acad30b0", "comment": "Malware payload (Mirai)", "value": "a931def484ff21c6309bede1d384570a369a07c4717938e253c4a6623b3953b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311403, "uuid": "c7dc0a2c-5294-4f77-b7ea-d011c6d5b684", "comment": "Malware payload (Mirai)", "value": "7f6912aed4fb8e9db763e84ab857cfd9a5155210", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311403, "uuid": "24cbcc76-6fa5-49fa-ab2b-588d92421e35", "comment": "Malware payload (Mirai)", "value": "b81c02c8cde161e7cda1f200bc4d4fdc5709949906cad8b7f29a24105405de66ec88aa8630d0365724d11a57fb2c271d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311403, "uuid": "356ca259-5137-45ff-9309-88776145e972", "value": "T16143027E7857BFB2969115A2F639C058F6760F74F155269273A00F48A34A3C00A7B3E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311403, "uuid": "986cb957-bffa-4178-8462-9c33046bf08a", "value": "768:LVM+8lrim8SnjbpZkcaWDvK9Ypttqjn34OTgAK/w9+o8tikyjhMNszER6BT3TkWe:ZMRk4bpZkcaIK9Qtu4OEy9mfD8BHk7Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311403, "uuid": "494bd5f3-f941-44fb-9a13-eeebf378a213", "value": 56968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311403, "uuid": "96a0b580-8afb-4327-b25d-6592467e78b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311403, "uuid": "e3dbbcb9-2dfa-4f96-b0c5-0538f04339e5", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca12b4b-81b3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784274385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274385, "uuid": "bd46389c-3953-44a3-a6b9-5dbd6cb7629b", "comment": "Malware payload", "value": "020d532eb18b6507dd4c471d3999d91e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274385, "uuid": "d65ad839-afc4-45cf-822c-457f3e6d88e6", "comment": "Malware payload", "value": "aa030433b4bb9cce7eef168738c6b9210809ae523b2853edd6d220ef0e0bb56b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274385, "uuid": "7b5ab7e2-c4fa-4355-b9d1-d34583cfbe70", "comment": "Malware payload", "value": "5b0d6983ff5e83d805e814b9db886e877ad572be", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274385, "uuid": "a2972b0e-4657-4fb4-895f-08352b9f4bbc", "comment": "Malware payload", "value": "899dd8ac3aee1f8f8934b985352cbae4787fa949aa9acc1d0730826b5a6d72a3cdbd4d454d6b33d12dec318ad12a9eaa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274385, "uuid": "6f03761a-4bda-428a-b5e1-c139682e67cb", "value": "T18F5302578891E2A1C73B98F445CE759F500AAA2118062F8A7ECC89373F9DD770B20B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274385, "uuid": "0ed3aa71-11c8-487a-b3ab-6972e24b75a6", "value": "1536:Ejx4t9urfow8sKdauUh+o0CM6N0PT2ASifncRt9s/O:EKCfhKdaugX02N0K6KtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274385, "uuid": "af06d716-d7bd-40fc-8640-2ec963920b4f", "value": 64877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274385, "uuid": "76b08ac2-1f17-48bc-93b7-699ff8f4c43a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274385, "uuid": "1511e699-6a84-4c4d-9fb3-e4bc759649b5", "value": "N5 menu fix.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d95319f-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284131, "uuid": "6e090699-16ef-4353-9d7d-e9fe5ff720ed", "comment": "Malware payload (Gafgyt)", "value": "760318f04befcd738f337d17e458af93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284131, "uuid": "81946bcd-86bb-4339-bc22-a5cd09434016", "comment": "Malware payload (Gafgyt)", "value": "aa692a5a839c7a56e2cd8b70affeb4bb5252fbd9b3342d31e25208b54403941a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284131, "uuid": "b00ef418-d3fc-408f-8081-3c39e69c05c2", "comment": "Malware payload (Gafgyt)", "value": "45161f186b1e7013f073ccfba4cb031f1140dfa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284131, "uuid": "ba079fb6-7d7d-4aa7-bfc3-b9731f08ae0c", "comment": "Malware payload (Gafgyt)", "value": "421198e4e1ef2a750a703d7fe11d5d9ec84ce3ed36a5baf1b3fcab19bee1ed64b90bf926e60874ea263e4227d0022fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284131, "uuid": "3b2f038a-87c1-4520-bfa1-b0c6c939fcf4", "value": "T19FC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284131, "uuid": "f6032a68-643a-4c61-b1a4-c721ecab30f7", "value": "3072:ekYPUfsgnsb0J2ag/VfzkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0zkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284131, "uuid": "af297524-3dfb-4c69-a0e6-54cf13d6e187", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284131, "uuid": "c0b76650-a1bc-40cc-804e-4d1def3605a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284131, "uuid": "e5f6538a-7491-465f-bd47-c1c7b06fed69", "value": "arm6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d234cf9d-81ce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784286071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286071, "uuid": "5793c0c2-049c-42f7-a515-1f3295865b91", "comment": "Malware payload (RemusStealer)", "value": "f132421a279033fc699a5a39d9a7f9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286071, "uuid": "140427c3-0154-4610-9854-714e629fb247", "comment": "Malware payload (RemusStealer)", "value": "aba0424bfa3520f4e1c6fccb529e3a06d0a3321a4bc135e61e2bdca2a6979c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286071, "uuid": "f63607ed-e876-430a-876c-f91570b7b174", "comment": "Malware payload (RemusStealer)", "value": "f1e297cc8a952e410f4b5155dc109a51e2afa194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784286071, "uuid": "26d4a5fa-8d6d-4fa9-9453-f23d54874f22", "comment": "Malware payload (RemusStealer)", "value": "461670daa1088ff40b1304da4ca694313342722e47d1769aea34273fa000d31ce8434ba481216adac3270481cc62ca49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286071, "uuid": "2c5665a3-2ccf-4137-a7a2-862430061b62", "value": "T1D6F53A07BDA108F6C19AA231897652527B74BC4D1B3223D72E90BBB82F737D09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286071, "uuid": "e245871a-541b-4580-98a9-e46d9f143c93", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286071, "uuid": "8b760148-7145-453d-b9b3-a51ac9ea490c", "value": "49152:sH+7SX4QU/xtC3d/tmEzYEcojTJY46Mx1rprKVH2c:sITe/7Pr5KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784286071, "uuid": "236d2207-f2bb-4082-846c-23443a678326", "value": 3339096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784286071, "uuid": "8a214cae-ff93-47b4-8364-69b466b3b9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784286071, "uuid": "44771485-4fa9-4412-940a-d183e5035da9", "value": "xqAAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9629c0-81ba-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784277312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784277312, "uuid": "7480b865-9b17-4d7e-a787-4bca656c5bd4", "comment": "Malware payload (Mirai)", "value": "0d7356edfa211b692e948a9203a8c562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784277312, "uuid": "70b88b97-0f6f-48f8-b872-ab10d6cb032d", "comment": "Malware payload (Mirai)", "value": "ac63d817c90067d1880c9ccb647fe37912d7749d020989b1539205cd73a826d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784277312, "uuid": "39195353-ed8d-4fdd-a8f2-00b79b52b8bd", "comment": "Malware payload (Mirai)", "value": "61b892bd49ab23ae5872c118288517979e978a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784277312, "uuid": "8f58a420-8d9e-4e52-b7ad-e2e227f3d54e", "comment": "Malware payload (Mirai)", "value": "c3630fbf78d19729d8ffe1c6b5f9c93ce0fb1fa7f3c603dbd6f56f8adbd867847c095be2f264c99930df245b7efc5107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784277312, "uuid": "665efdcd-494b-4235-819e-e5c64889d185", "value": "T19CB30A89B881A621C2C21EBBFE1F014E33574BBCD7EF7372A9545B60778A41B4E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784277312, "uuid": "c08b8da9-eef4-41f1-b46f-9f1b9e82de2c", "value": "3072:Q6S2PttJGvMNUcH+I+gFTdcnYZJkaKO77Lyvv78K3wx4iV4:Q636MNUca6OGkaZ77Gda4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784277312, "uuid": "5b1dee85-d721-4287-840a-1ce2ab400902", "value": 116684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784277312, "uuid": "157c4438-21fd-4294-a336-6f18027c5a58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784277312, "uuid": "0f8a8a69-a252-458d-906f-c099d39f6e72", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cd3a74-8216-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784316893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316893, "uuid": "0e43c361-6d88-4db9-b445-5fa6936fa555", "comment": "Malware payload", "value": "3a4cf464f018bb6915b1f65ddff094f7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316893, "uuid": "60751f8b-e96f-4b75-884b-ae49fa112ef8", "comment": "Malware payload", "value": "ac84c6bb36d2d145a76989b1f6e94455456903fea62787ee85ecd3fc35f4c08a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316893, "uuid": "08d36d07-a7e1-4197-bbb0-7326074ddef0", "comment": "Malware payload", "value": "c142003baa39c7c911c6e297114308c175cf582f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316893, "uuid": "7bb3f202-7adc-429d-b174-ad9a1ab175b6", "comment": "Malware payload", "value": "69d97d39e573ae33f4d4137762ee62ec8eb2fa4df7c3257dcc40ca7953e805f74fa6af20c8e0173b5e70c65090dd60f7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316893, "uuid": "18d75b21-23eb-4105-ac9d-8ca6edc23fb6", "value": "T15F519647B8474D144AB347674523A6E1F852101F29625428B9DDF48A0F3D6A993B81F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316893, "uuid": "07b59b41-b2d0-445b-9f27-ed9e1e5404b1", "value": "48:EA0BbsJBiWmCubhCMLCOVY95eRHqFeIBsCSdQhxu:+Yd6YMXGDeStnSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784316893, "uuid": "1fea9c64-8d92-4dac-805f-e2699411f29f", "value": 2749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784316893, "uuid": "29d14f6b-65b8-44cc-b673-ca7f98df4c72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316893, "uuid": "ce350706-7601-4422-8ed9-d841b72b8fc6", "value": "Adobe_23841631382_Fri_17_26_2847362583452.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1739d498-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312386, "uuid": "bf8cd9c4-dd60-441f-b3ea-56295f5f2ccd", "comment": "Malware payload (Mirai)", "value": "2e211d9c520cb8317103fe373fa9b064", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312386, "uuid": "cc0ec1e6-00b0-481f-b2e4-2ed1c8ead776", "comment": "Malware payload (Mirai)", "value": "acb1e8323106c3e518cde916222cf04c3c5a27803a1d49da5b2da20d02c57b25", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312386, "uuid": "9eaf7b77-dd08-4dd8-863f-628a128524c3", "comment": "Malware payload (Mirai)", "value": "a4fcde280172c843d9291fd7d4f321cb5e5421c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312386, "uuid": "36d7630f-eb50-4ea4-b209-c4d0c4d81dfa", "comment": "Malware payload (Mirai)", "value": "261f6a8168ab30239063e7aac5fac1d18c841dda8925112961b5e7ba4d383341955f9f9e6a0e3bc14d9e26db2d6ec875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312386, "uuid": "17ee28bf-53ba-49c7-898d-4bd01ec2e174", "value": "T1BC730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312386, "uuid": "bbef4ada-5983-49b1-b5cd-36bc6df8655b", "value": "1536:Rcz8Mfl3USRL+r97S3Tl5ffUrksEKh+03DLJfLZaA14B6Kk3u8mg:RcICl3USMsTl5HUrMm+03fJfLYK4fQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312386, "uuid": "7c4a53b0-bccf-46db-946f-d2d4b78d9f71", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312386, "uuid": "17b2e8b8-1ba6-43a7-8ee6-c40664a32f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312386, "uuid": "1bcb4599-c734-4f53-8d52-585d51ffb58a", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65975534-81d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784289325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289325, "uuid": "33f8fa9a-f3c6-4111-9034-8fac994fd1ee", "comment": "Malware payload (Mirai)", "value": "b9c4743ba04fcab8f687880ad8825dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289325, "uuid": "a1fce652-7ce2-4045-8cfa-7f4e39b8ca24", "comment": "Malware payload (Mirai)", "value": "ae2294c021cb4852026c7834fe72c919d2341059ec84041d76c00a28a2071cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289325, "uuid": "225d7e30-ef8a-48c6-8f9c-09ec2002d891", "comment": "Malware payload (Mirai)", "value": "d09b8373f90ebc79d6a0ae2fa92abed016daa36f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289325, "uuid": "d526620a-5aaa-41cc-b9da-287a416d4701", "comment": "Malware payload (Mirai)", "value": "0cd3e9dd81fbfcf384c11b4c9627f08f5c7e72d00299738137b181d05cfe30683e7d19efdb3337df1400f9a0f63b7ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289325, "uuid": "c3fd7481-6c05-4498-9f86-bc602556d678", "value": "T119056C677B21CFA4E315C63005F3CA655AE421A21AE25089B27CD31C7EA162D2D5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289325, "uuid": "c0864465-6372-4a9a-a921-db87a6127d81", "value": "12288:nrk4I5TYrSMXNz8KBofSL/DibkYHVaCkKJvlsih+gt1wr8plTk4Tbfm:o4I5TYrSWoKx/D3Y1aCHZlslgtGIkAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289325, "uuid": "c7a568e2-bd10-49de-bd33-eb02365d4a9d", "value": 827760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289325, "uuid": "5825fc2e-dbc5-4413-8fc3-bf45ef126136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289325, "uuid": "7d6232ae-23bc-48b0-90fb-ea44833a5ec9", "value": "volar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d867352-81b0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272856, "uuid": "ca39d135-2fec-4dd1-98a1-6c962a57f883", "comment": "Malware payload (Mirai)", "value": "e3e6c8ddffdd39395d62b73a28a1c0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272856, "uuid": "375a456f-47d1-4789-9a1a-69c433718a99", "comment": "Malware payload (Mirai)", "value": "ae720419178e25cfdb7ec52dc345f0e3efd8ca7e1f17a5923ced38cb69bc1b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272856, "uuid": "830d2058-a8f5-4147-8931-c3b26c372af9", "comment": "Malware payload (Mirai)", "value": "2b16f412130716fdb398e79f80ccd043e4971e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272856, "uuid": "6a83599c-2780-4af7-b9af-e2ee8fecc3f2", "comment": "Malware payload (Mirai)", "value": "ab5735c0be0d0c5d14171d25e34f97a008c1212d9633ffc5e0638395310410d0e880e20f7adfe9a3798f8ba5f148b771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272856, "uuid": "102ae4e6-1a84-4b8e-87ee-a1d0543a1900", "value": "T173331A95FD41AA12C6C155B7FF0E828C7726435CE2EE7303AA25AB31378B85A0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272856, "uuid": "3d90eed8-c003-44e7-b08c-330ebb9fd7f1", "value": "1536:xyWQVz9so8z4PaORqQghHH9CVJ1RHbRR:k/io8cK9hHdqHbRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272856, "uuid": "8ad92164-c127-40e7-aa32-d24e983dfb5e", "value": 54888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272856, "uuid": "3e7083a7-22f4-44ee-ba48-4fdf05ef3a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272856, "uuid": "40c41b4c-eedb-4b52-826d-8390fcfdb186", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288633ba-8215-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784316281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316281, "uuid": "ea990c10-b855-4767-aabd-560023b9551c", "comment": "Malware payload (Mirai)", "value": "36dc0c3a6e1c5de2c4cad0b040ce708a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316281, "uuid": "e0cb7ffc-d9bb-447d-bd42-031c92d36169", "comment": "Malware payload (Mirai)", "value": "af43e33e37f04ffc9e00133cc20c5f1577493808226c170c229724c0c9a6f893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316281, "uuid": "98ecf693-aa79-44ee-a415-fb917f3ac8af", "comment": "Malware payload (Mirai)", "value": "587dc1496ae5b6cf8d31a24d24d009390b9d023c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316281, "uuid": "006810c2-e356-468a-aa83-c51d068e5495", "comment": "Malware payload (Mirai)", "value": "efffec92f1e4ab7d9d82bec9b46b549b4ed721cf1664a34b608f05fc37416ab0ad3387f87e6ed1683af1bd30719c1301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316281, "uuid": "d1b0f989-52d5-4c3a-b85e-02ff0bf4724c", "value": "T134C32A0674A154FCC15BC434C77FA837EA31785D12347AAF6B84AA712E23E751F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316281, "uuid": "9cb27f1c-4ef2-49c9-b2c6-3d6e13b86907", "value": "1536:pMpL4NR4ouH9iGPiGPZpx9HEmU40Be39QbtOnhvpC/hvMLTzbpG44IorCAg:pK64ou/qGxR8cRtmvMLbpG4m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784316281, "uuid": "c7beb43e-2caf-4f5d-9296-9271b0e83f64", "value": 124792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784316281, "uuid": "afbf0485-30bc-4d7a-9806-7b0e504747a0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316281, "uuid": "ac9ce10c-6d54-4b88-bbca-ee68a245639d", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1027cf76-823b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784332561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332561, "uuid": "699aceba-7e13-44b6-815f-7108a99a0bef", "comment": "Malware payload (Mirai)", "value": "5bec04790ec99c1ca51a919a431abd32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332561, "uuid": "09bf5b1f-06d4-46c2-afb7-c25fb93385e3", "comment": "Malware payload (Mirai)", "value": "afaf5a58dd6e9586701b97b9e5b454846f3ce0053a0aa44b196626d7f4a4e5d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332561, "uuid": "271c0ce5-6c8f-4205-9a2f-2bc5fcb9a8e4", "comment": "Malware payload (Mirai)", "value": "890fdcebd5b9142716115feb30b7ad80b0a208ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332561, "uuid": "157eb8e2-d5e7-47b4-8247-8b5ac1cd7871", "comment": "Malware payload (Mirai)", "value": "472c6ef03838ca919d9b665ee491a2fdb851fad4ad37d05e6a248a696cedfde923ee8f69471ac12d6cac94efad4bb7c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332561, "uuid": "c695cf0c-cfa6-4152-8ad4-e83aff374603", "value": "T1A8148E01FB180953D4932EB44B3F07A6D379D88318F9E109190ABB561733EB7A6C7B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332561, "uuid": "60c27810-40a0-44fc-893a-e553eaa86bf1", "value": "3072:kdqDIz5qCymAWY0+bcxwvyeyagZAAkQOpUoooS1qRZ1DrooER:HDZCyCY0+bcavRddAkQOpUoooS1+fQoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332561, "uuid": "4c4dfe0b-3b88-4504-b329-92f195bdaf4d", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332561, "uuid": "cd466a1e-c001-4844-8781-424d6864f0cf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332561, "uuid": "290576fe-e3ba-469b-8ca2-13de3757cb61", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d74b57-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250137, "uuid": "7a725963-c18c-4157-b823-b8a00903a50d", "comment": "Malware payload (Mirai)", "value": "5c38113f40d8be0d79a05f3b00520289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250137, "uuid": "347de8d2-1c95-472c-942a-9f9d9c6a55b1", "comment": "Malware payload (Mirai)", "value": "b0f13b57395ac71b39d1d041c1c7fe8c145d9e3b0783cb336f66ab1f3f1ec596", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250137, "uuid": "77def5ae-81ce-4c8c-8ac1-3160862862cb", "comment": "Malware payload (Mirai)", "value": "f6c6687e75c748d2e7d9f27d01baf31348a7fa95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250137, "uuid": "88e7b8c9-1d7d-460e-a290-6f23b5f18a89", "comment": "Malware payload (Mirai)", "value": "cac83d9fefade99adae61da7ff88a7ace632adcb8331d1f6c6421cdfcb0293317dc05d276b6e6e85b2f07f2b05535bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250137, "uuid": "c2af5ca9-91e9-426b-9254-f34b3dfb9045", "value": "T117B34BC4E243D0F9EC560534213AFB379A73E5BF212DDA43D3A49AB26C96AC1D40679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250137, "uuid": "12d82345-8cfa-4d76-8050-2fab6c2656e0", "value": "3072:hd5qGekwumbRajd24Wg4I28xxfebx/S3HgGL:75qGek6bRaj4JI3GJS3HgGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250137, "uuid": "bd80669d-296f-46ce-b959-3faf2168ef41", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250137, "uuid": "b9041efe-27de-46c1-a703-7e5c4b633469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250137, "uuid": "e924fd1a-77e8-4e61-9dc6-a553a1d267c4", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5a5afa-8207-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784310222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310222, "uuid": "207b3b10-6cfd-4ca2-9683-6340a4e54067", "comment": "Malware payload", "value": "241713a3180889ef311aaad3a16aff37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310222, "uuid": "cf981b3e-d293-49dd-bf62-ada7b3618e1d", "comment": "Malware payload", "value": "b15502493aabcb2aa6a314a94e6a02eac07c7545617018f85b7aac50d9491aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310222, "uuid": "68b1d184-43c6-4376-b2c2-566c3e34219e", "comment": "Malware payload", "value": "580c7e38b4201cc836f8eabf47733dc251cd2374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310222, "uuid": "455a3b17-5689-47bc-ba51-07fc66239503", "comment": "Malware payload", "value": "19d462452165a7532b5fc4b8a42953d92b1bccb138a799927d6b725634219e89661ffd88f999d33de3efcf9dc30c3a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310222, "uuid": "637c09f6-1006-4849-b1be-6d2a66da526e", "value": "T15A86D42F66E8812BC519863FC5928B40D9F371754B32C1F7569907B88E769CCBE3E260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310222, "uuid": "6fc538bf-d285-4d5b-9ed3-c282c9901537", "value": "5812c562fdd89355e9ab0d4179cd97e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310222, "uuid": "5ae00b65-962f-4764-9cf7-05dce45a9af0", "value": "49152:YAikniUmg/AwYZQcE3s2ugXK3US08L2D0p1q/9BKD54TqCPMgSUVUw4bpwD:GFeRlrDSC4F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310222, "uuid": "f9032fbf-5958-4e87-bc82-2cb63e29d4ab", "value": 8035640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310222, "uuid": "9c3ea9fa-cdd5-4936-8b3a-72020e18a615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310222, "uuid": "1e2f3d15-1a7f-47eb-87e9-122b2c8c4392", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f579ac95-821d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784320060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320060, "uuid": "2448c811-ac9a-4051-92a1-17d0bc97d3e7", "comment": "Malware payload", "value": "c0d35d47782a872f43055405a9d09ce9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320060, "uuid": "1ac7ea9b-c0b5-407d-bca1-875deee0269a", "comment": "Malware payload", "value": "b1864f056c3166df653b5f4400255b681c4f9ab7a44ef2d8f118e6ebce8aab35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320060, "uuid": "5d1c42ba-209e-4d87-a202-7842c1ef0303", "comment": "Malware payload", "value": "92af1966a684aceb52b2fb470280c8a7a8ed8d5b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320060, "uuid": "e6783181-865f-49fd-b163-b669f2ec8d90", "comment": "Malware payload", "value": "4759bd0f0db19fa1fb6b3fe54dd7a0e1224047c373458be200c47ab4d9e4d4ab2120fe9036c3b206833e7e6d5fc46c33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320060, "uuid": "c6cef3d2-1fd3-49a6-ba66-19d100ad6002", "value": "T157E048CB011563704B1C9DD87C7B44BD79C0D2D571A23626F4048479C2CA1187C1372B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320060, "uuid": "b387d295-b5de-498e-88f5-03aa44917c7d", "value": "6:3J33kzRrdP8khELVBQ3kzRr/Q8ksWQELLcBQ3kzRr4xh9yLcMBQ3kzRr5xhbQxIg:3J33kzLPfhE3Q3kzlQ8ksxgwQ3kzkhgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784320060, "uuid": "ddd51dfb-f05e-486d-bd24-fc4aa845426b", "value": 320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784320060, "uuid": "b3a48a78-81aa-41ff-b9f4-d760b619b53a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320060, "uuid": "8f8fd542-1191-43c5-bedc-622ad3c61265", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054290cf-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311497, "uuid": "13f8eace-8078-4ced-9703-6751427a4ded", "comment": "Malware payload (Mirai)", "value": "9786b24ae61abd2827b5dd346268d40f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311497, "uuid": "7dfd2de8-ae8e-4f41-b72e-42b10ffbaf36", "comment": "Malware payload (Mirai)", "value": "b192afaad8960ab1bacb9de6cc65db73a941debe2c97a5d35a2d9c32adc56844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311497, "uuid": "0599062e-dddf-4b71-a8ba-a2a98ae507d6", "comment": "Malware payload (Mirai)", "value": "8b2bf72ae2e7774e15c6b414d24ea488d491a52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311497, "uuid": "8740adeb-dbb0-425b-9624-f80d4f6a5e62", "comment": "Malware payload (Mirai)", "value": "47504be6f073302b8c73491898c898c8d08dd1c705d0f9361581284c14100225247aaf70914789c5b5efad33b44b070e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311497, "uuid": "6da226ea-7064-4a21-a7f3-577af053dedd", "value": "T11D14B50A6F610EBBDCABCD3706E9170228CD541B21A93B757674D924F14B64F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311497, "uuid": "c424af9d-a109-4815-855d-81151e26626e", "value": "1536:B9EuHQ8SFdCQjJrIU+qiGLzVxwBBk3Zwa1eXblNi1Hk+yjMpkpg9c7/+vHcY9krG:Bm2Q89QjJyqHvwBM1Hktgkac78Yej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311497, "uuid": "467eabdc-8a7e-4cde-860f-7070894a5928", "value": 197700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311497, "uuid": "d05e38b0-062f-4fdb-a4c7-41df944e1caa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311497, "uuid": "24ccdf74-44f1-4113-b398-615bd84763ec", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddafad6-81d8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784290412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290412, "uuid": "8de33e5b-d295-4ac2-a30a-2f8e68734809", "comment": "Malware payload", "value": "86ba88a0a9197cd034f453fdfc4cb175", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290412, "uuid": "01be51ee-5071-4f24-b67f-816293478b7f", "comment": "Malware payload", "value": "b1c0ca1f0b8c4852928c8263015177262f9c99ecc433cd90b8e33044f95b8a6d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290412, "uuid": "039cc4e6-7891-4ed5-aee6-146f87617008", "comment": "Malware payload", "value": "532f40d3c9b79cfa011a3a6d14487ecabd362bfe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290412, "uuid": "da054e57-e535-449c-b22b-badb8e7b5a59", "comment": "Malware payload", "value": "39e4e9b99712aeaeb0f2e1f338dfc9bed258104a82290737ec2909c018836c8924cb0c594040a4423bfbe73e6e15674a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290412, "uuid": "e4203de7-8dbf-4d41-b2a1-0b546e42f4cc", "value": "T1EFF73331B27679D9E61FA3BFA4A85F8940307DE0731BDAAB63787FB145B054251B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290412, "uuid": "97672200-555a-49e7-94bd-b9a25b0c0b3e", "value": "1572864:GLO3oG15J3eRSC6gc9XUhzVGj1Jr6xaC1114hkPY19PXKA+YXBTionjG:GGZO6R9khzofr64C1O19P6A+4BDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290412, "uuid": "5469db69-22f4-4d53-a55a-528c982c6075", "value": 74358784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290412, "uuid": "4deb66b9-afe0-4cba-9ff2-e0938e9a39fc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290412, "uuid": "c7c4f009-9671-4790-99fc-26f9bb7e14ef", "value": "bxgajwy_jyabaop_6.5.9.8_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbf747c-823a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784332208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332208, "uuid": "ef1f6010-be7a-4cd3-9bf1-fd078013400e", "comment": "Malware payload (Mirai)", "value": "abdcc6b6768a43b65d95ac3344678938", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332208, "uuid": "09b98f82-e6dc-4852-92bd-0c40a9501314", "comment": "Malware payload (Mirai)", "value": "b25c3c740aead577c7c89894e80ee57c63d5acd78e62d789213fda023bfbaf3c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332208, "uuid": "13008c6a-4b78-4219-a347-92a35e717630", "comment": "Malware payload (Mirai)", "value": "1e150c526760ca4ab4a490b2cdf9abd3ca3aadb3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332208, "uuid": "e4da12fe-df12-4546-897c-8eecc6bb9dd9", "comment": "Malware payload (Mirai)", "value": "ee72c4ad03b661a8ce29e73c2c9042d8393fa82f03d8f9628c36470e08b2cfa60b407ee5dcad9c69f5951f3820bbc359", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332208, "uuid": "714658fa-209c-4366-9aee-48155b7fb38c", "value": "T19A2162C7110503302EB6D9E6BBBB485970D0E1DE54C3BF6BA8D8B8E9828ED0C7C42653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332208, "uuid": "8f6ba437-43d4-491a-a1da-bb5688caad0b", "value": "24:ItSTfsS3+3IhOESxW3SexASoZPsSwySxTnxTGFC:irNEJ3GQ4KTxTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332208, "uuid": "198c3564-326e-43ad-af60-e335d1d34d73", "value": 1323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332208, "uuid": "6b6d3422-f4eb-4bd5-b59d-12e66ed37852", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332208, "uuid": "ee95145f-8dbe-4493-8bd0-20544e8ca4cd", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce9f923-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "5183905b-ec13-4178-afb7-9fbc699237ad", "comment": "Malware payload (Mirai)", "value": "1cc1d033ca45e29055624030f54d6360", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "a65d776c-393a-4efe-945f-62f3ba9d5cf7", "comment": "Malware payload (Mirai)", "value": "b2c6bd04ea2a48893f6198fa7c05629cd928ab8c7a7f188d909cae14a856db55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "4f1ab642-52ca-4ca7-b182-2a06aeecaa51", "comment": "Malware payload (Mirai)", "value": "88200998ed78e3db6e18832c29fd4b546d2c83bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "11db35a0-2861-4443-9408-c9fe457c1cb9", "comment": "Malware payload (Mirai)", "value": "ae375da1dd6b5ad2f92a15f9201295334769dc34ec0ddf2fe62f66132c5ca060cda4c81f76d30e56c446eef5f9191129", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "73fd47e5-5e5b-4a5c-85da-957473443cde", "value": "T1B043F1A80D4684E4CE26C3734EFFC3150F5443259293D8D22DEC2AAF5D4ACBA7892A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "d8a147fd-cf6d-4153-99c2-775b3e8980d2", "value": "1536:+g0sAzQvwe3aM+l1smuNpZ6kPGrZl0+PmEbJRf0zbCVJu7:j0txe3+HJuYkPyarmVQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311376, "uuid": "15df86f1-ee13-45fa-a950-f5d25fe69866", "value": 56272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311376, "uuid": "bac49eb1-4b56-4d7d-92cc-06143744c594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "40154e03-d444-4c70-b840-feaad45f7e89", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6881d3e-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267100, "uuid": "02e092f2-1032-472b-ac11-953fd491654b", "comment": "Malware payload (Mirai)", "value": "b6e16bdf105882972e7097d889513720", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267100, "uuid": "5a2cac51-ba26-4e4e-b8e0-6648696caddc", "comment": "Malware payload (Mirai)", "value": "b327e0094f3d527d64f2607edaaec2d1cc47356dfeff8789286dd419b1063e00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267100, "uuid": "166e576c-1fad-4de4-afce-75185fcbbfde", "comment": "Malware payload (Mirai)", "value": "6c6a491f2a1b241d9b3fb2d971749bfd61307bbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267100, "uuid": "bf4e0f72-2fb5-4b2d-892c-103f09bfc497", "comment": "Malware payload (Mirai)", "value": "cae52ac3493ada007d659dae402b07426219f4228b3418b43646eb29dfacf7f218a4f7e1c46e6bd2b5fdfbfdc88ac8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267100, "uuid": "1cb51933-bd2a-495e-9cd0-039cb6985f9b", "value": "T11B935D02B70C0E43D1675DF02A3F27D1D3EEA6E121F4F688691F9A8691B2D335586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267100, "uuid": "bd36a453-91f9-45c5-82d0-fb3ac50c0d0e", "value": "1536:GFsCCOHrTgbrkkoV4SKUgZ5VvHfNa1Y04M1ykpAzKY3uVetMuXyCQ7sIER3BfG:LROHrTZkoqkDTAzhRMVC0UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267100, "uuid": "18671920-34d4-4dfe-b0ea-d5206a521a67", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267100, "uuid": "2b451da4-0758-47c1-8422-31346dc0c79b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267100, "uuid": "d1d92be9-f220-4093-8795-c2eebdf3903c", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1376ca42-8207-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784310232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310232, "uuid": "a55b23cd-81fe-48c5-bd74-bdd2149d483c", "comment": "Malware payload", "value": "567d4d9de3fdefaef336b926a08e8d4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310232, "uuid": "6f36458d-22cd-492b-adbc-5efb917fd044", "comment": "Malware payload", "value": "b3516fba1ae0048ef4b61513776edcb2c3f62aa27759aab762e41c545b6025e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310232, "uuid": "3971c437-4c0b-443b-81dd-23d1876fae6a", "comment": "Malware payload", "value": "5b5a9b870cd4592770b37f6c2db71bb986b89d94", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310232, "uuid": "f114c86b-483c-4f2c-a25c-ecd11ecd4252", "comment": "Malware payload", "value": "ffd38221013e71da1118fd9ba4a30333e9c515751154ef869eddb279ed0518c7f637773d2ab878f64c0d688f0dc5c2eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310232, "uuid": "993bf549-e23f-4512-8a61-b58892c0d994", "value": "T1D8C27D966A967C44BEC94A3E4CBD2B0D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310232, "uuid": "6d1e0ae7-2a07-4cdd-87ca-e5e4d246c982", "value": "768:e8vCB+25j6es8RAK9FYpMSUpi+20qUpi+20YQX:e8l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310232, "uuid": "96244ce6-c1c8-46af-a87f-2313422753d7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310232, "uuid": "1e34d805-24d4-4529-98b2-153c605e77ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310232, "uuid": "11f1d662-e8c3-4a7d-9e8b-3700532b4ac2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8956c35-81a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268848, "uuid": "34d9903d-48a6-4b71-99e1-d2e6ae114b4f", "comment": "Malware payload (Mirai)", "value": "261f3e4669ef9438e5ba91c434e4a700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268848, "uuid": "6e37c93a-7587-4707-8f18-55d11070e457", "comment": "Malware payload (Mirai)", "value": "b35e2ce4970b20dc6c6cb8f6dc9f0187608bf1f49f6ce9606fa51d9d1a9d88c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268848, "uuid": "ddb0fb9c-fa06-446b-bf1c-30dcfa17d073", "comment": "Malware payload (Mirai)", "value": "54032d092eaae0923660be9abd33762b2eda8e47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268848, "uuid": "4cc9ad2a-f38c-4bad-a8be-8294cf46995c", "comment": "Malware payload (Mirai)", "value": "4c82be9b7ac1abf2c4bf5f7370fe80482304da008157d239c9e3611412910a01e834c1932dcbd92fb2e52d153d0d5d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268848, "uuid": "b3d51523-9898-41d1-afd4-64dfb84c98ae", "value": "T1C0B35C22B9751E2BC4D4A8B661F34361F1F3579E21ACC61E3D710E8EEF246503257AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268848, "uuid": "bcf1248b-4998-4b6f-9553-fd2decbd0907", "value": "1536:3t/ikUw0qX/ySCcYIUkKrN8v4AOaOHqkDfBAXoCJdhIyAiWP2IdtorNWq5F9AcUd:3pDwN8AA8h3CidmrNlDCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268848, "uuid": "94fc82ae-c1b8-42b9-8352-dbc0a8a37dd7", "value": 112644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268848, "uuid": "5295f647-146d-4b0d-ace7-033b17a558f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268848, "uuid": "714c4a4e-e4c8-4e82-9e6f-2e29d1847e56", "value": "nerv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb7b58d-81de-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784292749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292749, "uuid": "5a22516e-edfa-4e2b-a0bf-a751abc82560", "comment": "Malware payload", "value": "d0c1d330eba0209b548c78d2cddd6139", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292749, "uuid": "758ca2ea-9ef6-4f39-be93-dd82781b8334", "comment": "Malware payload", "value": "b3948180677cf5a14aaf56f5d39f66f345287d1f4e3ea79ee3ab4848c9336557", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292749, "uuid": "76eb1fdd-f989-4ab3-ad1b-eb26127630e0", "comment": "Malware payload", "value": "14dc07da982973870a60897da59d58dca3c4d5f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784292749, "uuid": "7ec33822-a491-45d1-b5dc-af13e4acefa6", "comment": "Malware payload", "value": "a00822df38ab4a338f9997e80ca13c4bb2c7202a2cee8ec025460906e2f5286651b9574a164f0b17265081ed7a1bd474", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292749, "uuid": "121c8dfe-f2ac-4cb7-83b1-cc84032c29a1", "value": "T1CEE633085AE012DFD3F38138EEE1C6A5D6A9B4750771C2EF2BD853A16D472E0493C6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292749, "uuid": "25f88b61-a37b-4737-8acc-afbb91e12a66", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292749, "uuid": "c7d6ded9-95f4-406a-8047-f4ec787c523c", "value": "393216:z7vv+GGzsRFYaTe6PdCOD22XMCHWUjXCcuI3/PGTAI:zYQfYae6PdCOD22XMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784292749, "uuid": "f3b10e07-3d84-4e7c-9e4a-c16d14ec6490", "value": 14297056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784292749, "uuid": "abe5ea91-f6ab-4ff7-b15e-ebfe446971d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784292749, "uuid": "ab4c8453-bfff-4a1b-a85b-9240d51197bc", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91943958-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278661, "uuid": "bd6debcf-740d-4b2a-84e2-f30975b5f9b7", "comment": "Malware payload (SilentNet)", "value": "7d19870da186a389a44feecf56a9e040", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278661, "uuid": "106fcd09-a967-4878-8f57-bb6cf2c00989", "comment": "Malware payload (SilentNet)", "value": "b40233d96499f3952c0e147f3b9023102aae10d215b85cf85634f10ae9684307", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278661, "uuid": "13f6bc99-d5fc-4682-8ce5-54a59fc46b33", "comment": "Malware payload (SilentNet)", "value": "04fb0e8c24d598dc0b1c7e104bf449b94be3dfa3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278661, "uuid": "9a0f34ec-13cc-4739-a7f7-667f39c88a17", "comment": "Malware payload (SilentNet)", "value": "863ecfa28e0e96834bbc4224f7d525c41fd5d1ffff2089c08ed6d47534580f6b15848179b2e0aaca40ad9dcf7ab90cc9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278661, "uuid": "0cd99ff8-13c0-498d-b0fd-4fc071a95358", "value": "T15E1633C3692F652AC13BB7B1C5129CDF49E843D8A11C9C3D94EC5BF91D4A4E0AAC726C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278661, "uuid": "5beffa4c-4e80-4ccf-9d7d-aa17efbdbb8c", "value": "98304:FN0tGu9+WXxK9fhTor70wV4mN4BdD0tvn4t94Rg6DKu1:F8+WXo6I24Bds4D4RVDKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278661, "uuid": "1ef595e8-06b3-4732-b8b0-dfc0adb044a5", "value": 4047155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278661, "uuid": "c61ed0a6-3314-4802-b5f6-0ab692f50798", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278661, "uuid": "1716122a-db31-4c96-8d06-29288546303e", "value": "Fastclient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b508df2-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284127, "uuid": "c2f17690-e7d2-49a8-b93e-fe1e2e617dfc", "comment": "Malware payload (Gafgyt)", "value": "4e9691dc110c6ccf2abf0b7caec71610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284127, "uuid": "a3f316f5-ff56-4cdd-8df9-9d09a8e46800", "comment": "Malware payload (Gafgyt)", "value": "b4a9cb32dc30192c85d35f3f7f518081988a6461ffa5e136fd061db8ed31ef0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284127, "uuid": "ce15bb7a-a6c2-4d54-a3a1-46c151a2259f", "comment": "Malware payload (Gafgyt)", "value": "1b745f356e6ffaef473586a9bf44322963696bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284127, "uuid": "a0af2415-e7d7-4fc3-b6f3-9ae2c7710949", "comment": "Malware payload (Gafgyt)", "value": "13d6edd6e6da9164e8d802ccd8f2544c7fefbec3f1e30c474f7bfc2e0d3caa5a7bd206e8a45c352ebc786193f156ef70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284127, "uuid": "7a46f725-5120-4756-a74e-1e18700ebba0", "value": "T169833A02F751C6B3D18316B612DB9F110532F9BF1A1AAE06F3AC3CF8AA154847563F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284127, "uuid": "a03c75c4-d0eb-40e8-a48e-65c2bbc1f3e2", "value": "1536:vrYoW7as3D972+c6tsTngPE56XxCSn9GPvjtg0md+wVOz+sXcfW7k:vrYnvT97hc6G7gzXxxY1mMwVOz+ucfWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284127, "uuid": "173b6ef8-d08a-49c7-9bb6-cc13f9673ce5", "value": 81479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284127, "uuid": "731c78d5-290b-4ddb-89ed-0ac4c4f3ac0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284127, "uuid": "d47528dc-70e7-4aca-9a9c-b81f5fd89299", "value": "x86_64.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3210763-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1784291656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291656, "uuid": "6743f951-35de-4057-ad5b-2f753abea554", "comment": "Malware payload (PureLogsStealer)", "value": "c3d3e85c060f70edc6e05be165bbb9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291656, "uuid": "b701b82c-471c-41b4-94b9-6964351fdd45", "comment": "Malware payload (PureLogsStealer)", "value": "b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291656, "uuid": "cbfe9894-4c76-4280-ab7a-1a5e55955ab4", "comment": "Malware payload (PureLogsStealer)", "value": "33d45d550844adbd722d5aca58fce1db5151aac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291656, "uuid": "42cbae2d-da6c-4fe9-ae8a-770d6ef67a57", "comment": "Malware payload (PureLogsStealer)", "value": "8e88c16adc38a66b5f62a65657cd0f388dfb7a2ae24346b9d9a7a364d3b712952b33f2959f4a4166ad75b62f3e9a063e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291656, "uuid": "dfffa19c-3ccb-4e4b-ae6e-ccdaca80bdea", "value": "T1B4751BFB997619D0C76CBA7188188842F3F0107388E65E15B8F5ED80D6A64DAD486FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291656, "uuid": "8cacc904-3c37-447a-b1a6-1ec5a8b917d2", "value": "96:1VQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQY:9rVbj8UUXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291656, "uuid": "61d604be-c5b1-453b-824e-986894154246", "value": 1689185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291656, "uuid": "b14bd487-54cd-4f97-8fbd-aa5113efbb20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291656, "uuid": "511d165f-3805-4c10-9725-4a9b21b3ae5a", "value": "Pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2706bf-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784329760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329760, "uuid": "e9739383-b920-49fc-9bb4-dd1fefd83aed", "comment": "Malware payload (Mirai)", "value": "a064dcdbc05bef30b19a4ea35834ea8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329760, "uuid": "8424f3c1-11b5-4b99-83dc-9c8343b957be", "comment": "Malware payload (Mirai)", "value": "b5b220b1dff259efdaf017b58aae836955096f6ffe8cdca658c1b6887b35dfbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329760, "uuid": "c2c5d5cd-1795-4221-9706-bd139b1dc2ba", "comment": "Malware payload (Mirai)", "value": "6ec0542779de680c589272e0e78e28e3051a7895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329760, "uuid": "c81fe486-9808-4bb0-8884-a33a6b8db507", "comment": "Malware payload (Mirai)", "value": "8df2fc6f5728cda7d4b1aedccfba976272a021bc2052edf905a144b38a7f6204ab79f809a1018372dc372882aa80324e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329760, "uuid": "4eef44b6-4e1f-44db-b629-128a562bbae6", "value": "T102E3075AF8829F11D4D625BEFE5E928D331327ACE3EA7112DD245B2533CA91B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329760, "uuid": "5ede60fa-4feb-4192-9b08-c9538d2652d5", "value": "3072:xWcSqfDrwUw5MVosA11P5Fe9YpZsuR0930ndaPhGQCw18/Uf7YK6f7KInbp:xNSq7rtw5Maswn66suskndaPhGQCw1az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329760, "uuid": "f3cc51af-8786-4e38-8e37-0ad60cec88cd", "value": 157204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329760, "uuid": "64503f98-b01e-4d1a-adbf-5f08e6061991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329760, "uuid": "3a5e33e0-f7a6-4fa2-a6a3-51d075d02946", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b3e207-81d3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784288275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288275, "uuid": "3ae18335-c171-4d4e-b9f0-51cfb5c6e07b", "comment": "Malware payload", "value": "542ba4d8b33ff34e35db7d908e718629", "object_relation": "md5", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288275, "uuid": "a01c4ab2-7a40-44f6-b829-6b52c83ae33e", "comment": "Malware payload", "value": "b6085dfa30f84adb9096bc19a0d6f56acdcf277585d46b1198dd66b01083d66b", "object_relation": "sha256", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288275, "uuid": "8a392511-a820-476b-8f59-ecfe17952edb", "comment": "Malware payload", "value": "df87fc32fd39f1fa22f880ef5fe07f810b2b6fc0", "object_relation": "sha1", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288275, "uuid": "0c70b120-03b7-4c25-aa13-355b7e803349", "comment": "Malware payload", "value": "4722bd167df0b9f085807f4180e2a59342405d511a9e2980beb95c0b1e76ac4fe79404028ded77707ff465bf3732b9a6", "object_relation": "sha3-384", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288275, "uuid": "21b3f405-24d3-4bf6-ac58-1604c4b26852", "value": "T19B85C7A9B9F80071A7F95C14AC89A403D9FF7283392C59CD94D60716CB2308DED69B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288275, "uuid": "a61adbf8-596f-4289-922e-0d9724fc0b38", "value": "12288:BU224siqt4bWL7VEf8oBrRs476r+fFk8qokSQ/fvn853Y:h9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288275, "uuid": "9c692746-ab4f-48ae-b5bc-f4bdec822766", "value": 1818628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288275, "uuid": "6f719e73-d359-4349-8cd6-32947cc29267", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288275, "uuid": "864bbd18-c3d0-4f68-bdf9-449c129ff66b", "value": "Nuovo_ordine.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97005fec-81ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784270939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270939, "uuid": "121a7c2c-3c0c-4d1f-8fd1-9277d04e01dc", "comment": "Malware payload (ValleyRAT)", "value": "4f378fad0a9fe5cfa7323a1d1226a812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270939, "uuid": "1572bc07-69c0-48df-af0f-bccb1bba0520", "comment": "Malware payload (ValleyRAT)", "value": "b7259736c0581f5e2f80ef11f692ca773a13ac75cb6cdbe14182638eb902f0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270939, "uuid": "bd1c2c6a-853c-4ea2-91cb-efebf5f02d94", "comment": "Malware payload (ValleyRAT)", "value": "60af988041ac4814bd237dbaec3bff56e1357c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270939, "uuid": "65c59e57-4857-46f1-a497-5aabfe9aca48", "comment": "Malware payload (ValleyRAT)", "value": "92679529c6983e9d69ee169b58e5341e5eaea5849bf2269f769c878ee3a9e4204fae319a86b18c936387112a87469ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270939, "uuid": "c317d70e-edbc-4ca0-b738-2543520ea056", "value": "T1C3D63AFB61E5D2ADC01EC13AC2939F09D93FB0B90736C1E7529442A61E16CD46E7EE24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270939, "uuid": "8b893fca-428c-4cba-8e09-07d454740437", "value": "0fba73de092ecffc1c9d511645aea68f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270939, "uuid": "3c1754e2-83d4-4766-9018-5fab431e82be", "value": "98304:GwnDo/mx92IQZzEkjaVgUH4hBQwqh/qUS0mBf:lo/mxIIQikj4H4hywqh/K/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784270939, "uuid": "15ed6f50-e04b-4aba-94be-5178c4ee91e4", "value": 13732497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784270939, "uuid": "a2dfef79-9c4c-4c28-ae1b-12ee16475c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270939, "uuid": "c3d8e661-2fb5-4d53-96cf-f2eb406de0c4", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e003423c-81a4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268055, "uuid": "7d179f51-f05b-4e25-ba63-1bbf54e2f429", "comment": "Malware payload (Mirai)", "value": "260a0daedce669f016b184ba3276e7c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268055, "uuid": "fce1ab89-3f95-4a0d-8e88-b3c85cac61d6", "comment": "Malware payload (Mirai)", "value": "b73254619afafb76b68df14739b3cf1d70f24919901ac4d0dd704b1b5d6118e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268055, "uuid": "85940cf4-70cf-49c0-9b83-98adbb23f1a7", "comment": "Malware payload (Mirai)", "value": "3a3a1c9881051f100588216a5ed77c2103e3ad13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268055, "uuid": "8be5fc1d-097f-4716-852b-79623f222622", "comment": "Malware payload (Mirai)", "value": "a0e86f32d8fdac2de3bc42f8608fb830c0611e2b453555cb19eb685361c160bb21dc594736ac0c7303c080b46df4a250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268055, "uuid": "419c44e4-64a4-4e75-9449-ade7234cc2a5", "value": "T1EAB32A84B881A611C6C15EBBEE1F018D335657FCD7EB3322AD644FA07B8A91B8D36741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268055, "uuid": "35e8c240-e71e-4970-ab15-5ec822273e70", "value": "3072:fufdbVc8mpkQ3XJ0Vgh1i+S6zPOZ5XlEZwax:f+dbVcrkW6Vu1i+R6ZFOLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268055, "uuid": "0c686b9a-4ff5-4009-8ffb-6625228eb65d", "value": 108312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268055, "uuid": "af4ceba7-5032-487b-bf50-b58a40ceefc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268055, "uuid": "60bac254-7222-44f1-b6ff-d36c7289ebc8", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca1bd74-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250306, "uuid": "a3cc954c-170a-413f-92a0-be1cc2dd2af7", "comment": "Malware payload (Mirai)", "value": "e96d02c4e1795c83ad808f1e2ffac87c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250306, "uuid": "852d4270-ff7d-4541-8d14-7d0ac31dccb5", "comment": "Malware payload (Mirai)", "value": "b78a23549c477c5ebc564b25dd6871c6e1f1964302f5cbc4b5de190a8447319c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250306, "uuid": "a6484f07-a5d6-4359-8b0b-12a78371cb7d", "comment": "Malware payload (Mirai)", "value": "b0219308d2e4f4249eb2dd4eb4faabf914744abe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250306, "uuid": "50d978e6-0960-42e9-8a34-a38293588366", "comment": "Malware payload (Mirai)", "value": "335c857b29ef598d53ac3a4707959601b39a2f79b90365b973e339deed333404052ee634771367ef4675c47896c3c82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250306, "uuid": "fbccfaf7-d7d5-4df2-b1d8-caad3cd7a11a", "value": "T18143F11119016BEBC6E82C77B42F824997F71A7E9E3635702D207B79BAC560BB0B140F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250306, "uuid": "ee9a778c-44ef-489d-8ba7-1128c7b2a668", "value": "1536:MBRZXd83A0lYIQh/2hH1u7RIrNXJvacLfT:otOwGBPH16axXT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250306, "uuid": "4c1d2f9d-9b18-487f-8da3-1617a9d18f7f", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250306, "uuid": "bdaeaf5d-4bbe-4819-a0c4-88c8824d60a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250306, "uuid": "ba59822e-773a-484a-b286-a3b465e303f0", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e7470b-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311355, "uuid": "936377a9-ec86-447f-a1cd-d1ee4ad87486", "comment": "Malware payload (Mirai)", "value": "1174f689a2761c68106b7d40153a7ab5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311355, "uuid": "1b5b2029-6e6f-4e0e-9d4f-f270f8486ee3", "comment": "Malware payload (Mirai)", "value": "b816e1d5ca34442dc212587c8b5816117b3199f53ead3c38cdb41a0078732807", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311355, "uuid": "1dddcd1b-0131-4813-84e6-c7eed1611b4e", "comment": "Malware payload (Mirai)", "value": "afd991599620d3f643ffd27d54f22a4580cae5eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311355, "uuid": "03414e9b-1d8f-4816-834c-73a7afe631bb", "comment": "Malware payload (Mirai)", "value": "09b56b0ecae9d730859688418065e13102b93b91ad365ec26a71a1d8d0f432e324519c67fdf957839e3a9649825702b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311355, "uuid": "3bfb0fab-e26a-4f4a-a770-d049022f7bb7", "value": "T165730249AC5ECC92E7D28D7A4183CBC78473F919FA1DEEA60B44E0162A49E83C56F070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311355, "uuid": "dd27a58e-5fcd-43d9-a53a-09f8a7b0ed2f", "value": "1536:GU/Xo2UIQgtlQAhJAg995PWLLnKmyJI5y+qyEgoZmUeeMWv2DSQru:JQ2UIJlFhH5uLLnD5ydCXUe6OS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311355, "uuid": "378851d7-4bd8-46fb-b58e-0fef554a1a5f", "value": 79284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311355, "uuid": "ffbff2b2-cd2d-44ae-b985-23476cf52318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311355, "uuid": "18d8ba7b-0fcd-4a6f-a940-136fa434f5d6", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc062f4-8179-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784249449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249449, "uuid": "21d8269f-5ecd-4302-bd09-e67a3e7dac2f", "comment": "Malware payload", "value": "e1ae2b07de3f11dc13cef996d3f93e19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249449, "uuid": "090f05e6-083c-43e5-9c38-5e2b2d8bf03e", "comment": "Malware payload", "value": "b81bda693566e7b4964f843c8d59e28cb75bc4d43faacbec6f0ef960040ee16d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249449, "uuid": "3df26b43-29c0-44a1-8e4e-ad242023a6ec", "comment": "Malware payload", "value": "b13c60e824fb8901a8ccbd64cd0afcd2d961c5c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249449, "uuid": "44954087-bcf9-425f-91f9-f3ec32fecf2c", "comment": "Malware payload", "value": "0cac41e7acba73f21a1e4ee0c42af13f740232ebc83962d45fe5af6c71c74f163b9e14f89927c9a9939a8c5afac965d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249449, "uuid": "9ecc3df2-4426-443f-a413-19683ac37cd5", "value": "T125D097B27A2302BC60321A99F2CBA860B0124B3F8D92812E7013A0305F8070EF0C03E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249449, "uuid": "12b1256a-e255-4975-89bf-aeec34d4c6a5", "value": "6:hTuigNsQCyTiKRFUycbAulNXYq4HvXDG+NjVsNXYrkJ:VuMvurcbPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249449, "uuid": "07ad53c2-b736-42a9-b005-2f107870f134", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249449, "uuid": "abf18b50-3269-4626-a437-c3e2107dc9c2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249449, "uuid": "b8aabfc6-06f9-4690-9eaf-d6ba4168a9ee", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece26ad1-820f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784314033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314033, "uuid": "c894f39a-d4ec-4f6a-8efa-30cd6aecf4eb", "comment": "Malware payload (Mirai)", "value": "a7d9b3f928a5bc7f4e8678a939a0079d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314033, "uuid": "6acb8980-49a1-45c0-8be5-1ceae3d15d2d", "comment": "Malware payload (Mirai)", "value": "b8c892f6fc9989c499e15ed02b7ee0310146f63ebce40c79cb4a7290cd9d3ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314033, "uuid": "c1706972-6de5-4541-836c-3e568f5bae0a", "comment": "Malware payload (Mirai)", "value": "acf024645075d1a5593a3bf077b4b0e2982276c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314033, "uuid": "baee4942-5b6c-4d9d-bd9a-5ac153340d3e", "comment": "Malware payload (Mirai)", "value": "6b7fee2b2411f118ff7fbe3908caa77f2aeb0e948ba8cf979061af0312c51f36c0ef90f42b447791a2518e0c1af8b3dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314033, "uuid": "dfa076cd-3663-4a2e-9df2-11c7fea10cb5", "value": "T1B8C32B99FC90DE52C6D52679FA5E128C332353B8C3DA7106CD209F3477EBD5A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314033, "uuid": "02c14add-d3aa-46ad-b790-1f0ec75acb31", "value": "3072:Bc9mMYnhxeOo1iJKHUQ4g8OFCqFEAV6OLx78mxk3f1Dlh:Bc8Xn7evHUQ4g8OgqFEKx78wk395h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314033, "uuid": "69cf7ba8-49a5-496b-8e9e-ec33e68ef31e", "value": 124356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314033, "uuid": "ed0dff8c-181b-4e22-9203-fcf6d0c45211", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314033, "uuid": "bab2befa-4939-4517-9c31-24ca68f86de9", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed81c86e-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267219, "uuid": "a1cad748-c550-4c01-8bf4-aefc5c1f7cf4", "comment": "Malware payload (Mirai)", "value": "6346b391af650692df4992b3cf869918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267219, "uuid": "bdd8deec-83a4-4ea2-9d2d-85e80e00ebcf", "comment": "Malware payload (Mirai)", "value": "b9cacf8b82df1ac6c89e696e8b45b8b8ba5cee7ae6be068e22087a9ab1f6086c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267219, "uuid": "c37169dc-b82b-40d5-9584-03f1c8165102", "comment": "Malware payload (Mirai)", "value": "4c68324d88037aaa2c174ee0238948606e3b6176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267219, "uuid": "3a0c7047-8ca2-4a33-8b09-2731a75e8b0f", "comment": "Malware payload (Mirai)", "value": "fa27adaabdabaca4c2a648a3642b252bfc74ebfecfe7d660b2c5a7a5212350a059adfd0f5ae4dc23fd59e8713826b650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267219, "uuid": "44d29ff0-505d-4894-91c4-53c2b05e3a50", "value": "T19FB34AD6F401DD7DFC0ED77F4453050ABA21A36216835F37635BFA63AD320A86926E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267219, "uuid": "960d9ed3-4626-400a-81ce-7f4a141461c3", "value": "1536:6Lxd4q1r4dSpzFtjMy4HPZo0dK8FhBipZ9j07HRc/XLWNvESM9Sr48:4xdxeItjj4Hho0dnBit0NK9SM9a48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267219, "uuid": "acdde21f-6515-4b0c-96a5-95ace40cdc19", "value": 114960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267219, "uuid": "55376e79-8403-47d2-ae68-d37e1799edb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267219, "uuid": "5ab05f8f-81de-47e9-8f64-c6db28c4cf83", "value": "nerv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfcccbb-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278679, "uuid": "9e6e9940-237d-4dc7-9eff-91f209b6ce3e", "comment": "Malware payload (SilentNet)", "value": "e51540068a634a559713e2c62666935c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278679, "uuid": "d79958cb-844c-4e22-8a1c-40e75e2d40b9", "comment": "Malware payload (SilentNet)", "value": "ba0847586f71982c999dbd4f2555b4231a32d497cc3a1e9c57900913c7c3cc4a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278679, "uuid": "d652f786-a2cc-4004-b90d-405e8a1b8ba4", "comment": "Malware payload (SilentNet)", "value": "7738d062925bfe2bebee389d5446afcb01f1ced6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278679, "uuid": "82c51e2b-ea14-44c5-a53b-99edfac9e8ca", "comment": "Malware payload (SilentNet)", "value": "c8811c331bcff25cfd5139c46917060bf266accd0209b0d414ee4a53756886e058acba748c1a57ced3083228b90e1a20", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278679, "uuid": "ac7a89cb-186d-4e0d-8f44-bca056b05d2b", "value": "T181E4231F7F9EF425CC76EE70BD2B6AC7A1948F58E4A12296C337CB48CA49B04E1045C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278679, "uuid": "e46db3a9-a44d-4bcd-9ed6-e7fd29004a0d", "value": "12288:g0aPDeLSVQJqjjc7AGT2q4ueYNxFdcOcozc+HexJwVnsHdEhZ3BUAJbGHbMOwauQ:g0hQX477TN9eYjvcO7rHexJwVn+YZRU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278679, "uuid": "2bad6d5c-05db-4cac-9a5d-ee64512ea9e7", "value": 676872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278679, "uuid": "7c4b5283-f4d6-4c99-847c-fc420faad8e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278679, "uuid": "8d52c019-6076-436a-ac5c-154c63a03f75", "value": "kryptonplus.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c18620-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311370, "uuid": "b515cfab-bf2f-435d-9b91-db877ad8af9d", "comment": "Malware payload (Mirai)", "value": "b94864db802e2db2e7b8ac17cb3867de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311370, "uuid": "b0e94910-2de4-4e3e-a9bc-9fe537f8a9e4", "comment": "Malware payload (Mirai)", "value": "ba73d6fe274be680ea143769cb59db2fb7570770b10310c1f8925fc57f7720b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311370, "uuid": "81b0da67-8479-4a6e-a7c5-15b9a341c9bb", "comment": "Malware payload (Mirai)", "value": "c16daa2d6f1400cb7dcdaccd6477420bbd3e1ede", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311370, "uuid": "0e2571c7-8204-4b3b-8dcf-fd415f2b606a", "comment": "Malware payload (Mirai)", "value": "d781b100939427d3f363c63495e7db8661381503f8e12f09fff29c27194f5e167797cf2e2b3d3b5602453e17d99d175c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311370, "uuid": "18519518-9392-4398-a561-811b296c085b", "value": "T1A3434A2250BC2F07C1D0B63B12778792B2A53F5E2A949B4EBD660E4FEF31254492B1F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311370, "uuid": "ea3b7979-2d9c-48c9-a659-9100db9bfd1b", "value": "1536:XT6xpeCxq1VowrFd2oaRrpRgcey2NOh/ex1NWIU:DGzpGcsOVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311370, "uuid": "47964f36-778b-449e-8d26-4901152d86c8", "value": 59592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311370, "uuid": "a2421609-79b9-4834-8fd2-5639cd3d2177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311370, "uuid": "78a0a3bb-96b4-4f00-b627-58f3b6c37ae7", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92dbe9a-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311477, "uuid": "e35bfc1a-fa48-4cc7-a289-6f1f45da78c4", "comment": "Malware payload (Mirai)", "value": "3b274f64242559e9b49b704fccedbe2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311477, "uuid": "66ae5f6b-bdc9-4c72-abf8-fd22b371fe9b", "comment": "Malware payload (Mirai)", "value": "bc258ae280c48b1f79932e92607c00e8f6777ebcc462a2704581866fbcd230b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311477, "uuid": "4955abcf-f458-4aef-b503-ae84f4c1df8c", "comment": "Malware payload (Mirai)", "value": "d8a7b9e2edd3c1818cceec3b34d16a9df7778f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311477, "uuid": "6274e6dc-f91e-4aa4-a6a0-a7e273374ebb", "comment": "Malware payload (Mirai)", "value": "a7e666c92f1530ac7273dcf0f9108549d654ba4d8d3dd516b01fe944ec50dac41c70373d4b4b876c38fcd72c5c4bf59b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311477, "uuid": "1949fc49-e103-47ba-984c-f667f2d4d441", "value": "T1A7E31845BC905E17CAD512BBFB9E42CD372617A9D2EF72078C116F21378685B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311477, "uuid": "e67d4494-167f-4b28-a8cf-b8597cbffdc8", "value": "1536:a8MDIcqplUPaKcOqEw9aZE7lrS+tmtRRBx0AO0nFUawc9nr9+y4VR57m5PVLxk2x:a8MD4tmV0r6Sawc9x4Vy5PXEDL8jlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311477, "uuid": "3a37b8d9-9eb9-49ee-80f7-2e65fe6c02cc", "value": 148620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311477, "uuid": "f3547644-ae96-4d96-8833-d34242724c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311477, "uuid": "a3190187-2f5f-4ada-9c5e-05fb11f7403e", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4c7ed2-820f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784313955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313955, "uuid": "9e3ab96c-acc0-430b-9cd2-a56ceef9c351", "comment": "Malware payload (Mirai)", "value": "477bd804d4b82da1e2d9d5bc41e0a8ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313955, "uuid": "676562bc-011f-44b0-beb0-4904b33724f4", "comment": "Malware payload (Mirai)", "value": "bc658eaff9e085c43280052034ea30014908e54946c8f9b3a820cb97fe4c9430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313955, "uuid": "ccd458d4-9c62-434e-8bba-24de6d7f6079", "comment": "Malware payload (Mirai)", "value": "b3b2e9e37158f904f2f65b7c7f9f4e57f6306604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313955, "uuid": "5d2e91ea-65cf-465c-8945-71741a6d940f", "comment": "Malware payload (Mirai)", "value": "760b1bbc1fddc6b7293d9441ef478f0b46c2ffa39788292098c02c8680155d10e6b6b2bb214501c8b570c275f6c3ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313955, "uuid": "062e6f20-6293-471d-9e15-9201cb9032ec", "value": "T10F3302D2CC493494C12199B8DC6EA354F54BD479B1EEB50BD158FDD8EBD362A38F800A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313955, "uuid": "5f8d96e5-d728-4900-a956-212fcf505995", "value": "768:WbsmrDRxYO62x6WMWGoEhGJIRATUzC3TsmiqUTpJN1nUmS4mKDamo3U03wfZo:ism/RlXMSE8KRATFTWqKJcR4mKWmFfZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313955, "uuid": "ca5c5879-8b3b-4e48-b8d6-c50f44554616", "value": 53780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313955, "uuid": "594c9cf5-57f3-41f5-9865-8154de14e9c8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313955, "uuid": "98f326ec-4809-48e0-8e40-5d0f205c0b2f", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa789e3-81ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784271732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271732, "uuid": "65f8be53-2fb8-442e-bc5e-6b58585bb8ce", "comment": "Malware payload (Gafgyt)", "value": "0ffe1b3cf989628b969ffd9e6ab73693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271732, "uuid": "342a1aa6-f05b-4c2f-bd9b-648855b520b6", "comment": "Malware payload (Gafgyt)", "value": "bcd7a4b61c333630c1adc26d5f55b296c5446d96c868875c30a9ffd6cdca023b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271732, "uuid": "bdeb35e0-7d57-435f-9f50-a1150c0609d7", "comment": "Malware payload (Gafgyt)", "value": "fbe860ec7a89b5e65b594f9abe03d04e3396e280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271732, "uuid": "7cbb6473-51b6-4753-8e6d-be947dccc139", "comment": "Malware payload (Gafgyt)", "value": "96ecbcdb16f987be38156e082aba82f6b3d4b70c8fbda19f545ff45e9b646e22097fd3835c1dd576615bf965d5a963bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271732, "uuid": "b7a993d9-6169-42c6-8775-c614a9aaa905", "value": "T13EB31851BC825612C6D612BBFA6E418E376623A8D3EF3213CD255F203BC791B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271732, "uuid": "1b6c3fa5-97df-4597-9b97-3ecd7fd6b9d7", "value": "1536:bjcuL8lzTm/NWSGmQAf3ilNUsdnS3qF4h7Fo1YW7avLKT8nl5t1e1rmgvl6DAJaI:bjcKamISANUsdnS3qWJnWMLc8nlhnj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271732, "uuid": "5fa9bc91-7d30-41d2-b392-d275e4f60d3a", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271732, "uuid": "0c46656e-ded2-4004-ae8a-c2abf0349590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271732, "uuid": "fd2f63cc-807f-4c48-ad09-d6033b281d15", "value": "nerv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11cc574-81d3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784288270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288270, "uuid": "5c941976-30cf-4939-a258-1926e963ca14", "comment": "Malware payload", "value": "4e8e2eb77954f05949bde0fc694d1b87", "object_relation": "md5", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288270, "uuid": "e0394040-b91b-49bb-87a4-299637f17425", "comment": "Malware payload", "value": "be1441938aeefc277ece18411075de78bf5d6be23c3d64cc676050728b31deaf", "object_relation": "sha256", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288270, "uuid": "dd2fa8f5-f2b5-4f69-863f-0d2f36e4fc86", "comment": "Malware payload", "value": "202b131884e94532d2712d8d4cb686194adabee7", "object_relation": "sha1", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784288270, "uuid": "b3be4809-b23d-42a5-a174-7c7a4ed00377", "comment": "Malware payload", "value": "d869855dbe42b938e91273794a438b24201e571072a1449ed1be458fed5c6d7f7588048185b5849175bdf815bbecd47f", "object_relation": "sha3-384", "Tag": [ { "name": "galdum-ro", "colour": "#B52181", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288270, "uuid": "cb332c69-78d7-4ca1-bdbd-625020f7a893", "value": "T18054237B2CCF4B6A8348617B959CA841E5F7B84D40F58FE253908D7B2157AFBDB00909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288270, "uuid": "2e49b734-e1a0-478d-98bb-31cf0c1d2946", "value": "6144:yCk4KM7Fn/jJpEEtFq560Rbcs2JZP7Zs6DjfRxmutcJuLjq:yd4KMh/bEEegssFs6/9tOuLjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784288270, "uuid": "d89e7da9-ee4b-4040-bfea-8f61b5f5bd64", "value": 296315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784288270, "uuid": "d6882565-827e-49b9-bdba-da3eeffb8ddb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784288270, "uuid": "617ae440-cd3f-482c-aa59-c998675bdfe1", "value": "Nuovo_ordine.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc4f27-822e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784327272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "c64e89f9-800d-4569-a26a-280ccec2a56d", "comment": "Malware payload", "value": "1cf6c17d13156ec830da6ed2b0932873", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "48e1d81f-fc92-4533-8776-6cae73dd7a11", "comment": "Malware payload", "value": "bf2d153b1b6ac1dfb076c520195b283d9c353117005ef849ac146d98ec886192", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "19547eb9-36c1-48ef-9340-e2bf70659494", "comment": "Malware payload", "value": "9dd9b2b1829612213cbe3a7cd67c34d648e74d69", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "52d3248b-a247-41db-a0d5-279424dd1d05", "comment": "Malware payload", "value": "34ea6c116e5e74d3daf5dcc39e3b48359e2e865e03fe0e19b138838954ff5f1267cc227fbddbfae21d88d84d94a1f758", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "cbd17c8c-5a41-4032-ba8c-8708cd48cf9d", "value": "T179E501577F14D902D0564E319970CBF86721FC488B29838739D6BE6BBDEE6D28E022D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "05cab671-7b2f-40e2-ac2b-9e85a63bb366", "value": "d7cddda1d2ea4ee1d634f7b65dfe4a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "d70bab04-2239-4719-ad09-1bbf4b18d019", "value": "98304:PEX6JnJekZHtuD0TJbTKi4M9YgyFen+bQGratLiBJ:MX+Jze01Ki4Ne+QZiBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784327272, "uuid": "40383aa6-7a1f-45b1-b9b8-6311f0d108f6", "value": 3235872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784327272, "uuid": "56805fc1-90e5-4d54-8f32-3a118514cf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "1f81cbf4-8afa-49c5-8669-f555c8e13cd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccb6ee5-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272238, "uuid": "fea06699-640c-42e0-acc6-a3abe3c9dc47", "comment": "Malware payload (Mirai)", "value": "9f9975e322571c296832b1c8c5554db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272238, "uuid": "f9f5e317-7f2c-45fc-b75c-10336f7b454c", "comment": "Malware payload (Mirai)", "value": "bfabc6d084d58a9321267caf03d634d288099fba68a642de437fa9a0c3ee323d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272238, "uuid": "45e250c8-770d-491c-acfd-9474dc1ab7c2", "comment": "Malware payload (Mirai)", "value": "2dd2123e27920e29df2ca97c17c202f66eb5fb91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272238, "uuid": "dcc02dd4-ea6a-4526-a818-c2a47b5d9b51", "comment": "Malware payload (Mirai)", "value": "ac83a4ce15802374aba28e94fd3bae6b6f231ec95da41da6cba81154ff2eb39f9be2eaee7e507ce021035b224bc050a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272238, "uuid": "39b1294f-ab9b-459c-8a4b-557e4affe318", "value": "T112E32C56E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272238, "uuid": "9d0407fa-0c85-41ae-8356-6eae2ebf773c", "value": "3072:U+UgNWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UrIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272238, "uuid": "cb66bd35-62ee-40e4-a03a-0b315b4b7958", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272238, "uuid": "f359b152-6a17-4210-90ba-d976c15b54c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272238, "uuid": "f29f2467-c966-4e0b-848f-f0fe5ea16142", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bac573-81df-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784293024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293024, "uuid": "833f38c2-d90d-4323-abd6-d7e5927b0a6b", "comment": "Malware payload", "value": "1dcbfd1f202f01be6964f2b4de90e556", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293024, "uuid": "f9ce2ed6-fab3-49c0-a424-576023e11352", "comment": "Malware payload", "value": "c00613db93a95e51bded7f17d61447f9e5ac45fa55a7fdfd9ce7b4a825ed74b5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293024, "uuid": "67735b4f-2d49-4f66-92ff-86f3c3fb8cc2", "comment": "Malware payload", "value": "5702e1a360a8ea62df482dd29bb667352ac2bf21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784293024, "uuid": "e97d77b5-e3c4-4570-85c0-eb05d689d32b", "comment": "Malware payload", "value": "51f3aa916132a1c1b3b37c5285bed4a6f850e99fd84b2251d1742b18278938f7151cf7481d862154c2a56d70f351c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293024, "uuid": "dbb1c090-8b48-48d7-9f03-4ff6d96ac3f8", "value": "T1ADD02EA3A1A3093810A2AC22E9C26860B0106E7E6C55CB4D316B28303F8120CF5C13A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293024, "uuid": "cdbb08c6-7749-4a42-8ccd-175f375cacb7", "value": "6:hTcTRDaTm1uwqH/rWIHUpAulNXYq4HvXDG+NjVsNXYrkJ:VcFD+mcwqH/rWAUpPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784293024, "uuid": "407d9d73-b23d-42cf-a982-72aebf8023a0", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784293024, "uuid": "78a0c87e-f843-4dc1-886f-ba4c5bb228ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784293024, "uuid": "da26a4fa-4e9f-43e2-a056-d5a9bebf3132", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6980f08a-81b4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784274728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274728, "uuid": "bfb39ffe-df44-460f-b89d-e7aa8c951b79", "comment": "Malware payload (Efimer)", "value": "07a29d1efb99724d4001cfe39e7adf2a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274728, "uuid": "53d56d92-658d-402a-93c9-75c7c83fc890", "comment": "Malware payload (Efimer)", "value": "c018201e421db5830428b892ce9f57d94733fbd93c2bcc2a2fb49a1c28f6d60c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274728, "uuid": "fb931f76-24c9-45e2-acb3-cb03bf5e1dd7", "comment": "Malware payload (Efimer)", "value": "0868bcfdc38df5edd8d0ea1f5331350e3c1b4ba4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274728, "uuid": "0becd9b9-b249-4fa0-bd1f-f68500f1faff", "comment": "Malware payload (Efimer)", "value": "cce9de7f0df1c5f3cf8b6ae4ffc46297eda94b09f399280a372e9381d8ed0df98d298fee0e03ae63cd81a3e2f7825013", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274728, "uuid": "97c5a477-ae67-4a50-b650-e8d3ea446617", "value": "T162E63308BAE153EFE6B3803C9DF266A5F06A30A60772C8C7576583906E570F09D7DB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274728, "uuid": "e3c79c08-104f-4827-8d95-d5dd98ebedc5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274728, "uuid": "bd09d8d1-add4-44eb-964b-afbc8ba70f45", "value": "393216:ywcB7tS+kOyx36y8rh8FIEXMCHWUjX3cuI3/PGTAI:HcB78+kOyx3euFdXMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274728, "uuid": "18feaf47-dceb-4228-8fa5-6fca46637db7", "value": 14308939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274728, "uuid": "b8203cb3-8f0b-4869-bc56-de4696439a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274728, "uuid": "0bb3236e-061a-488b-b302-c55f767b8f83", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f08a64-8210-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784314471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314471, "uuid": "58f58036-87b6-43a9-b263-2bbdf0c6131c", "comment": "Malware payload (Vidar)", "value": "057739a12fa0d25a1017e5f7a8538140", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314471, "uuid": "d17bb959-e44d-4c21-b802-4774b95573d3", "comment": "Malware payload (Vidar)", "value": "c13be88a14d2c50b4e5ebca6b490fd6b8a6982555051c58b1d45fef6011671ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314471, "uuid": "d35e450a-f833-4841-aa65-63068b3a0482", "comment": "Malware payload (Vidar)", "value": "3dd7b3bbb0dcfe89e1a3ff1c1b0abcd5371b706e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314471, "uuid": "4768c6aa-3049-4281-97b5-8e54be31d438", "comment": "Malware payload (Vidar)", "value": "6786da15b0aaf630bbc9ea6473f2ef9ed67ea84665f2d4490a2cad426b2d5dcacd2075b309b81fcc7f8d52c3e6ec6112", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314471, "uuid": "ddfee35c-894a-49da-879b-6c5e0aa648a2", "value": "T11975D922B2D0AB7CDC2558F30F979B74C372760E715359E818BE1F04A92B5A26B127DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314471, "uuid": "12e50009-6bde-4f63-a6b3-465d0c2a1244", "value": "314d410bef1e80ee695ecc184f2190cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314471, "uuid": "5a1b7810-51ff-4e1e-abaa-79b44ddfa351", "value": "24576:GwuiEs69CpHDtGeqIKCaKSStmYowH1E0Dt2/oVVQI:Rv69CpjtGIKCaKSStmYFVE0B2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314471, "uuid": "7aca97ee-25c6-4a13-b2b4-c90149e16be9", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314471, "uuid": "e5cb21d2-ab4f-490a-acba-f3d6ed14699d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314471, "uuid": "5279b8d3-dd4a-450a-84ef-2492659feef0", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9fc937-822e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784327272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "479ae53e-7d85-45eb-a59d-7ff172c5544d", "comment": "Malware payload", "value": "be1ff2fa3b9c4dbb64edf967b201decb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "7a79ba5c-b18f-4b7e-b1cc-1dabca539320", "comment": "Malware payload", "value": "c16785a165adcc885acca91f57c25090ee781705248ba535d889a135cc276b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "f6516e56-74cb-47ec-b72c-15bf01c71929", "comment": "Malware payload", "value": "cd3c097fac9161d1d6eca90fc093a4f54f5e91c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784327272, "uuid": "fbb9340c-845c-4efe-8cf7-5f90e0a88a91", "comment": "Malware payload", "value": "e6b55184266371f23ac2f5711c80c0c6461c8c4c99788dbc6836743d0fdf36dc5da2edcdd665c025fdbb7446a7614546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "18b6e3e5-229d-4441-b46f-4398c9bd7a99", "value": "T1B772C58AB29764FDC956C17CD2DB8B72F1B1BC4206397E3B4250D2B51D71D9B612C813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "109c02d4-cacb-4abb-b6df-38f001520f66", "value": "d4af7c7127d0ce8764c777abc0e921ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "6343ca62-09e1-499c-9988-d8ea8128e9a3", "value": "192:nSfS96haJyylGrg6h5RuuC43hyUlDSHN8SzKOx+8Ce6FMM+0CU0CZ3ktcu:h6cz+DevM5lDSx30Re6xtCvCZ3kyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784327272, "uuid": "94a9e0cd-de47-4453-99f7-55ccf664ff85", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784327272, "uuid": "296d04d3-217c-48f6-97cc-2b4add9863bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784327272, "uuid": "fa93a397-d930-41a0-84ea-17d1077ac715", "value": "abe_extractor_amd64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bd0f88-823b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784332776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332776, "uuid": "172dfb9c-4c89-4665-a2df-798af356fdf4", "comment": "Malware payload", "value": "706896c05dcea348215278389689beb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332776, "uuid": "c189d0a2-d88f-4b68-b23c-ad918b9e2577", "comment": "Malware payload", "value": "c1dd7a5673962d108ec8d1b12b50604a134cc52cc95de6c3bbf680198e8f9cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332776, "uuid": "251388a4-0d52-4c50-9793-f56c5d9de3b0", "comment": "Malware payload", "value": "f37c3668c8fbbc7ab69e31f9fc9cc929c26a2a1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332776, "uuid": "e0bd1e9a-4f41-4e26-9580-0a473a952da6", "comment": "Malware payload", "value": "d76be9e9729440a05efa1988532f12ac35efcb97eaa8b8b217098382bc2841f19e00dee68ba653be7612e0574552d97a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332776, "uuid": "84c6b778-a302-4e59-8470-4f1ca1f956fd", "value": "T1D9C33BC0F98B81F6C40B88305166F73FDB7198A95123DA9DEF999F72DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332776, "uuid": "247169f7-6b38-49aa-9664-245046a5a062", "value": "3072:6FjlzYNVoZXRgn4c30tItERjnDBBMesWrhK8HR:mYNVoZhkD3OItYzDjw8HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332776, "uuid": "1d5b0b98-2c65-4bc2-be9a-50a424fe63fa", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332776, "uuid": "4f340530-9de1-488a-995b-286e4ac70e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332776, "uuid": "2a57f945-eb43-4c8c-a7c5-5d65614526c8", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c0bc0-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278647, "uuid": "16760f81-ec2b-4089-a667-048a8f93f07f", "comment": "Malware payload (SilentNet)", "value": "888376744d55d6fbdd16343d4b91e329", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278647, "uuid": "799814e0-6728-4da4-968e-095040ddc307", "comment": "Malware payload (SilentNet)", "value": "c204724b335507a2d8e60d39f608163eed67ea0c8f1880933943c9c471ec02c7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278647, "uuid": "3e1b10ac-17e5-42e0-8f12-4dabf064c0eb", "comment": "Malware payload (SilentNet)", "value": "ef1fcd404abd4e72291e7d73346bb39d9229fa3f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278647, "uuid": "91ddacda-47ad-43ba-8c38-2816f315c3e5", "comment": "Malware payload (SilentNet)", "value": "3122b3affb4ba6571c6b8d4d492cf3bc7ad39a752e9804f69617b0dc4781504a74ea858cad46bcf6b7ce03e071f8b56d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278647, "uuid": "ff038aba-6e5f-41f4-8b25-b1e01f74f9d1", "value": "T141E312707825D4DAE143B97BDEA4C9D721318AFF010EB0C75EE7047A1E17A72A92138E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278647, "uuid": "b6eb72cf-3ebc-40ec-83c4-50dc2d62ecf3", "value": "3072:zMhCwpriv9BV1Kc//5L4M/kQiK8L0FBvTizv02pSNejOvJDsQ5pRpnE3//:zKbSVpV4M/lP8w77oFpSNejQDsQ1pE3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278647, "uuid": "bcb4afff-75a5-4d5c-8f62-f13ec3f3e020", "value": 152649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278647, "uuid": "312a944a-f34d-4940-bd83-6b2e52960fd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278647, "uuid": "9a007842-7303-463e-8833-c8eee90f23b0", "value": "AutoRelog.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306641d7-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784311140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311140, "uuid": "e1e26ace-8b8e-43fb-b996-912f5c14157f", "comment": "Malware payload", "value": "b9c703fbb310d41773da60ac63a6c6cf", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311140, "uuid": "a801c4ca-ab5c-4e8b-be74-7e8620df2eae", "comment": "Malware payload", "value": "c32a4601f0957e80a1fc980352adbb059d7d3014c614a2f8e72c3b212739739e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311140, "uuid": "5d19c61e-bf6a-4513-a873-2e1c52817a62", "comment": "Malware payload", "value": "4ced50674f8053e85ed2dc5bf01c4beecb851fc7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311140, "uuid": "72c69531-ba63-47b5-85da-e788c3f2211e", "comment": "Malware payload", "value": "1e3bc8274a8373a31be7123cdc67db75fd1a780e423e0a0386074b69f82bd4a80cc26dc039bd77d9f998c12885fa61b2", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311140, "uuid": "27de2b0d-6d45-414f-a841-c7eefd1b10f4", "value": "T19B572970D251E065D19F8430CAF54EF7A0A130375236691E1BC5D81AE7EAE60BBED3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311140, "uuid": "9f395aad-8fa4-477f-ac02-e54c6866c439", "value": "52fc4cd1f0148f6789c566674a94e859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311140, "uuid": "57eb8193-293c-46b3-9b04-a9c9391a363d", "value": "49152:l8ssdYOohI2pVARJ+PxGAFI2VR9MZBlpx0owbHB3jR+0IPUnScJFL19NKgTI3bu9:CmySrIUhiPS23r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311140, "uuid": "1b7c94fb-6b91-4904-9c66-97168df454cc", "value": 28620288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311140, "uuid": "9d371522-33fd-4838-abdc-b06e67a00df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311140, "uuid": "cae09e5e-2af9-4131-be50-ed1ef7d042e4", "value": "DivX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b3750-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325137, "uuid": "0f46358e-8cae-4fd8-8330-79beb7b65995", "comment": "Malware payload (Mirai)", "value": "4fa1ea85226ab09d2247a74818bb0f01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325137, "uuid": "d982ce9b-a91f-4c3e-a90a-f2b3771339be", "comment": "Malware payload (Mirai)", "value": "c33db627edc37d12f0cce98bb33b496b82a1b2a8cbc5e7be6aa3b75b96d0ce69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325137, "uuid": "7f601cfb-c206-416b-a000-9c81c660e41b", "comment": "Malware payload (Mirai)", "value": "299650d0c3720a882e1ff52d9b8a3204f3bdb424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325137, "uuid": "7426acf7-c6bc-4a2d-b5d6-23eba533732b", "comment": "Malware payload (Mirai)", "value": "52e33926d40bc77a685a4a2286c213c7838bd5d43cda6eb32fb313243001671cd6e9b28244bc398e36456c1d2cb0c825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325137, "uuid": "a29856eb-f825-48b9-98aa-846867526af6", "value": "T1F2F2E1F15AD66820FE71A078EA79CF4853D357ECCDE626B216300A14571B218E8FCD66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325137, "uuid": "498200bd-b788-4d66-b02d-f7979bf49d07", "value": "768:q/C2uS8lsCkrqWvtdMv86gyirEVeEFVI+hHBi0t0bJsPxiUs3Uoz4:q/mS8l7KOEXSeEFLzi0SGZixz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325137, "uuid": "6a57b36f-091b-4bab-8766-3fb2701e07eb", "value": 35632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325137, "uuid": "307e4bb8-58ae-4597-9bc5-849820d81f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325137, "uuid": "d0f9deb9-5cd1-40a2-a24a-c1b9aaac95ce", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35793ed1-81a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1784268199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268199, "uuid": "c4884a9c-bdcd-4ba3-b2bc-63edbfcdf2e8", "comment": "Malware payload (SnakeKeylogger)", "value": "622ccff40973d7099893300bfcecc434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268199, "uuid": "b60266dd-6dec-48c9-8733-e555cab80537", "comment": "Malware payload (SnakeKeylogger)", "value": "c363e567a04e86db78f38568d6aad75186719deac66459276dbba3c458151e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268199, "uuid": "00e13b16-4b0e-45a3-b29b-fe7995bb2764", "comment": "Malware payload (SnakeKeylogger)", "value": "422ed40f7fdf3aab4f63ed2aec22a9fa8038d7fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268199, "uuid": "2d9f1bd7-8f1d-4b8a-b5ce-85a6a2c2f5cc", "comment": "Malware payload (SnakeKeylogger)", "value": "10896e959583e39f8910012466903e16b0d802eb00abf5be8d5748e650f430aae868be670fb8584c7651f2be6a76cb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268199, "uuid": "3910c51a-6000-47fc-a07c-cd2789fc9a4c", "value": "T153E312027B5CDB3BCF7E07BAA45046DA47B04E7A4C19C6DC9EC1A08FBE17F814911996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268199, "uuid": "63953763-35da-48bf-b59e-9021b43693fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268199, "uuid": "aa041434-75dc-4671-baf9-40986758baad", "value": "1536:rdz8UporgYj1ZIigeH9ml+M/4TBHM9Kl+U4EJ3YWW0zjqY70fVvvtBTnDqhR80Ou:rdz8UporgqIigeQgu03YMfgL7T49BsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268199, "uuid": "78644a62-11df-40fc-837d-8119b879758f", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268199, "uuid": "b0d895a7-951c-406d-8950-d38762778746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268199, "uuid": "e65a1f7f-80d9-4ae1-8cc6-cc61cb0da929", "value": "HG9765445678900.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aadb77-81af-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272469, "uuid": "2aeb7a44-c47e-437c-a37e-492cac1b510e", "comment": "Malware payload (Mirai)", "value": "d07e6d480ff58938a9441f7f2f96f817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272469, "uuid": "bf913707-e516-4fa4-8bd2-f4df338f938c", "comment": "Malware payload (Mirai)", "value": "c41bc8bad9933edaba91f47c426ea7fdb2f1a7d1ee58b488f000e698d1b217d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272469, "uuid": "dfeeb797-86aa-4442-bcba-8392ca4d4f7c", "comment": "Malware payload (Mirai)", "value": "f62c7926c1d121749498e3a137126db2f6ae0e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272469, "uuid": "c8a4267a-894b-4843-8ff9-4fa0bb49bdd0", "comment": "Malware payload (Mirai)", "value": "f57e037bd837fd1ec67ca7de7f0a472e156bb05ec08c9bff974441ebcffe18852d173e14b8ba3bd342fe43a6b2346438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272469, "uuid": "36b4d0ab-48f2-40a2-bceb-fa5c06447bef", "value": "T1FDC3285AFC829B11D5D522BAFA5E718D331377A8E3EE7212DE205F2123CA51B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272469, "uuid": "054f1d39-d38b-459b-82cb-99307d35a430", "value": "3072:jYX1AsuE80zi5gXtr98yGYEDoNeau8J2csyb8A20wIqJt2f:jYX1juE80zYgXtrR0Geau8J2csA8XIUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272469, "uuid": "a5d32e0d-2e9d-47a4-b33a-37091b0cb14a", "value": 129100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272469, "uuid": "08b62775-95b4-46b4-9d0f-82e8eabe2417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272469, "uuid": "513fa7bd-21be-427c-89aa-2fe67f7a0350", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf0c214-81a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268961, "uuid": "ebc910dc-af29-4d10-81ae-a597cb60bafd", "comment": "Malware payload (Mirai)", "value": "90b045c22792ccb530b44f45817d8daf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268961, "uuid": "59a782df-429d-4133-8712-ad8224fc3d2a", "comment": "Malware payload (Mirai)", "value": "c4213932c59d57f7a2b5d7b73cafbe08f3f6139b41b56b6d4c1d964c097d368d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268961, "uuid": "4bff6925-0094-4bf7-aba7-04bceaf776e5", "comment": "Malware payload (Mirai)", "value": "c658f156063dc4f6f9be1a2a21dc2dc209d697c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268961, "uuid": "e56650ca-7630-4b80-b154-ed589fc860f2", "comment": "Malware payload (Mirai)", "value": "835d7d37b533742b5f320fb5012e66ae5a08c229ebba4b3ab51b34bef132d03a937608577ed5b83866fbafdbb00caaf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268961, "uuid": "516710a4-2a0e-4a5e-8425-109f161a192d", "value": "T101B32A86AC814A11C5D613BFFA2E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268961, "uuid": "dec4f655-3cdc-4d7a-a958-850b2d35d3c7", "value": "3072:BfxGIfE1qVXbO4bnOfGZKGanrfKkTVDaoK7X+f+aM1kDxG1:iIfvlDDOeZKGabKkTxaPj+gktE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268961, "uuid": "6e272e9d-11ed-4d0a-b975-7010c7b61132", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268961, "uuid": "c6e5155f-6c8a-487b-b3c2-9e23c7868c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268961, "uuid": "990283f6-e8a5-46de-928f-44635cd2dd07", "value": "nerv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b823f5f8-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1784291611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291611, "uuid": "7b5871e0-e059-4038-80b5-a8e9756293a2", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7e0c5b1a659c8ecee5c970cb7162d66a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291611, "uuid": "2a95f9f1-018a-462b-859d-e8ac65eb22d7", "comment": "Malware payload (CoinMiner.XMRig)", "value": "c4b117f30786d0b328d90c2818e4c454e81d29ed5921d8f8847e80333a12ee86", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291611, "uuid": "6b011fa3-5a69-4f4c-a799-13f5cb54a49f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "cf18c4eca378bfd964278f1fcf97fbe51cc6f230", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291611, "uuid": "e0345327-6bd0-47fe-8388-ab34a86422ec", "comment": "Malware payload (CoinMiner.XMRig)", "value": "37b73a21d4bfb8aa58d813ddae035b218656bc636df08d7ded8f8ba0bb38fbf791dc951b724208e41c29a3def7bd100a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291611, "uuid": "bfd4b73e-8032-42c6-81f4-f1e2023f6aa2", "value": "T1C20723BCB4B6B95AF5D4433BC6852CB6DB2CA540D7D93D9BCE2041927DC320E1F6A821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291611, "uuid": "e52cc006-014a-4e53-a255-2e78b6b9c92b", "value": "393216:BvoJYnm4PaJBjPvwL4835pf/9vV0sj2UMMeEH4eMrfvh0WyFiOl:BvoJ05EtgL445ptvV0g4MAzfOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291611, "uuid": "4038680e-97e9-4b69-bb50-89479a685d15", "value": 17836347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291611, "uuid": "00af5d88-1864-4c75-b964-9445c0a46175", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291611, "uuid": "61ffbf11-42d2-4013-bc1a-88ee682212aa", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcadd6c8-81d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784290008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290008, "uuid": "b2b36f81-7f81-44d3-9c3f-92e87be3566d", "comment": "Malware payload", "value": "73c2ee17c7f6012d41ba6251facb659d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290008, "uuid": "c756a38e-e86e-4ebb-9323-cd2de0673799", "comment": "Malware payload", "value": "c4c2e5441b762bbc8e15b9a7b33aa91899dde924967d4bbd405e23f9b82e5c59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290008, "uuid": "cdfbd6d7-dcb6-4a2f-9cc6-71f388c272d2", "comment": "Malware payload", "value": "63fe3016898ebedd6b0c567d7eb9775e77493f58", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290008, "uuid": "bc1a91c6-23b3-46fa-9e63-f26c889c2a78", "comment": "Malware payload", "value": "a75d415a90aabbe97d3dee71d573bb4721f029e09e90fdd455e542697ad920ab98ebfdcabe3e3f3255f49e60fac9072a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290008, "uuid": "664ee3a3-5943-4587-b9b5-449c8497d6a4", "value": "T14B018CCBD3506A005029995D679B51A0B830C3CF57870BA87F9C943DAB8DE04B067F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290008, "uuid": "e8562f9d-743f-4da2-8813-69d33388e831", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkatFCo3xWFCpRJ1CoesKCD+sPSCb84aauD:kXCKysE2hi0ziQvZoha3F3MFk107+8B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290008, "uuid": "72992b88-bc6e-43e9-a607-b9f0168f0bd9", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290008, "uuid": "7406ef14-a06d-456f-b58d-c03008a72784", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290008, "uuid": "459cbdba-1c69-484a-b7be-50dd2641f3da", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8356cf3-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267103, "uuid": "0a78a959-2215-4c11-a35c-2de1d6f3e7cc", "comment": "Malware payload (Mirai)", "value": "a35f0ed23c377f4ee28a1e1b863e096b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267103, "uuid": "a6ef3011-9016-4d63-87df-6212e83da4e0", "comment": "Malware payload (Mirai)", "value": "c4d3241b2948863f87bf4fa815f82b8fbac0f8afe2d37504f05384fb99c3072f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267103, "uuid": "11a6f72e-8b33-4122-a590-83283ba2e476", "comment": "Malware payload (Mirai)", "value": "b6a52b8805403588a023473c8f97f134c5133c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267103, "uuid": "d35c58e9-dd88-412d-9494-d856ed0fe274", "comment": "Malware payload (Mirai)", "value": "4ee078da29f113da112142becc36ac9c3c2e9effa10a2fea8cffc84d3c461add8e72e947f46f2b25a92c662fac73f087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267103, "uuid": "7ecb2af5-4324-4b0b-a2bd-45aa8d84c407", "value": "T1B5837DC6E743D0F4E8528973213BE7328A73E53D102DEE83D769A932ED12541D66A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267103, "uuid": "63782f17-3830-4f8a-8d9f-f96bb33b5a4c", "value": "1536:bAxTtfhenc5SWhp9Cl3IVVk/13HWCsBjJe7s4TtABV:bALIuSGp9Cl3I4/13HlsBdarE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267103, "uuid": "a2d5a30d-375b-46f7-bbbe-dce40050343f", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267103, "uuid": "15092738-dca2-4e86-8fda-13ae9373e49c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267103, "uuid": "eedd10ea-0d5f-4308-af15-96312e845cc8", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dc9d62-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271989, "uuid": "33ff4879-f613-42a0-af7c-545b5b17506d", "comment": "Malware payload (Mirai)", "value": "0fef9dbc773bf8febd66854111cc3a69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271989, "uuid": "e0c80bad-4f1f-4b1f-986f-833e62ab0ffb", "comment": "Malware payload (Mirai)", "value": "c523e13d778893c67d7e13a011529baa655d2017fe89a0c3989f96595a51b4e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271989, "uuid": "7c6c47b1-1c2f-4e72-8ea7-f78093ac9645", "comment": "Malware payload (Mirai)", "value": "3841620b02c67d687e345bf995f7c7da787c44d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271989, "uuid": "00f95e0e-df57-4f3a-ac72-b06fcf3a9366", "comment": "Malware payload (Mirai)", "value": "3d34b0b6ae7336a20e5451ecab11f8b2cd3383f552d525753f82b14c9c1fe706da12eae40bfed6bcf5da99273b0e0b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271989, "uuid": "e6f10436-d5b6-4d9b-802b-cd923fef5361", "value": "T13CE2F26A51ECB12CE44E903BC32FA98E31E65D11BE17C6A424C476DADF611F914B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271989, "uuid": "1b8b6d28-81dc-459d-9809-35c521c43d75", "value": "768:g32bRAqg2mQzSPMjFY8AFOEPB6ZSq7xnwNQBUe:DbRAp2m4ECF+FvB6ZSonwN2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271989, "uuid": "f25f4b36-eb42-46d2-9e72-c478463da08d", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271989, "uuid": "f5c3bd75-435b-4dad-88d4-f5548526532a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271989, "uuid": "43519bb6-809b-44d1-ba5f-2434c2f006be", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124f59b0-820c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784312378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312378, "uuid": "3e018f54-1957-4d43-a825-95af73b9232b", "comment": "Malware payload (Mirai)", "value": "11134d3d4ba7ab5051cfc4daad5989d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312378, "uuid": "0b30f2ec-40c2-4771-b62e-64de2562fe9e", "comment": "Malware payload (Mirai)", "value": "c54e949bff5f0f8c2a330c17b19427d29d5442f0b09aad9a8ec36a78f18e0f21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312378, "uuid": "47de9030-24e6-42b9-a9d7-d55754723085", "comment": "Malware payload (Mirai)", "value": "332692fdab359c4441635d28f59946e617df8dfa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312378, "uuid": "770be9bf-9010-4c93-9503-bcb72fe9e193", "comment": "Malware payload (Mirai)", "value": "4bb875914568f5da1962e0350ad494e02f7b4b8733325db163c880f3bc7d5ad7a053b0b7df3b49833ebb30b17e19ecab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312378, "uuid": "78d8cd08-8672-4104-8fc2-71e087570bbb", "value": "T178A30887F901DE7FF80BE6BA049309197520FB660E530B76A367BD93AD311D41926F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312378, "uuid": "304fef87-f31e-4e8e-a2de-20ef8fdce31a", "value": "1536:3yD7f6hZC+TxtRnWeIFkCQ+7SwUNYpxl068Fl4/zW0IEpmPZY/hdhEhDhx02MV6k:3ynSLnIFvUNuxl0b45Ix+V2MVEjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312378, "uuid": "3ccee2a2-6857-4dc2-a7e7-660860143876", "value": 99692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312378, "uuid": "f09f84e0-31a9-40ce-9203-005399c01abf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312378, "uuid": "a86f798d-e96a-45aa-815f-f4c6e5267864", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed399af-81d9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784290656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290656, "uuid": "2b6b9f54-2382-44e6-b28e-16ff231cb109", "comment": "Malware payload (ValleyRAT)", "value": "0339c190d049e564aca4c1fd58763a09", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290656, "uuid": "b17631bb-05b9-449e-a6bd-9d55bd390f4f", "comment": "Malware payload (ValleyRAT)", "value": "c5d87b2fd77b79c04e3cb70c08c383cad28eb8435ffd6a3eed1a9c391b6f83ca", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290656, "uuid": "03142ce4-d19e-410a-b4c7-f795f231ee30", "comment": "Malware payload (ValleyRAT)", "value": "a2ab178de12f8a951e1e3d7425e4dbd46ffedc26", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290656, "uuid": "3b1559e5-f820-4620-ac0a-9d648448bfa1", "comment": "Malware payload (ValleyRAT)", "value": "602015509c52a65be348afeff8693de0e88da3881260cca4eb5348398fff086a885189eadb46e176c2c16493cd2a3230", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290656, "uuid": "7c6c4832-2033-43b5-b1d3-ded694824f7f", "value": "T157283331B11764A4E11FB7BF9178AF8980317D92732BA59BB3787FB28571A8310B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290656, "uuid": "9550348e-162e-4f20-b7c9-9a5a79419d0b", "value": "1572864:RRIJx/xzKqEvlacMJp+mF9k265mjkcXUw1V034I/KDjZLhI2mZD4rLZ8bR045caN:8x/xmqEdanp11Nk2x1V44I/MZ24XZ8xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290656, "uuid": "2159bee8-ddc4-426b-af9d-11a67096eca3", "value": 99884032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290656, "uuid": "ffda9452-2a86-40c0-a5d6-49793d5b504a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290656, "uuid": "05b6c055-7b79-438d-b490-aec1dd1610ac", "value": "GoogleBrowser_Isyi10_v1.0.34356.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08237a5-8208-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784310952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310952, "uuid": "0977400b-47e1-4463-8464-672f561be683", "comment": "Malware payload (Mirai)", "value": "a7a98cb9de2da41cbb86a944eb9f01fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310952, "uuid": "c5e8f021-08dc-4b1a-9aeb-2b429cd20270", "comment": "Malware payload (Mirai)", "value": "c623cd07443cbbf55f9bd14aabf149b4c515ced13c62a50298fa186fb184e43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310952, "uuid": "3df494c0-2ba0-45ec-8754-52e4c6b4f56c", "comment": "Malware payload (Mirai)", "value": "b5d717b1dfd6f2d4de1c156aa82aac8908f0cb7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310952, "uuid": "d3bfc2c1-73b0-43f8-ba9b-49f5e7fa2df5", "comment": "Malware payload (Mirai)", "value": "5d8e3755ff00be234c45350b77b40ae4254c9ba07d6e70cd606919f9d21195217f97236ed31960ab8e19a1b238f369a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310952, "uuid": "001362ef-d5a9-4734-bcfe-fe91d313423f", "value": "T166E39FA8DE0E7C82C6C2E3BE9E490FA3312734B04551D2F65D01968DE5DAED59CB2532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310952, "uuid": "25658474-f8ab-4bce-8831-1e6217f9ed61", "value": "3072:1E2OHsPggHXcZ9c6leDnQ4iw0XtZnjuADeSMmdknKsKhRchHl:1E2atKycfnFiw0ddj4S4nrKil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310952, "uuid": "106195ac-5113-4eac-9ba2-7f05befbcb19", "value": 145272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310952, "uuid": "3000dc2b-f4c7-4432-bf6a-cc82b6b85a21", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310952, "uuid": "7420c523-b255-471b-9f0e-fc2b72ef1be3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d84eec-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315436, "uuid": "0fc86fa8-05f4-42fa-95ac-366d3d782dc5", "comment": "Malware payload (Mirai)", "value": "0f336dca1ed120807f1156af50ce24f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315436, "uuid": "4fe18e82-6db4-49cc-83a7-da1cee66d64a", "comment": "Malware payload (Mirai)", "value": "c63a6dfc431017f98927ba8d9a7c12bc8c1a41da7214807f8591122b00b9d134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315436, "uuid": "b9116859-ae41-4145-840e-bd6675cb77b5", "comment": "Malware payload (Mirai)", "value": "a7b779347ebf4ffb9d6aaacc7e179c7d51292aa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315436, "uuid": "936f380d-26e0-40d0-9cec-643652d9700c", "comment": "Malware payload (Mirai)", "value": "3e3b62e9585e9ff6b7627099e2a2ff13e0a5a2c655f198d026c712b653dccb662f8be7e21a0a74fb0ad3e9cba019fa98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315436, "uuid": "0ca78b59-fe10-421a-bd60-33ac26fff138", "value": "T13DC37BC5B50D7EADE5933E7CC206271B6E1C9E519C83810150B5FE072AB76E32E26AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315436, "uuid": "fb2301c5-83c3-4cfc-949c-a5fed54e3d4d", "value": "3072:/1CGjkXoPpvogAXrIgrZTKlUv6IvYNQLLjyohA:NCCpALUgrx5v6IwNQXvhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315436, "uuid": "a3523658-eff5-4c74-8196-3fec9679af26", "value": 125268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315436, "uuid": "7391af5e-0cd2-4fc2-8bb4-50bc7fa41078", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315436, "uuid": "74932322-b01a-4406-b288-c1f3ee40024a", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebfda2e-81b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784273825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273825, "uuid": "373fe866-4901-4caf-bc07-5a3abd41c6d0", "comment": "Malware payload", "value": "58330aaf1f533e9fe03b6355c60347b4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273825, "uuid": "3f66dcd9-1bba-4201-93f4-c144b75186c9", "comment": "Malware payload", "value": "c6528aba9265127234f36dab178d1688b541c1878ba3093ddd7d5b84535a9d76", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273825, "uuid": "d272502f-6f3a-421c-9cb2-2b1d4374fc55", "comment": "Malware payload", "value": "b5a44ea4861bfd73f95efd32d77e746851d83ec5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273825, "uuid": "f7f64b78-f7b9-4314-a37f-ed0f27b22a1a", "comment": "Malware payload", "value": "cccb7bc5b960731e07176df31a0bd6ebca5b0ab9afbf2127b5af59e769e56ef48b5eb8c6c823f21ef069fa5d551917dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273825, "uuid": "28168982-0dd8-46bb-a685-8e8b0c4314aa", "value": "T1AD96F106EFC4BA6AC9F71232557A5A184C434D4447C7D983ED9A782C1CBB6F0AB1DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273825, "uuid": "e33aa3c5-97a1-4316-9ec0-3d3edc6c7455", "value": "196608:gk0yxEa+cxuM1YD/sqLBzuGtIj9nW0x6CJgefuSF4A2:Iylxt+z/1HbefJd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273825, "uuid": "bc03e83a-dea1-4768-a34a-7c592b1d748a", "value": 9007247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273825, "uuid": "8a5196da-d234-4bb2-9915-30b7a5972442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273825, "uuid": "40dd47ad-d86d-4e2f-bc1b-89c401582882", "value": "alert.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515b74d2-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284137, "uuid": "740d24e1-8bcc-4603-88b3-a488f125e7ff", "comment": "Malware payload (Gafgyt)", "value": "1215412aad7b46005b8566de58e5375e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284137, "uuid": "83a46f6e-0950-4dd8-94bb-0a31161658dd", "comment": "Malware payload (Gafgyt)", "value": "c6568754d0ac40fc7c0ccdd98b0a4f69fd85476089161fc5eb14fbeb33949f9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284137, "uuid": "0a0d0ecd-c1cc-4d7a-992c-111d58a45727", "comment": "Malware payload (Gafgyt)", "value": "f3f6ca14b3ea9e9a5a5e5fbb859c5c61af6b0dd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284137, "uuid": "db3babab-a09a-4aa9-8868-cc2aa518bfb3", "comment": "Malware payload (Gafgyt)", "value": "e7308d2b7e038ee770db251be1ea81571dc732c791b2954ecfaa9faa02e51d55bc280a0771065e6efffcc16029b9e11e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284137, "uuid": "a3776125-571b-4c31-8353-d62ab14090c5", "value": "T148F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284137, "uuid": "afef7ec8-b914-4f8c-abaa-0b9e09a248e6", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBsYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/iYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284137, "uuid": "35d1e398-be5e-4a16-bbcd-00f956787350", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284137, "uuid": "882bac05-cc8c-4f41-b1af-9778c95151ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284137, "uuid": "59c24abf-1957-411d-bc78-3366bbd16e9f", "value": "arm7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d276a-8174-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247170, "uuid": "4b583357-107c-460a-9cbf-33d882cf5a25", "comment": "Malware payload (Mirai)", "value": "72793a36b6ad03df42e8fc4c3c39b671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247170, "uuid": "580041ef-894f-4825-a782-722f8f2d4c16", "comment": "Malware payload (Mirai)", "value": "c68ac31b40203f39c9a784ea8209736364ce9a05a9b06670938e66ade6e25d78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247170, "uuid": "6d473536-442a-4fa7-b002-a6a1501b8cde", "comment": "Malware payload (Mirai)", "value": "96442e6b491eda901d0e5e29e79377f362b493a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247170, "uuid": "539474f8-d8ad-424a-96b3-db00132c67de", "comment": "Malware payload (Mirai)", "value": "34324c131271d5dc92ed8a8e966b269e96938d658ac93f692a090aac0cd6905fe10cd9210aef2d74a41935c5a2424bf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247170, "uuid": "c7e4f5fb-2162-44db-939e-a396713db90f", "value": "T176C34B0273180B47C5A319B02E3E3BE687FFE5E021E4BB89251E8B564575EB75849FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247170, "uuid": "530625cc-ee85-44c8-a2da-61d0df171b8b", "value": "1536:KqL5Jj5lED60/rhmvQ+f2evxDNScNGPuFZ+1mWdHKyELsHzI:KqL5JjQ2w5qbDPfFUmLGHzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247170, "uuid": "4a4688a4-5f59-4590-8eab-a9668afadc1c", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247170, "uuid": "0b2e4172-50c9-4b4b-b2f3-faac88890d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247170, "uuid": "09564bbf-d13d-4185-b596-9950bad91309", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e7b69f-8177-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784248493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248493, "uuid": "292e00b1-fb58-4825-883d-e5e472e3286e", "comment": "Malware payload (Mirai)", "value": "0e2e885b964b6223702ec7447790fa8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248493, "uuid": "4fbc8874-1b63-4a92-a563-c2b6c7ffe1f2", "comment": "Malware payload (Mirai)", "value": "c73cbed870744e026b4f09dd0e2e8f3ae22a74ea46199b1a0a076a39b5f3be40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248493, "uuid": "84d74ab5-e928-4a0c-9348-40329fc9380a", "comment": "Malware payload (Mirai)", "value": "5ccb10e667978f8e2294a2d6e033ebd252231c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784248493, "uuid": "5c511e51-c53a-4e6d-9488-35df92cbdfe0", "comment": "Malware payload (Mirai)", "value": "f6e1d6abb37e330bfdba5651f2596df6cafad8401160436da4b6f19828f5700dbe949a356447d7fe3bb4f0f3083a26b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248493, "uuid": "06b89c8d-d1cb-4809-afb1-d840c37d51b5", "value": "T1785302A3C25BD902FD63C652DD25D1E92BE207053070DAC34DECA320AF9257BAC68DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248493, "uuid": "196c4850-9736-423e-b0b5-ee8f719f8f23", "value": "1536:/arYAH4YwpsQUXzHPz4TcqxbrMdiUNnayz/rNVNJJ4u+qgw0r/:4+FXsk5Br8ifyzRf4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784248493, "uuid": "ba92da9e-3e72-4889-b354-401332039cf2", "value": 64100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784248493, "uuid": "98175392-126d-4dc6-a9b3-5fa5107f0830", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784248493, "uuid": "792db694-5a4a-432b-b6d6-d88f6332e444", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e57eafa-8227-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784324075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324075, "uuid": "050c4563-f92b-4c0d-8f1d-9174bf8aa284", "comment": "Malware payload (Mirai)", "value": "63a543e21783a02613720b5ad1a1caf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324075, "uuid": "7cfee062-19d7-449b-adee-2a34f318ca00", "comment": "Malware payload (Mirai)", "value": "c853e37abd17e2073a068e628b8a3a2ab77a0fa8206db877b769b756b6cb2fb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324075, "uuid": "34e1b7a5-38b5-4d72-8746-64bc38e56e8d", "comment": "Malware payload (Mirai)", "value": "37f806ba2735d614a9aa3e9831a5d09bce8ac956", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784324075, "uuid": "e5238bdc-9bb8-4d76-a518-db6948b19422", "comment": "Malware payload (Mirai)", "value": "6c202ce416f8f8be68507b6e0949fb5f2de81508115ea42d55ed34f32535b518e0faddbce586333bae147d7ee88391ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324075, "uuid": "becb90fd-037e-44e9-8233-636844cd04c6", "value": "T13A03F251A6077C30E92019BCFF9F5AC5EA3D2EF0E1BC36339295890646CD5E147E8682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324075, "uuid": "db45f42c-95c8-4c9c-9508-32d728fb0b0e", "value": "768:tiEBFQtTh/C//Cgcqa2CNX0v/qAaw1dD2mncP1LA32R469q3UELus:tJKTh/CXClqaHt6d2V1LG2KvL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784324075, "uuid": "32a2ab40-d3a2-44e7-8f17-9f4952ce0835", "value": 38056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784324075, "uuid": "def91a26-8170-4b63-bf4e-c0dc14e5f1dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784324075, "uuid": "b0c5f42b-f7f5-4679-81d4-5fb847c466c7", "value": "SecuriteInfo.com.Linux.Mirai.10589.29319.5096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff09e6b-81ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784271035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271035, "uuid": "663e38d3-a7a3-4078-8903-10ef4f393a21", "comment": "Malware payload (ValleyRAT)", "value": "7f0dc039affc8c5358269aa7d44f1c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271035, "uuid": "866456ba-cb98-4027-9bdc-d07738f868ba", "comment": "Malware payload (ValleyRAT)", "value": "c8f9bda04605b9771a96bf875b51ebb5a4797e9bcac8d3550039ca2a745316ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271035, "uuid": "a1c7c334-d23e-4a61-a68d-b9b94296712f", "comment": "Malware payload (ValleyRAT)", "value": "d86e7b630760af8b790effdee66522a2d870e750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271035, "uuid": "4703ffd2-28ce-46e9-8624-54a02a56321d", "comment": "Malware payload (ValleyRAT)", "value": "6b05e94f67cf1f36e2397af516b5dddff509bee132c1bf54366298dc8f242f70fc2cecdedb6702da3677902dd1dfa5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271035, "uuid": "63c8df05-d96b-4840-986d-4a4b9d0f5856", "value": "T100349E63B2E430EDE3B3863088BD921DE7F27872DE205B1E17D086255F535A64DADB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271035, "uuid": "d2e25c92-91cf-408f-bf35-78961a6046cd", "value": "e91b68fe29b473e22c03a780dbcb6987", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271035, "uuid": "9103af81-5154-45e8-9071-5d47f113db66", "value": "3072:nRn6Rw90Amliz1+CCapJl6fKq+eU1CduTM9/qlmqmB0DPrOHOvXfSNXOfjNDmtON:R0Ayiz1pLT6fd+aV/ql/mbiDqDHqdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271035, "uuid": "c7339429-ff94-4750-a28c-e52f3dc0ea7b", "value": 251918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271035, "uuid": "7d0d75f2-985c-4a58-9d87-a95c56f7ed1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271035, "uuid": "6b08a6c6-9e7b-4a7b-b9ab-79b97aa02b1d", "value": "123456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3ce6ab-81d5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784289153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289153, "uuid": "6a5da20d-5757-4ee2-b48f-aa41b8867efa", "comment": "Malware payload", "value": "0037eede5152130a70ea086c4c25b100", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289153, "uuid": "3bcebb23-4f6c-4198-8318-9b0162d9f526", "comment": "Malware payload", "value": "c9259a5f917c8aaa2480e984455ba4a979de52bf3f0c5aaf6c5459f882be8299", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289153, "uuid": "ae5a3c6a-2322-4600-9be1-a488313c95ff", "comment": "Malware payload", "value": "09322dffe5711f21eba8e004a721b494c0d06c5f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289153, "uuid": "56886168-6e56-4800-98e5-ba663e29ab28", "comment": "Malware payload", "value": "ded350193c1f5efb388fd486b55d11ec67a456f88310e6a7a98cbed73d9093d24147036169042bf448d63024725d6f19", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289153, "uuid": "2c1a4083-683f-4de7-bc62-6d6517087b96", "value": "T177E633949DE442DED773913AEBE2A6E9E56878360732C9DB139CC7A13D132E00C79217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289153, "uuid": "be0e8257-20bb-4fdc-9883-6fb0e3fd9385", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289153, "uuid": "43eeb3c9-a084-4ce7-a42e-595113fb2b78", "value": "393216:MOCUakyh6mOCO/a3lxrlHTRSXMCHWUjXBcuI3/PGTAI:MOSrxOS3lbzYXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289153, "uuid": "6b43e25c-8987-4ef7-bf82-5e2776702a5b", "value": 14313409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289153, "uuid": "c2622230-b4f9-4661-a8fc-8b3294a936cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289153, "uuid": "33f9a1bc-0d71-44ca-b75f-d55dd6587e4d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d4a26c-8174-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784247065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247065, "uuid": "c83a7da2-fc19-428c-8adc-564b0c1b68aa", "comment": "Malware payload (Mirai)", "value": "ad4130be23b5bf51906d14f005f5c204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247065, "uuid": "01608186-9cda-437d-96fe-9cd7c6d2a41b", "comment": "Malware payload (Mirai)", "value": "c9889d7751721e0531e9221143ea1d9c20e3eda5dc18e88ddab6d52e3d729d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247065, "uuid": "b083acef-aeb9-4f9d-a014-a23c695f9cf5", "comment": "Malware payload (Mirai)", "value": "772f60999af558e7b7bc197a5ce42ab7562b0411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784247065, "uuid": "a56fc7d4-735f-4384-9360-b023f88c583d", "comment": "Malware payload (Mirai)", "value": "df2482933ddde874f5f2ee84040530e028f5bda3dd885e09dadf1a40cc3297091ebc0a7ba1096a1118cd94b8184f5fc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247065, "uuid": "a9b510f0-adb2-47f4-960f-665ab9770621", "value": "T13223F118D2F45FBADF9B52B61888D19627A0CBF7C367CE9230CDF6603155E02B499A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247065, "uuid": "cf3b9df0-6fc4-4e7b-8b86-1e02677d9729", "value": "768:OmBrN1oPOSI35TzozdYvuP+3zx8QnjL5JnK+08vKOfdx/IA/k6xt6/NC/HxQR7k0:OCrN1oPO5KzdYvuCNPnjLvnKxoKmXIA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784247065, "uuid": "c4b41377-d245-4cc4-8307-81f601380d15", "value": 46952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784247065, "uuid": "6e55fb76-91cf-48f1-ad64-2fb414863731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784247065, "uuid": "f4e61ede-503e-49fc-803f-a6bafa0479cc", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b6e3ee-8217-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784317086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317086, "uuid": "fab35583-f257-44fc-8027-d25c4f4e2336", "comment": "Malware payload (Mirai)", "value": "0725d045e836589a696ae5b6ea809aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317086, "uuid": "86dd63d8-067a-4b78-beed-96f3df7f2189", "comment": "Malware payload (Mirai)", "value": "cac8783060e52271f29b76a7079e704d770068cd21649b3fde44399425e1e2d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317086, "uuid": "b67a5e45-7b36-460c-9162-7b3bedbdaa64", "comment": "Malware payload (Mirai)", "value": "75787b8e1ed55ec7affad53a76758eb64f742557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317086, "uuid": "d98d0c2e-7f4c-4b4a-9351-88475f7f8d02", "comment": "Malware payload (Mirai)", "value": "62ef57339df67c04d5fcdf7dce33e497c7ed28edd7de5248c3e9f66e25542959c30cab0bb324f942bd1929fafccaf8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317086, "uuid": "434198f0-5a0a-4cfa-bf4d-e982dee5e3e3", "value": "T12DF3F70AAF611EF7D86FCC3705E9470625CC645722A83B793634E928FA4A54F4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317086, "uuid": "b3480c85-2144-4c78-8999-83c40deca9ab", "value": "3072:htprS2wg2HVNYcL8kP3UqXxx/HwoA6FDzdnbRg7y:vpMh8kPkGL/HwwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317086, "uuid": "fd53d50b-5880-4ae0-870c-37bccd5b24ef", "value": 168452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317086, "uuid": "ff8e3421-8dbe-46ba-8926-e1328d83abad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317086, "uuid": "1e1aaff6-6b7a-49a6-9207-bbbcd6bb8206", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8fdbd0-81bc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784278334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278334, "uuid": "abe0ff9b-39c2-429d-9a56-f03e2434caa1", "comment": "Malware payload (Efimer)", "value": "1f6302bf29ebe490369a35e66385be4c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278334, "uuid": "d6921496-50fe-40fd-8862-1b1f1cb2e2d0", "comment": "Malware payload (Efimer)", "value": "cb53a27059d050031065ddba70ce41b852eccc62b337cd1610a4a23bf874cf78", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278334, "uuid": "e81a7850-9b89-401c-a6bd-1ceafb366060", "comment": "Malware payload (Efimer)", "value": "109e494ec15d8771f63760b2b9ef88a8cc0b9c93", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278334, "uuid": "fab3b88d-60a6-4b47-9966-cc13be3c1590", "comment": "Malware payload (Efimer)", "value": "c272f799dc232818aa61dcd1fa91d2d39d3f466943dcc784883e578aa48c2a22192a07f5adf0ced65f3e16020b07ed6b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278334, "uuid": "41a07616-e080-4546-be5f-1c16b21df598", "value": "T12CE6335CB7D401DEE973D03CEDD15799E9AA34B21732C8EB076482F9BE071E08879626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278334, "uuid": "0f8605c1-bc89-48b8-92c7-44b562dba0d9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278334, "uuid": "2fcbd342-a827-4505-b751-499fd3c0676f", "value": "393216:zAbu8Qd+Zo6Hr4jjXMCHWUjX2cuI3/PGTAI:zcvEgo6Hr4/XMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278334, "uuid": "6c3337c1-9866-4e36-9dc0-12ee417bc3bc", "value": 14329614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278334, "uuid": "6b83117f-8b58-4738-9a6f-4efc8d52a2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278334, "uuid": "f26461de-8468-4167-9cdd-c09d0ca76170", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28286729-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784249708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249708, "uuid": "b210c15e-5555-43a5-80f0-1791ea42ce13", "comment": "Malware payload", "value": "5f33f8c748e9958350c472514366a3aa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249708, "uuid": "d8f0a1ca-e7bb-49b8-a322-00b6ddeabc97", "comment": "Malware payload", "value": "cc17b6dc8a38d09ecb5c13c5eb24dff13b5015fa4e084931a82fcf84502e756c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249708, "uuid": "2d903a4d-cc85-42ed-ab1e-200ecdded048", "comment": "Malware payload", "value": "c7efea5d14f5bd79ee789c62c0efa2f8ee759331", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249708, "uuid": "1379ea63-6f7c-43dd-a3d7-40463e83ac40", "comment": "Malware payload", "value": "bff78f3387d1f520c1d786e04463d522beef3478479a8ab3c6632763408a5d4ac149729ed1b5a5c4b95bf1819a936bac", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249708, "uuid": "7b1bf656-c1e2-4a76-8f0e-165ec6e247ac", "value": "T175E3491EA600458EFC8D21F18BC977EAC35910DDD397BA9D1E31FA6884B045CA2E375E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249708, "uuid": "b9c4803f-2959-4d32-8536-757c5ec08228", "value": "722ee3c091a704dcbdee8bc509a6531f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249708, "uuid": "eb463a49-d4c2-49f8-8429-bef164ae8c43", "value": "3072:2Mh8Uh2QGmEfZJS4jwA9buGgUV3XFKWuEGTGiYiJcVl81BiG:2sh2qEfDS4jwA9buGgUVHqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249708, "uuid": "d6c94d4d-b6c9-47c2-ba91-6d68af9b92fb", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249708, "uuid": "1288f9f2-ea25-47d3-b5a5-f470f0820777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249708, "uuid": "2e6936b3-70d2-4ee0-943d-8f94482b2025", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a608a3-8234-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784329776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329776, "uuid": "ada03559-e2d0-4c0a-9aff-9edb19ed0367", "comment": "Malware payload (Mirai)", "value": "8b343d6bc78b939a1ef24ea00a55a955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329776, "uuid": "fb726ead-771a-423a-93a4-92a423d340d9", "comment": "Malware payload (Mirai)", "value": "cc6964a4808fddb922b8889d83fd0724f6bab22125458690ab189a93978b2638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329776, "uuid": "28fc2de9-76af-49cb-9944-f185b449e2fe", "comment": "Malware payload (Mirai)", "value": "3425c84e8595d2411bc81d7c4d4643d833862c3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784329776, "uuid": "6d4c3178-ac7f-4685-b1a5-778b0557bf02", "comment": "Malware payload (Mirai)", "value": "1ce0435e22046a1c4ea2bdbab9bd09e52a93e23be7be762bb5104dddebd0eefd2ed1325c9c42327029d566060651219d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329776, "uuid": "1b264abd-110f-4d0c-93d8-25967ed9295a", "value": "T15EF3D716AF602EF7D8EBCC7791B9C70A34CC645A22A42BB57534E424B64B44F5AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329776, "uuid": "67dbbd29-f7c1-4ca5-8e69-7c566b52e682", "value": "3072:1Mz0FY6Gkr81p0ABo1kgMcbFyRJlCrbNpdCCtnb+S:1TJGkKp0AC1k8FYCr5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784329776, "uuid": "3ee67917-a1b3-40c4-9ef2-dff83aa2a5c1", "value": 160152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784329776, "uuid": "a827ffa6-eb0e-409c-8bf5-984242149d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784329776, "uuid": "b6773f6d-9a1d-42c0-aed2-ff667a4ccc3d", "value": "gmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb25598-81d0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1784287006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287006, "uuid": "24057404-13c6-41cc-a8ea-69f1eb2daf8d", "comment": "Malware payload (ZigClipper)", "value": "e19293ba06f288b511cb5697b3c2c195", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287006, "uuid": "c27f2616-b22f-48ef-9547-3767c6770060", "comment": "Malware payload (ZigClipper)", "value": "ccdc3e99b62d1b0b4b86a74896c1c1a45ee9a43bba9264fad162eb0116c49033", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287006, "uuid": "fb249d30-7550-4843-b5a4-0ebf61bef261", "comment": "Malware payload (ZigClipper)", "value": "10214a6b85cc071194553f5939cd3a0a5bf3d1a3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784287006, "uuid": "9ca38b5f-83c9-4e34-af11-e33845b0ad16", "comment": "Malware payload (ZigClipper)", "value": "81a1b88a1b0048454829f216805c2050f69c63630a1d0c79d45d5100b3fbee4a37a2b5b2b5d34cdc9929a8df5104c36b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kffd3-vexlatech-cc", "colour": "#34AD70", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287006, "uuid": "a9ebe0c7-e81a-4337-8948-7c492312a12e", "value": "T19E85BF24E3D911A8E577DA74CBA16233DAB178160771A9DF0689C3161F33ED0AB7B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287006, "uuid": "ba00fe9a-d4e5-4fa9-87c3-32528d2c0679", "value": "f55037ff0e6a8b9dbcbf489f2f670682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287006, "uuid": "099612ea-9637-4991-bf7e-54530534ce62", "value": "24576:dqhjpzASvunYrACtQAbW6TVd/eYDaft01Y5RZI/mYu01lBfxr6:dq51ASGYpBJe0Y0OezL1Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784287006, "uuid": "f28f7a78-1584-489f-a7e1-c428b1405a77", "value": 1767936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784287006, "uuid": "3b4e6763-df55-4472-b142-e33d3fc01c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784287006, "uuid": "30c293c9-e705-4290-90d9-19c28a51cd41", "value": "zopew-woeq-w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872214f4-820d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784313003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313003, "uuid": "a32d225a-2c05-4ddc-b86e-29d27702c5a8", "comment": "Malware payload (Mirai)", "value": "be3b6d316b83c3a83b4c86dbad095778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313003, "uuid": "48b66ab4-0818-44f9-bd3b-339437bad867", "comment": "Malware payload (Mirai)", "value": "cdb500cc24f17844a131561aac729a06b8c4012e06fc926b5f94e94c69bc57b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313003, "uuid": "79b7552e-c0e7-4b7d-81fe-3dffa0a9c4e9", "comment": "Malware payload (Mirai)", "value": "33d89bf09e19ec8b00e3caf60fc517a9597aaa42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313003, "uuid": "c52b82b5-52cd-45b5-9315-23b7081cee90", "comment": "Malware payload (Mirai)", "value": "cc182f5feeb4044142e56c8face17c1835cd259db5956247f74ae0587118abbc57e3d48c86e081286e31fd634da34e15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313003, "uuid": "97e45839-fa0c-466b-9150-7a2c682c00e1", "value": "T1B9B38DC5EA47D4F0E8135970043BA36BAA71E4365139EE46DBA52E32FC13B00EA1B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313003, "uuid": "f96b670a-8380-4698-8b91-a0925f412fde", "value": "1536:PkBIZJCrMfvYvXdjurz/Bz12VI+8WL8MjFxhSUeHeYgqqA6MBmrAg69yn:lJCqvwXdirzBMVIZWL82xIUupgqvgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313003, "uuid": "8ebb6219-bc0b-4386-bef1-1821524b5ff5", "value": 107632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313003, "uuid": "fcd84b60-467e-48ad-a06b-14a76cf2a6d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313003, "uuid": "76bf814a-8a45-413e-8bc1-899c87dd0b8b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22942866-81b7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784275898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275898, "uuid": "b455f97e-f342-42f7-8910-13fd7ca20203", "comment": "Malware payload (Mirai)", "value": "c16a9d0dc31bb3bf9ad85bdf1dd3adce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275898, "uuid": "ab229f78-3594-458a-8c21-ac31b99d3faa", "comment": "Malware payload (Mirai)", "value": "cdd0f676b39abd3dbddb8a99c9ec27a510f5275617cbbc803dfbbfd6e51c1928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275898, "uuid": "af90ec4a-23f5-425c-9357-91f213558153", "comment": "Malware payload (Mirai)", "value": "ffa87d8f6bc913b6f4c27026c6af34ccb05950be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784275898, "uuid": "b7560395-58c2-4afc-9b5a-498dec7355a5", "comment": "Malware payload (Mirai)", "value": "144df0a6662d747ce84a753b566482ba860d95214c2b5f876cfee80f59e2bc0102f6a12c826ba4d7b00297a0b8b57b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275898, "uuid": "2c3382c0-fb24-4b42-a852-c416d2012b54", "value": "T185A329C1F68B84F9D54B48304066F33FCE32E52A8071C96EDF99AF36DA77641921629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275898, "uuid": "aaa70730-043f-499e-b133-1a9e7590464c", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3E6WtacwKczMEW2MQ9nq6X:ZTFPbQ0yhOEckEUI6A12ZHTz9e2zUnKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784275898, "uuid": "628d59ed-3329-4759-bcae-9b751d3c306b", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784275898, "uuid": "40a068f9-d726-4e05-9fda-9563f2956200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784275898, "uuid": "677b98fc-46ea-419d-ba6f-c7905921d858", "value": "nerv.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48b7c4f-81b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784273646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273646, "uuid": "665825e0-4d0b-4e5c-b2e3-26d9c2121d94", "comment": "Malware payload (Mirai)", "value": "7fec5d87ecf60ded68fab5f783d3cb35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273646, "uuid": "9c9b4d1d-2c68-4227-a4a6-be1ab3bbd341", "comment": "Malware payload (Mirai)", "value": "ce40452c57edcf8f754cc6fd19e8e62e30783010fa2a913c4fcfedb06a156502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273646, "uuid": "9bfb50de-1d64-48ea-bb48-8ffc977a4f6c", "comment": "Malware payload (Mirai)", "value": "173eb10f02ebd1574d79195b7b706b7b5f3a028c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273646, "uuid": "f7020686-7cbc-4c46-a2b5-16e54f1fc4e0", "comment": "Malware payload (Mirai)", "value": "cf5fa0ffb4d505dd3617b246f8e0689a1750b4d2408064fa26c9a94abff2c9abb6521d2b6496e14750cf4623101aada2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273646, "uuid": "b1a61a6f-8a52-4388-b1ce-a740d89f0707", "value": "T1B4B32996BD826622C5D423BBFA6E418E371623A8D3EF72138D215F2037C692F0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273646, "uuid": "6dc0ad2c-b8e7-4cd6-a6ab-f9f57cd63a61", "value": "1536:POlvWIlGPodwHHK7CDvDNUsdnYkqlGBPRLUT7aUaHz0VZsElQlTWz6JuIeG:POlezoONUsdnYkq4Cf7aHz3XWmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273646, "uuid": "2793e187-da6c-446e-a7be-561e82672977", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273646, "uuid": "cb47df9e-c501-4154-8b4d-c3981ea098a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273646, "uuid": "3240926e-25ab-4330-bf74-dc3817438ee7", "value": "nerv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37f25cd-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267095, "uuid": "aceeafcd-187c-4750-b121-fa2bf281447c", "comment": "Malware payload (Mirai)", "value": "915060180647d93dcd19cb0c723009e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267095, "uuid": "fbc940bd-6bb2-40ba-acb0-77949c98a790", "comment": "Malware payload (Mirai)", "value": "ce454e145cd0e506f3e8a975d2dce8f3ffe042f613013053e8661ce8e72884f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267095, "uuid": "ba337ff6-e464-46fa-9aed-2d03bb8c652d", "comment": "Malware payload (Mirai)", "value": "f6ac4c083624c99ce29cf2746d9ae72c5986b2bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267095, "uuid": "1207b6f6-21ce-45cf-a685-5a5f7f0fa551", "comment": "Malware payload (Mirai)", "value": "33af0926198b4e0cdff8804912ea1bb1c4bc6e09bcbe9a0b0ed5cbe189829a9d918fea9bab2272f6617e7aeea6ab9b2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267095, "uuid": "a9c01553-d02e-4ead-8b5f-b39486c1535c", "value": "T1CA8339C1BA4BC0F6D9174830806BF33FCB32E6394065D25EEF6A9E65D933642562638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267095, "uuid": "e9ca8f6c-09de-4c50-8f88-ee6b98d186b7", "value": "1536:q1BK59Eb0SI7+rRg/XWAcanWiaSyzRigopFXKShkRL:KBU9EVI7+1AXWnplzRidpVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267095, "uuid": "54a5f027-aa1d-4700-acf7-71fb823bef75", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267095, "uuid": "0d63a8ee-f369-4563-becf-56df276af282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267095, "uuid": "181fd9f1-c049-40ab-a3d3-bb5481c2660e", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029ecdb9-821a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784318364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784318364, "uuid": "2b9e09d5-b09f-4d60-9a46-ea64c75d65bb", "comment": "Malware payload", "value": "bb34fb3d1bd1f2b1b96feee076bdffa5", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784318364, "uuid": "11c453f1-7834-4c33-88c0-0ccbba065e66", "comment": "Malware payload", "value": "ce91001d95ebd45249f7d18f51d75abc51f8093dae104cea05a3c5ca54d10e44", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784318364, "uuid": "13f76372-ea82-4cb3-b42f-a32c46a23589", "comment": "Malware payload", "value": "fd8b1cd8f10abb5729daca8399a8aa17bbfe499c", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784318364, "uuid": "972e7503-5e90-481c-92d6-3a0b4f1735d5", "comment": "Malware payload", "value": "11e88141a8a973636434ad4e9559a258d5799f9e15c38f57415baa49e92271450e34c90cf3ab76e5abb4eb347542ba5a", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784318364, "uuid": "5891439a-3656-4a90-8e09-13174f1f5ef5", "value": "T19BF522423B94C416E6A60971CEA9E7F92760FC4D8B69831331D7BE07BCEEAC35C15291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784318364, "uuid": "afe9d0a3-84c3-4613-87eb-3c590231aa49", "value": "8f104ac81ea8802600956811d68df5a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784318364, "uuid": "abd048d5-9e25-454f-b84d-b51741e78a83", "value": "49152:FJQB79VqRJPbi/RDdHeNkGsluSmveBhow6mBAg9cwI0ltNEOn98c+QK2yzxNoWso:FJW7u7kdleNkVl6mB8wbWOn9fg2yzxNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784318364, "uuid": "aa5590bc-9c2a-4ae8-9b9f-f7d3ce8a462a", "value": 3335240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784318364, "uuid": "55a80c12-cf45-4443-bf61-750fdb67e98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784318364, "uuid": "faf54a70-7ef5-4cbf-9a63-418e3fb39dc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d12cc3d-818f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1784258843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258843, "uuid": "13115d0a-c3fd-46a2-a2f6-949c805dddb2", "comment": "Malware payload (Joker)", "value": "d4e944b08e8c4ebda27e0fd9460a3fa9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258843, "uuid": "471b08f8-31c0-4479-b1a7-91ee0c00016d", "comment": "Malware payload (Joker)", "value": "cec2a39e52791bf8b7505f1fda1ed41cb2d23e78951e6df5c327f0cc937ea4e2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258843, "uuid": "cd820ce8-ffc5-4f70-acad-96b5f632b6e3", "comment": "Malware payload (Joker)", "value": "c1bc28303ca60fb31792c7cf29ca74605fd9680c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258843, "uuid": "2f8252df-9503-4dd3-8b80-9e068cd828dd", "comment": "Malware payload (Joker)", "value": "f9400c02c6145f0a02363ffc9c994cecab4b9baebdf9de072fe4cd965923d604efe13b8b51ce4537cd2b8ef84235c03a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258843, "uuid": "2603f828-166d-4896-afed-b8bad4852179", "value": "T19E37220AEF0DE42FDDE7B0388A9A0322A1577845574197A73A21C51DBE937E6DF09BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258843, "uuid": "18382e65-87ad-4ef2-8040-4da44af65d90", "value": "393216:zHqoeT3K6QuHAYnqCNzRTPJ6k9cKFIMqF1Heuq9YAWcA+QxKI:bqoe7pQ+pqCoMcKeF1HtpEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784258843, "uuid": "bf75bdfe-790b-493b-9787-e90ef7813c0f", "value": 23311179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784258843, "uuid": "178130f9-6588-4e23-b5dc-b2f93cf97d30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258843, "uuid": "0226a059-cba0-460d-b177-ee274d7350f5", "value": "Super+Clean_1.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd7602d-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311374, "uuid": "375a965e-82a0-4711-9a26-5fc3541b9166", "comment": "Malware payload (Mirai)", "value": "d5ecc1b9751e29a28e836c8397314706", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311374, "uuid": "1aea6635-b73c-45f6-bc0e-976688249747", "comment": "Malware payload (Mirai)", "value": "d09ed47221706e2c5493e4090e3c0731a06d20870c5bb147313e266587c7b909", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311374, "uuid": "d7a23ddb-8821-4dc3-8701-828b5a1f5269", "comment": "Malware payload (Mirai)", "value": "ae5b46fe453eb732989853cbde5ee9d1c0fb16f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311374, "uuid": "56319240-627d-4275-a0d0-15863748ab6d", "comment": "Malware payload (Mirai)", "value": "906289cb9413960b117a9b3e5b2cb8fa6a6de82cd0e126ae0a594136d2882408af02ca928a692843f4768028c4342c48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311374, "uuid": "29f6e874-1a22-4101-b034-bdbd158b4d9a", "value": "T14333F192DC38AD55FFEFC9710DE27A414B208BA6F2FC88621991C715C2B781297883D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311374, "uuid": "7362fc65-abeb-4e7f-8548-c76f1605a5d0", "value": "1536:8QQq/VaU22TAVTKzVkdPg6eA8AodkR2cavJz4u+qgw09C:haELVoeYoyR2cax4u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311374, "uuid": "613e07d6-94c6-4b98-b3c8-032ef582b0e8", "value": 51240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311374, "uuid": "9f7bee55-048f-4b10-87f5-ed78770d9b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311374, "uuid": "7f6aa1ce-588a-4402-aa85-8a973cf0b4b7", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213e8d86-821d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784319704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319704, "uuid": "3fb35c5b-9515-480d-b447-6ce3a163d38b", "comment": "Malware payload", "value": "0f0f8e2da620d16edcb7ce9fbd62cdb8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319704, "uuid": "49101bac-59d0-4f5b-a757-9f35a9ddecf2", "comment": "Malware payload", "value": "d4a2ad392b20b2e4ba82b37ade4fbdcf9c99cd22444241951c2da5fc4b675948", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319704, "uuid": "3dbe154a-ba35-45aa-922e-75605ddfe845", "comment": "Malware payload", "value": "1f7ebbef32e28c98d29123f26ab98253d5627667", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784319704, "uuid": "b8abdec2-edca-42d1-a8a3-f9b078f7b377", "comment": "Malware payload", "value": "a8ce060c4849392d1d3db36eae9807681d06c78d53b5084c26e8ec2622380f9f928030617ffaaf16775bf253e04d65d1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319704, "uuid": "9efbdbb7-8e75-4b48-96cd-20a4a2682eb7", "value": "T1B48633C6BCC624FAD09BD7749683B26D702A3FCABC73CD4E729A7A540E716162072741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319704, "uuid": "095854a8-68fb-401f-ba0c-7e2c51521496", "value": "196608:XNCIFVS+z7WXVLCcRZN5qib0HMtJPpTTwxRxFoPDHJAti:93VS+Qdsibl3dTwc7uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784319704, "uuid": "015cd953-b504-4cce-a254-15a32d6cb2ba", "value": 8462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784319704, "uuid": "66187f79-4da7-415e-b290-72e5262a9daa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784319704, "uuid": "e10a22a9-e9b7-4202-8913-ea15aa446478", "value": "intall_app.66553003.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe07000-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311273, "uuid": "f8cfa5c6-ebfc-4e9c-90c4-c737676c367f", "comment": "Malware payload (Mirai)", "value": "51377c858ea266d8bae0ea78134e6936", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311273, "uuid": "0dcae1ad-bf53-4f71-9048-3e901e91f177", "comment": "Malware payload (Mirai)", "value": "d4ddcb33421971b72596852c263303c010fd58660840302aed60a41612bced89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311273, "uuid": "a249b43e-0324-4f91-b514-497e74edf882", "comment": "Malware payload (Mirai)", "value": "53985349497014171e05e84f3b3f76074a60b938", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311273, "uuid": "eb225898-2526-4a88-89bc-5342c6cdb2ac", "comment": "Malware payload (Mirai)", "value": "2d51589131b0a66b11515880cfc108f5eaa3a09be024a83ab4753be7626f665757a68a5532065d965d2d077fadb27373", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311273, "uuid": "b32f8da6-0400-4fbf-9ab2-5972d8b9c86a", "value": "T1E9834B02B70C0F53D5625DB02A3F27D583FEE99020F4FA89695F9B864276E364186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311273, "uuid": "f566053c-95b3-4c59-a6bd-9851f180a588", "value": "1536:4PxhP1+gflVUPLrtnEyhutoGyD743ego+QRk/dHaNhJFST:gxyvN4KzDgiRw3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311273, "uuid": "5aded5ba-7308-4588-9f30-f02281d41c53", "value": 84392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311273, "uuid": "c5225d87-3c35-4131-91c1-e6f3bf29237b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311273, "uuid": "81fbdded-3313-419f-bfb8-9e8d2ccdaadd", "value": "byroom.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66f3eed-821d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784320062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320062, "uuid": "ec089ad6-b159-439a-b5bd-e5c9744de367", "comment": "Malware payload", "value": "14ec4aadd97ef949c22e1aa6e30801b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320062, "uuid": "55ca8325-ed59-4d89-888e-2e09e7e14f45", "comment": "Malware payload", "value": "d5bcffe6c397267ffc56923c7703d4c2d125e6b96c3f07dfcf3c5ee001b4badd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320062, "uuid": "35dacbac-453b-445a-a7d6-0ffdd2245645", "comment": "Malware payload", "value": "5156ad41c44e3003ea1946cb0fdbc2c6d78a2501", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784320062, "uuid": "38a1f76a-d6fe-4ee6-a1bc-68116879f35f", "comment": "Malware payload", "value": "6912065250c5274319a0c90baef9f712f8839e3e082088a06f8cd4281613ea9639ad7fb9bc357f7c46154663da58e48d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320062, "uuid": "6dddadd2-d3f3-463e-be8a-33186a0cfba1", "value": "T184D012CA01165360075C8ED8787B446A79C0D2C56192261AF400847982CE108B81162B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320062, "uuid": "6cffdbb3-712a-4999-a66b-3d869198f9b6", "value": "6:3J33kzRr/Q8ksWQELLcBQ3kzRr4xh9yLcMBQ3kzRr5xhbQxIMBUA:3J33kzlQ8ksxgwQ3kzkhgLcAQ3kznxhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784320062, "uuid": "75bb8463-7118-4f9a-b224-e311a80f76a6", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784320062, "uuid": "f8cf500f-fd1f-4785-a4bf-72d397aea33a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784320062, "uuid": "184b0064-8549-42de-962d-9f0fdc144f45", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc2280c-81d7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784290006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290006, "uuid": "876159c8-4df1-40e0-99d5-c52f144b6314", "comment": "Malware payload (Mirai)", "value": "892c2025abdda2e2f11f805b5a357be6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290006, "uuid": "63dcb86d-0eb5-4b0e-96fc-f7b71892888f", "comment": "Malware payload (Mirai)", "value": "d61c8941cc26939744082429f84b7fcb6611a62225aaff896afac68a105dead4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290006, "uuid": "260a6f42-9cae-4973-99f5-df81690d8dfa", "comment": "Malware payload (Mirai)", "value": "0edc98a24833f923999944d43687e77ab3afa546", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784290006, "uuid": "05514bb8-c48a-4370-a127-2a0c384b2f66", "comment": "Malware payload (Mirai)", "value": "2823d72451d1755f7616045ed3b0c3dd0786e698156cec1844f25406664fd0fa39786d645ab887f259c6763b8a67e7d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290006, "uuid": "60ed939c-6527-43b5-99d4-c5dc0f56da4a", "value": "T17FF06757A497F0B2D5A055BB87ADB15C80E7B8231231FE1C7B887A608E73A04BC62A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290006, "uuid": "a25b6ecd-c54a-4121-baba-daae0d424ed8", "value": "12:r6SmzTyaDKTXNk6TrfOcE6TrQ1nTrBNfTroiTQz57TPb6TAsZTEsrNToZThN/3TC:r6+a2ksfrEsQ1XB9o9zVbPsiseHVUqNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784290006, "uuid": "3641841d-8fe7-464d-bb0f-7ad0a416f8d5", "value": 578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784290006, "uuid": "a26d51b9-74f1-4609-9bec-d736c11983b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784290006, "uuid": "43f2385a-e401-4b78-b65a-775d964f900e", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1264543-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267091, "uuid": "972a6f2e-6083-4bf2-af01-559cc8e754be", "comment": "Malware payload (Mirai)", "value": "8fb2287ba7011ac47e2ce18452f098cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267091, "uuid": "5b4b2840-de33-4f5a-b80f-82afc1af365b", "comment": "Malware payload (Mirai)", "value": "d6ef25685c116b8be1a520a818ad03f136b96b7c172ebab5490af77a8428850e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267091, "uuid": "3d429bce-412c-4ccd-8881-e555a1de796f", "comment": "Malware payload (Mirai)", "value": "fc3541542cbf2842e086962a34005c842f220ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267091, "uuid": "ebb7d3e5-2c02-42f9-9b69-09351f796e45", "comment": "Malware payload (Mirai)", "value": "36cc04657775b71589497a2bff5d7717b4d8e1a861599138f0239cff451f22edd08fe64d41224ba4f4e983e372441c83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267091, "uuid": "8271c4d8-062d-4395-914d-36877a11e5f9", "value": "T167933992FD818622C6C116B7FB2E428E376713A8E2EE72039D155F2137C795B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267091, "uuid": "f8c20a57-cd6c-4d04-ad20-f1e342fea6ca", "value": "1536:+5tLkgWzvZzZwZaGiTktAstazKS9C4SYm6vbOH2jQlZlB2Wv6aIA:+5tLkg4ZzZw4sta1c4Rm6voG4lT6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267091, "uuid": "41e2b562-148f-4d39-a72e-a1e8e1b9a110", "value": 93228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267091, "uuid": "6c482395-fdb8-48f7-90d6-cd97b15dc56d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267091, "uuid": "367151bc-df4b-44dd-a764-d4283d696c7f", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906c582d-8173-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246876, "uuid": "707d3691-bf97-497f-9ae4-44f29fa028cf", "comment": "Malware payload (Mirai)", "value": "538c27804f9d9382867b5b19f2c5fbae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246876, "uuid": "03b1329e-5ed8-4257-824f-ae2f21e11fd7", "comment": "Malware payload (Mirai)", "value": "d7fd0e83e6509cc290a309bab475d70008b04be72a307435d86e426464ce969b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246876, "uuid": "2fab1dcd-a352-454a-a915-73e7cdfee9c6", "comment": "Malware payload (Mirai)", "value": "54884e23d1154349361e6e5c11857847db18003c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246876, "uuid": "576d229c-0484-4e1a-9e06-4e09cb74e157", "comment": "Malware payload (Mirai)", "value": "b3f3324f1963e45c555176fb0fbea49619c1b9fd8e42866afab17ddb6b3613a98d6fc1267f8fc4947b534e5eecf44d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246876, "uuid": "76570ff1-6981-4fc5-93ea-8c5133a73813", "value": "T191B31907BDC18DFDC089C038477F753ED822F0ED0239B2AB67D4AE262D5DEA11A19A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246876, "uuid": "1db142df-2704-4dbb-a0be-e1adc2d116a3", "value": "3072:gHoE9uzAHZeQ9eAT9kkzyQtJGCvR0MeITI8IunXYUxme:gIE4zAHZeQ9XT9kKjGMeKIIXYUxme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246876, "uuid": "638f9333-ca5a-4d13-b296-72bb5742b04f", "value": 117744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246876, "uuid": "020d30f9-63f9-4665-8c2d-adfdbf1f1105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246876, "uuid": "77f0a433-86a3-474f-9e23-1538673dc056", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5036b7-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325172, "uuid": "98d8eec1-5b4d-4b18-b9b5-1924bce0f40c", "comment": "Malware payload (Mirai)", "value": "5760b589070b70e31270c6b8839f0569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325172, "uuid": "b33f9f0d-a218-49a2-9e63-0963249a716c", "comment": "Malware payload (Mirai)", "value": "d803e714033d0a5bd557e4f6aa9a6cc16323fe692ac9ea4ff8dce415c47b9877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325172, "uuid": "fd12365e-5a07-47e4-86f9-1039c3217a9e", "comment": "Malware payload (Mirai)", "value": "d41fd4dd252c865c71a0574f39f8df2e17c76bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325172, "uuid": "4ef5442b-2cd9-4c94-bfc7-4a03d6fcb700", "comment": "Malware payload (Mirai)", "value": "270e7b0702361baea7929ba7d3c2f9e0932c1a576af0e2295f5255a10d162ef576cf3fcc3fdc9086d748d89f917cd3ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325172, "uuid": "d5450b76-06c3-40f2-a0b7-e24e445433c3", "value": "T146E32B46E6818A13C0D6177AFADF42453323A754D3EB73069924BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325172, "uuid": "9088587c-7348-4508-bda6-a5325d5956d3", "value": "3072:qMY+9eCsBJUtaC88YJqRYm9f5vRfJgB7z++5KM/9TF2F:qMY0vsBStaC88YJq99RRRgxz++gM/9IF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325172, "uuid": "ed6fb9dc-5133-4fb0-bd4e-443c548a3296", "value": 157203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325172, "uuid": "f2f53c39-5f96-438e-8b0a-7412252b9406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325172, "uuid": "858d6cec-346c-43a1-8c18-0e61890cce30", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aef92e4-818f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1784258893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258893, "uuid": "9ba535b2-2712-40f5-8fc2-c9a0829825e9", "comment": "Malware payload (Joker)", "value": "95646f52772decfb480b809f94013e90", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258893, "uuid": "8098e422-9bd3-49a8-ae48-f8457f8c7f76", "comment": "Malware payload (Joker)", "value": "d8205619701059115b6f9ca0bb30157effcdea1819188b97519fe29c59724227", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258893, "uuid": "90513762-537b-4b99-ac34-34127425e7c8", "comment": "Malware payload (Joker)", "value": "7ea78766eec367ff1e772d09118f2702b02b2551", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784258893, "uuid": "78a83392-bb43-4796-9c22-338dcd790bf9", "comment": "Malware payload (Joker)", "value": "ed2843cc784789afdd5eb945ab84e8bbed223babd6b4252afe86c659f53b6e56920b6f367974179bad9f54f0b750c1c7", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258893, "uuid": "90537dc4-ffcc-49b2-8a6e-e011ebf69fdb", "value": "T1D7C61256F7A8EA1FD4377032496A5231514B4D169E839B43A81C3F0C78BBAD84F4EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258893, "uuid": "7f18ced5-4638-48ce-8450-13a1c71640eb", "value": "196608:0K2apfzy/yqbXpxOC4Bc/bHKZL2KEjpp/1+QoBySfzO648tcqrUBdNbcnEc4:HbfzE9bXp/4Bc/j8EjjELBytPbqrUBdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784258893, "uuid": "e99992a6-6592-4f87-bd74-2ad55b6196fa", "value": 11555263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784258893, "uuid": "94844af3-9267-4ada-848a-5aaec70288f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784258893, "uuid": "c8e0a0e7-931e-462d-8a08-13a134fd12c5", "value": "Phone+Simple+Cleaner_1.2.4.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c74ed90-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315026, "uuid": "5b679746-f53f-45d4-8920-b200fda42083", "comment": "Malware payload (Mirai)", "value": "45b6507cebad6b4e8c7106bd2df58ba6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315026, "uuid": "3cafa09c-9710-4f95-8343-fe7172a4e0c1", "comment": "Malware payload (Mirai)", "value": "d843f8b1b28ec7de49c76f61bacdbcca579b333248835155177f9184fe35a96b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315026, "uuid": "ae3f5f3a-4bbd-455e-b6b4-cb32dcad1470", "comment": "Malware payload (Mirai)", "value": "68a730c80f20f72593feca4c57a22cc8ca37e48f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315026, "uuid": "ff334f77-c57b-4466-8e7f-23812467c159", "comment": "Malware payload (Mirai)", "value": "4cdf5e877f21278da9e1a3341c8fce0d6ebc8752bb2dab8f7a20d645e8e1e6c889e7927fc90c4500a694a171ff9777a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315026, "uuid": "f2010146-73ef-4c16-b23d-1542e3333edc", "value": "T13EE35C4CFA57C1F0E5C341F1067BAB69563A99226237F5E2FF563762F8B1302588922C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315026, "uuid": "04361aa6-8178-4855-befb-86f9b923f3f3", "value": "3072:xA0Ercn+528ERMoZvfU5la+ChiWIIuZW7BWLt:mkn828U7fwZgiiuSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315026, "uuid": "30ba1944-c49f-4db1-8c8b-ea3eb421bf93", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315026, "uuid": "2b17af28-0287-4197-9f50-7b1cd42e2108", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315026, "uuid": "f6ca0689-b2b1-4e7a-b2dd-b527f37d67df", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3152c765-81a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784268192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268192, "uuid": "c9ebf782-23d5-4572-81c5-0bb2ceb81531", "comment": "Malware payload (Mirai)", "value": "9038004054a8c4e3b6ac5cdc0bf169c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268192, "uuid": "9ac1e6e7-5d5d-4230-8d9c-07323b63dd24", "comment": "Malware payload (Mirai)", "value": "d8a95391806c40e7b2a3898bbe942fa746a66b142dd6c65040407b5f49d7eefd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268192, "uuid": "941a9344-a467-48c1-af6c-b923c0decaea", "comment": "Malware payload (Mirai)", "value": "b8bda652fdae0327dc856c5925be7e28cef1762d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784268192, "uuid": "cc201922-ea43-4680-ae39-81fb7f9a5a31", "comment": "Malware payload (Mirai)", "value": "56c58332727aee8dbb9d5ce72b73078852c4a13369b41ce87764bb870accba4dd975956b5957fd177905776f3a6685a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268192, "uuid": "f1ff919a-a99e-4a33-a3e0-b37243ab5760", "value": "T1EBB34D02731C0F47C5A75AB02D3F57E1A3FF999021F4BA89251E9B5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268192, "uuid": "9129d8d9-9ba9-4289-aca4-b471460b1294", "value": "1536:7L8aGHx7rZazxJWsvNW/GHogtC4srsgLWLLGRHqrkzubJKekKYgesSRwPIeiI:7KKNvjoUsXy2abdZrUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784268192, "uuid": "04cf71b5-48b1-4b57-898d-5113ad6a9403", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784268192, "uuid": "39a50236-2069-4f39-a3ee-989b80db0522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784268192, "uuid": "1073e6fc-1ab4-431d-8e14-8f0860c96ae9", "value": "nerv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32b9dce-81b4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784274906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274906, "uuid": "6ca2b908-e810-4f7d-a2bb-fe4f28adeb91", "comment": "Malware payload (RemcosRAT)", "value": "157a9b12d3546b4550793e2379376e36", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274906, "uuid": "d1dfc2ad-8929-4290-b9c3-bfd10d687abe", "comment": "Malware payload (RemcosRAT)", "value": "d8ed131b01ea2d2ba3f2cfdd352707e9de8d609f452726b15033e409a4808c8e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274906, "uuid": "372a806c-8bf7-475e-aa6c-8a75ba5de332", "comment": "Malware payload (RemcosRAT)", "value": "0484d5e6d4145a45a6796ac079dd15516ea4bec9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274906, "uuid": "15d55b21-751a-422f-8e02-b38d72752167", "comment": "Malware payload (RemcosRAT)", "value": "87b590164b4a68e40375c89349a31d20d5426c535fee0b100c67ed589d0ab5ce581520dacd12b6707696fc2e03f66c22", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274906, "uuid": "63fc1203-29bd-46ef-ac17-52cfff1fbaaf", "value": "T1C015F02B2C812E8C2761465B37BBF06707EF5E614B90BD51AADB4E0DE6F071B09B441A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274906, "uuid": "db23ee98-89b1-4e5a-be99-53d0987b81ed", "value": "12288:PaeLCYmTtWsqHTbcBTyOKTuU2Nl3/AfMNJGN2aHhTrKKEfcZAq:PaeLCYmTgsqHcdZBNRsMNJGN9qu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274906, "uuid": "57495ead-b1aa-4edf-8d2b-58ace17c099f", "value": 927199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274906, "uuid": "231493e1-a06a-42fc-b763-fce0bdfb1138", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274906, "uuid": "e883a9a4-6363-4d76-a6e0-79fbabce9409", "value": "Ref-17-07-202645001Docx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a349963-820a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1784311693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311693, "uuid": "00c97ff9-69b6-4634-8e11-c170a6ddaa97", "comment": "Malware payload (Prometei)", "value": "7d559d96fd0950fae66723379a687f32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311693, "uuid": "75ee8dba-c714-4b08-9cab-8443572ccf7c", "comment": "Malware payload (Prometei)", "value": "d9dc3280e3a83cd87b06c2c0d2a8639ae1d3c7274fcb4b5e72c0bc5301ea0ab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311693, "uuid": "99ddf83a-44c2-4e39-9d2e-a8b603970ce1", "comment": "Malware payload (Prometei)", "value": "f6ef1a7b0773a1a9ddc7419825ea723588223c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311693, "uuid": "430c12fa-302c-4c6f-8e98-c05a716f8ae5", "comment": "Malware payload (Prometei)", "value": "bad5f2b1106ae3e76cd4b1704d7d5251adab5806d7e3f565a36fcc2fb61180b8033ad08847dec3322c2192f4b91bd871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311693, "uuid": "232fd8b3-c65a-4872-810e-32af11ca1f2c", "value": "T19BA423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311693, "uuid": "8e7273ed-cc8f-42b5-bbdf-48474e228bf5", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdQ:Fs6pyCC/Ya2hpi6T6N4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311693, "uuid": "d8ee17ce-6915-4fe4-8504-e97d4f73f710", "value": 449080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311693, "uuid": "7898503e-6aec-4ac3-9ef1-1e372ff3bf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311693, "uuid": "91eff5b0-b269-45de-b52b-297a3f399664", "value": "d9dc3280e3a83cd87b06c2c0d2a8639ae1d3c7274fcb4b5e72c0bc5301ea0ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f25e58-8218-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784317565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317565, "uuid": "39d6ff9a-891d-4f0f-a272-b270aad66be9", "comment": "Malware payload", "value": "1c709f7f33460ae149bb042b3559c49b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317565, "uuid": "aa5fb145-b066-4b7f-9954-4246caef0545", "comment": "Malware payload", "value": "da50eb6030b8760f13c2e1fbd9d325b15f06e5c6f015b38c2c2ffde870b7ac0c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317565, "uuid": "df4bba3b-8dfc-43f6-8626-d0e433e34aa6", "comment": "Malware payload", "value": "d214ab4901d81907b8034dbe7632e9268d531b2d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784317565, "uuid": "fcaee8ff-fabb-4024-becd-71417540e2ec", "comment": "Malware payload", "value": "3bd22a68a91c23df28cac707a9e1fe17e006047a052de8eb416e42359b4bca3ba996bdc38e3290d8d9e35bd3342b8f3f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317565, "uuid": "2243ccda-8ca3-4619-9755-7cc69919ae71", "value": "T1A851B219A99A648CF9FF50B125FCBB5091B638CE67891BE1407CB658E3D2BC84CC41EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317565, "uuid": "340e6279-ae2c-411d-b55f-40b3e8f7ca58", "value": "48:88Ggh3H2/XBvSSXtrSEdWSLkRTg0Xi2fjjCZaYwmYXuj:88BX2/RsEdW5W2PCZafm6uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784317565, "uuid": "35336538-5f94-4935-8b0c-a2292ea0f490", "value": 2595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784317565, "uuid": "0b704146-32f4-4dd5-95fb-0e717b669cfc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784317565, "uuid": "a39f3902-dbbc-4931-87e3-1b80b90a96b3", "value": "Master Bill .pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba002cc-81cd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784285550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285550, "uuid": "947df12b-77e1-4d6a-ac6b-28d0b1583aa3", "comment": "Malware payload", "value": "8ad2b0f99ddaacbdf71c664543746637", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285550, "uuid": "5d79b3f5-9aa6-4a7f-8e3b-e175748a966e", "comment": "Malware payload", "value": "db41bfcae876cdbcde754de1de28b384beca3b1b37ef3e3db29d84c6721bcd4a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285550, "uuid": "74a9dc66-0182-4f87-988b-e5fff2152472", "comment": "Malware payload", "value": "705dc3aab3d3a64a78087563b86da10cb7ebb34e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285550, "uuid": "1c24938f-e5d1-4084-bc4a-30e47ea22681", "comment": "Malware payload", "value": "6b76f7915ab84fe0eb32779761b96a737d5e389e306850d88063106fb44cac069f3bb04971a3d782cb3582a36057222d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285550, "uuid": "dbd47613-0d8d-4bac-838a-93947d99d534", "value": "T1BFE633299ED011EEE9B3417C5FE362D6F17474210B72CADB6BA482576E132F09A3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285550, "uuid": "b456dfda-daab-4668-9a87-e15665e3893c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285550, "uuid": "1caa2908-dd9b-4c17-972e-d101fc1929f3", "value": "393216:wgXXXinwu+r+8fg8zZ7ojHXMCHWUjXlcuI3/PGTAI:wN6+x8V7aHXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784285550, "uuid": "d3df2c9e-b029-45d5-b9dc-927789386d5a", "value": 14258737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784285550, "uuid": "571639ff-7b49-41bd-8451-1d380ba49e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285550, "uuid": "bb282cc5-9f3a-4a17-ae28-d6465d47cfab", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb75d06e-8211-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1784314809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314809, "uuid": "3c62c1dc-efa5-423f-8ea8-72a4a393b4f3", "comment": "Malware payload (AgentTesla)", "value": "85bc2324660729a2e3baeeaf34e6cdea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314809, "uuid": "746b722a-0a6b-4db5-982c-c139de3b9de9", "comment": "Malware payload (AgentTesla)", "value": "dbfbdcc2ee77868a8227d74aa1479810d38535550e63916530abdfdb428045e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314809, "uuid": "471cb65f-dd6b-41da-b176-f16ab50ce98c", "comment": "Malware payload (AgentTesla)", "value": "7fcf56631214d09723d2f8c9a9814575decb4876", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784314809, "uuid": "d7be9dcb-d663-4f70-8ec1-c40ca8338355", "comment": "Malware payload (AgentTesla)", "value": "eebac3aebd3769569941b0cf606e89af11dc5d16c8800f54eb425d19651f10b78f9fa6ff3adba534c7172b68b6def7f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314809, "uuid": "57d8da95-25e0-4f91-b4d4-6919d5545507", "value": "T1ACE5D51183387675756DC32CC0369FA8444D601761E8EF1D36AE1A24BAAEF17E38D6E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314809, "uuid": "f746a7cc-9b28-41c4-ae15-a42dc24cd97b", "value": "98304:n+QJCfqu6+jFYLM6NdB/ySK+R/5bf7v63XP6Pq:nSqf+xYLM6ASvRh7v6Pmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784314809, "uuid": "7a68b494-c78e-4995-bf1c-200bd6cf31ea", "value": 3291847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784314809, "uuid": "6256fea2-3aeb-46e2-ac98-7b74f6edc69a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784314809, "uuid": "52e6aac1-94c3-41fb-a741-fe78afa79892", "value": "kkpqlpwj.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e65cae5-8214-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315915, "uuid": "aa4e84c2-80dd-42d0-82c8-0e6c4799d87f", "comment": "Malware payload (Mirai)", "value": "46c8a962353663310097ae24c50007ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315915, "uuid": "dea9b2f4-643a-45bd-afbe-a761624e0360", "comment": "Malware payload (Mirai)", "value": "defef8019b30d07526f339b0fff853827efb277b678234c4889d3cabaecd1e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315915, "uuid": "886a55d7-a22c-4064-82e0-f3cb8cdff278", "comment": "Malware payload (Mirai)", "value": "2cce82b2c4cc76dd2e77a67f400742b4f49ddfcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315915, "uuid": "dd12749b-d6aa-4db1-b680-ac4554c73296", "comment": "Malware payload (Mirai)", "value": "4f7ae862e503af48591833a35673558553fe52cbc1277b517275531e9ae51fa333534db254d9f42af71b69154acbffdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315915, "uuid": "bd16af25-5747-4285-a3d4-4ef5e8dc29f0", "value": "T12EB37CC5EA47D4F1E8121AB1143BA36B5A71E4364138EF46EBA52E72FC13B00DA1B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315915, "uuid": "a22bb430-1dcd-462f-adb0-5bb8637d92b2", "value": "1536:IXvwpCbsNwx/m1Le7Fz12VI+PvE8Mr18A21x+kLDvrgn0mmrXP69yq:bpCQuJm1LepMVIuvE8+8/10Mzk2Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315915, "uuid": "ea726c31-2c14-4e6d-be43-465bcad7e818", "value": 107632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315915, "uuid": "0617eeba-07e4-4e45-897e-280515c83c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315915, "uuid": "f4c5cd7a-7c17-44ce-868f-dbc5df11305a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33599e23-817c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250586, "uuid": "02265d1f-a44b-4314-8a03-ea84d723c236", "comment": "Malware payload (Mirai)", "value": "1a7fa5f9c81b1e54da17eb5e7473c85d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250586, "uuid": "068c4af1-c029-4fc7-aec4-262d1c892300", "comment": "Malware payload (Mirai)", "value": "dfad56d46b0379eaf32c1969204b70dc30d5f44a74bc49d952a330eb170c0d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250586, "uuid": "2e7cb92f-8106-43da-a650-fd9a75940005", "comment": "Malware payload (Mirai)", "value": "888b3da0ab027bddd645673676b95cc043b20957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250586, "uuid": "fad8d563-b8dc-4529-ba28-2ac3fec78d31", "comment": "Malware payload (Mirai)", "value": "5f141dcc2eca377b5f622964ba501c33df4ff43c8d2d8c061aae070a7afe634f80fbb5d30a7483267e98f96f292528c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250586, "uuid": "27b0acb8-0136-4b30-84ab-59dddf25eac3", "value": "T10DB35BC5E247D0F9D8160A302276FB375E76E17B1329DA83D7F49A32AC12AC1D4167AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250586, "uuid": "76d83aec-6ff5-4652-aad6-3b86d5ea8ad3", "value": "3072:vpe9zJgGmi+dkEF5nSMnuAhDb4ySUBNIHcCeBX:vpe9zRx+dkE5nfuzwIHcCeBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250586, "uuid": "59aeec7f-f3bb-4945-8c31-86fce8b1b0a7", "value": 115988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250586, "uuid": "4c8f3354-6bb8-4c4e-89d4-47b9b6b17682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250586, "uuid": "83f77080-e6e3-4e3d-8c87-712587ad75ac", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fccc966-81b0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784273102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273102, "uuid": "56967882-fd0e-469b-b15c-efe737c92d77", "comment": "Malware payload (Mirai)", "value": "02354afa5e27d9b0d16998c1e568a313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273102, "uuid": "0cddb0d5-a910-4441-b7df-fcdb3b906325", "comment": "Malware payload (Mirai)", "value": "e022ea14b71fd8f2ee9430217900f322b49423e849882227e9bb05c1e27356bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273102, "uuid": "423091b0-ebc7-406d-a309-fdebb35eea76", "comment": "Malware payload (Mirai)", "value": "9bf8a772548fe30e20ab1b80326a599d07253646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784273102, "uuid": "61454db3-d825-4afb-874d-6a7a66589e4b", "comment": "Malware payload (Mirai)", "value": "2663b15282aeeb15a17113d6274860606302912d78fc1bacf64434f2076c3f1bb5ca7bb96ec3612869b407c3eb6df62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273102, "uuid": "141c07f2-080e-4ba1-b62a-a058b6d0dd46", "value": "T1E9A31984B881A611C7C15A7BEE0F018D335A97FCD7EB3372BD640B64778A91B8E26741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273102, "uuid": "8bba6d8e-1eb6-44c7-8d88-fa5b4db1bd72", "value": "3072:Wq/NtXEIxL4+tPZabmT84+SOG4ghMhMARwnx0:Wq/NtXNkQZ2i84+xIhyFWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784273102, "uuid": "ba74e747-71ce-4b54-b783-52c72374ab98", "value": 104216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784273102, "uuid": "c8f6adaa-565e-4562-b180-6a052b1137c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784273102, "uuid": "1af8d401-b4c3-4678-9fe5-f74a4fafc9b9", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03fba1a-81db-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784291705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291705, "uuid": "86b432f5-fadc-40b1-8cf5-f55ecfd7a124", "comment": "Malware payload (Mirai)", "value": "6ffc505835934d2c7022661649b9d24d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291705, "uuid": "b9208f57-f34f-455a-ade6-5758ff2bcea7", "comment": "Malware payload (Mirai)", "value": "e096bf51ba4bb7e4791166f7a35befb5a74b9ed2794f80ef7b913c6f16f7bd41", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291705, "uuid": "6a50dd0d-a7af-487e-916a-12dafc35f7cb", "comment": "Malware payload (Mirai)", "value": "641fa1adf2b663635bad2337806faeb3f8134698", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784291705, "uuid": "71b4b910-cf5f-44b5-9e8c-6846051cb7c3", "comment": "Malware payload (Mirai)", "value": "7c7c30dcaa5b5d961e1f9b3de4cf4689b9b95904d35b6c138904af9c88d34568f8b5ded3dfce03f8e215a0617fc40da0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291705, "uuid": "6ed14a32-9eaa-4765-bf7b-4a6a17ce73dc", "value": "T1E12165C7110503301EA5D9E6BBBB445970D0D1DE54C3BF6BA8D8B8E9818EE187C42553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291705, "uuid": "1684eebc-2ab9-4024-a168-aaa5e5517a07", "value": "24:ItSTfsS3+3IhOESxW3SoZPsSwySxTnxTGFC:irNEJ3Q4KTxTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784291705, "uuid": "a812362f-2ac8-45c8-977f-9a4c7883a17b", "value": 1141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784291705, "uuid": "fd1592fc-b4ac-4641-a038-acfa17e7feef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784291705, "uuid": "fa8b65fc-9ab6-46e3-9218-e250bbf3f0f5", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ec8f75-8179-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784249570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249570, "uuid": "c17c791f-021b-4897-8a2b-4511599fac43", "comment": "Malware payload (Mirai)", "value": "afc7b029f3a05b97b920d0407791ee68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249570, "uuid": "15f9d343-249b-4964-ba29-25150eb639bc", "comment": "Malware payload (Mirai)", "value": "e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249570, "uuid": "1f9e0702-77aa-44e3-8339-14b139844674", "comment": "Malware payload (Mirai)", "value": "1d5b8d5858ed9521bc305b362d2a99e24272bfa2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249570, "uuid": "d4c63e5c-f1f1-4d3a-be45-ec20191d8ffd", "comment": "Malware payload (Mirai)", "value": "d0b14d69e6067eed8ff0b81cdfba8768fd0e83df6f10135be6976c30fd5b4c6993754ea00f6ce617be6c351d8bdff607", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249570, "uuid": "873e6d94-d519-4d5b-b126-ea8ea0e59f4d", "value": "T1E0F0AFD941016AE39F88D91F3953542D2242BBC931272FDCADCE25B9A284FD6F020E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249570, "uuid": "b1ae688a-76f3-42ec-97fa-4dcff6835917", "value": "12:KhI5W3CtI1/TKxfvbQYpLOhPvqbiAE+8lHA:KOQyS1bkfvbZpLOSiAylg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249570, "uuid": "1ead6ce9-1953-40b0-8b72-9eac3f6a19f8", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249570, "uuid": "c3e54250-ff21-4653-a608-ed25f1a00b70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249570, "uuid": "a8c455ec-ef2a-4f57-acb0-e0313e2338e6", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c107baf-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784249876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249876, "uuid": "a3539c48-f1fb-4a09-9a29-97325d52aa60", "comment": "Malware payload (Mirai)", "value": "ed0e22368d57ad624797af95e92c768c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249876, "uuid": "6fc7b172-fd79-474d-b63f-01ab4b0d067d", "comment": "Malware payload (Mirai)", "value": "e34fd49b7b29fe32d7730995313d3c95c41a638a9679fe3fc8f63a1e66d46753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249876, "uuid": "7bd48622-a654-414e-b0d3-6108e2d49bec", "comment": "Malware payload (Mirai)", "value": "bae43f1eb9803ae126fb8349448f311dfbd50a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784249876, "uuid": "7abac22d-25d5-45ad-96fd-3d65e3be1e38", "comment": "Malware payload (Mirai)", "value": "24ed37a5b34372378eb261e1e5f21d419eb9fe72bd9c795c870107337f09cb803012386484165499ebf870e2c994b320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249876, "uuid": "5cffa27b-2e02-4ecc-8a54-c38343746c21", "value": "T19CE34A59FA53C0F0E1C341F1067BABAA563A99226237F5E2FF563762F871302588532D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249876, "uuid": "90ec75ed-612b-4245-9183-d5e46049b2bd", "value": "3072:07o4IvnRjCebCEf1G4AT5KRcyBag6Gg2WIbH7K9G:5n5mxDKRLzO2ZbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784249876, "uuid": "5fc7a1fe-f700-4a6c-8b48-b7a4e16a14ef", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784249876, "uuid": "d4688a3b-b254-4bb0-8143-8a5fcdfb7c4f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784249876, "uuid": "2fc1161b-bb73-4077-82f7-4be95b0691b3", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c40eb12-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311267, "uuid": "37bd0596-a8cb-4b83-a3a9-227c93f407fb", "comment": "Malware payload (Mirai)", "value": "0c4f6f4b6b9dfff265e6bf2b1232c394", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311267, "uuid": "de135e8a-9340-4c9b-aea8-da4205a52dc5", "comment": "Malware payload (Mirai)", "value": "e3616b2f328da3d6d895bbdc7fa96f25496da0435ad21b285ccb58f9b21062e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311267, "uuid": "b828fd4b-0b03-496a-92ee-d1062e078d3b", "comment": "Malware payload (Mirai)", "value": "c4b3cef0b7b9f11b4ee285eb161c79b3684e66b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311267, "uuid": "98deb61b-4846-4783-86a5-b9ff1e257170", "comment": "Malware payload (Mirai)", "value": "7db284c8d666841c250295d79cc5090024756141d6d9e4b46cc6b6f4cc1728ffdc64f04f96994a2f5430cb870ca49a57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311267, "uuid": "a47dc608-adc7-4223-9034-f067d83dbf52", "value": "T154933BC6F400DE7DF40BD7BB4493090AB631A35255930F3A639BBD97BC760B44962E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311267, "uuid": "e90cd3be-394f-4afe-9ef9-94b9587e9555", "value": "1536:rkRT1n2xSrhJBWQeWTMR+8l3AGCcwXsM7hK5/nryll4BywoEqV+L:repIQeWTMR27sM1KJfBywoDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311267, "uuid": "c0e0daa4-65cf-4f8c-812c-2124e3dc7798", "value": 93612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311267, "uuid": "65b9c856-0fb3-4b25-b986-fdad3b81694e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311267, "uuid": "1bae6c82-43a2-4bcf-98dc-4a7d065803f3", "value": "byroom.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6785bfbd-822a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325406, "uuid": "85019943-ce73-4ed6-8aa6-d73307c8534b", "comment": "Malware payload (Mirai)", "value": "0e19c57a5391d0e0b0532d96a6dec588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325406, "uuid": "406ea5c6-9a0e-4110-aa97-4e00e5c770ed", "comment": "Malware payload (Mirai)", "value": "e3d5253d9802acc39901cabdb8e299a25e7c1100939a87ded0d580d965905f35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325406, "uuid": "f956e599-23e7-469a-a091-029ba5f20c6a", "comment": "Malware payload (Mirai)", "value": "3519be8fdad0ab1cbd623317dfe9659bcc617526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325406, "uuid": "1be28cfb-8adc-4302-964d-b63d5f617211", "comment": "Malware payload (Mirai)", "value": "9eb3c317c47d7571100b4da6bd3d297901a37a22bba1ebc1a872a8f0b71e826b5865e8df083c6856ddb3cff85caeb0e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325406, "uuid": "271a91fd-f9bc-42b2-ac2d-67117ac3f214", "value": "T1B2632A91BD815B13C5D1227BFB5E028E376653A8E2EE72039D226F2137C785B0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325406, "uuid": "3c8a7d6e-0bdb-491f-b890-460bc548e2ea", "value": "1536:RCKyuaY3GekOPJ3CgCPavW+SLDK74ZFs/Kbg:RCDe3SgC7hLMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325406, "uuid": "115dd335-ae1e-4d02-abd0-55cf8f34888b", "value": 71756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325406, "uuid": "a444fd47-aeaf-4a59-ab5c-d02c8fa52265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325406, "uuid": "6522dedf-a26f-4b31-b0f5-0b1659f128f7", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1526da2-81c3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1784281318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281318, "uuid": "9b97b975-d712-47a8-acab-e102c7e7da54", "comment": "Malware payload (Gh0stRAT)", "value": "5b977f69426b81be858c36c516b252a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281318, "uuid": "9227afe2-01dd-4309-9518-abc7643490d1", "comment": "Malware payload (Gh0stRAT)", "value": "e4283d10ea2d8bfe524e2da68870d67653ce895ff4fcafdef68edc47576a5e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281318, "uuid": "201bd86f-6075-4031-9e50-f2e2149e61ce", "comment": "Malware payload (Gh0stRAT)", "value": "94ab762201f7bfa9506bc209a1349dc036fd05ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784281318, "uuid": "4333ee4f-9510-40e1-83ee-4078258fa87f", "comment": "Malware payload (Gh0stRAT)", "value": "9ad99a4e6395aa8977e175b4be5d4a5c82c6d2220b671bc3814f92a5309c6f010966d819accdb753f9f48291065d991a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281318, "uuid": "73cdf87a-9e6a-4392-b939-a01d0c711e44", "value": "T18F27333FF2AC653EC5AF463246734320897BBA61B41B8C1E07F0858CDF6A4605E7AB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281318, "uuid": "481a66dc-1bbd-4686-a668-bad88742c354", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281318, "uuid": "fb542e60-643e-447c-9a9f-2bcdb71b2cf0", "value": "393216:NAFt2EOoeD4u9Z0oOdTVicskFC47PsPf5CX0LW4Q6SnpUdTvkeDLXZ4TXvKU:yyAcpOZDskkmhnb2J/J6fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784281318, "uuid": "19636559-f416-4274-b42d-fe4b15256c1d", "value": 21666612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784281318, "uuid": "6127545f-3d84-4b14-a69f-c83d9118101a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784281318, "uuid": "cb37a382-8ae6-4ddb-925f-9132a3ac1d8d", "value": "5b977f69426b81be858c36c516b252a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2beef68-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267094, "uuid": "8b4d02fa-a1d8-4f39-a981-3804ff1ac17c", "comment": "Malware payload (Mirai)", "value": "8b298be1b39df83476b28bbe07060198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267094, "uuid": "7c1e0fd2-2d6e-4e2a-84f4-a461141e24ce", "comment": "Malware payload (Mirai)", "value": "e51d467976ee09a7aabb8cc6ce104e495b751c92c7d5d0f8b0f5d8b34f36f6f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267094, "uuid": "329619ff-fe41-4a3e-bf69-723cb4ed3023", "comment": "Malware payload (Mirai)", "value": "6ce869ebde01474019067c2740267751ec7fa9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267094, "uuid": "1c7992af-2efb-4863-a179-e7a25dcdbc5b", "comment": "Malware payload (Mirai)", "value": "1d55ff382e0f0f1a8ca6f1a5090f720864cfd741e5c29b13e4d43749971ccc4832e42507ca8617a29b1bf38fc724a90f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267094, "uuid": "979a9d25-6262-4f0d-8535-fc1e73f859f0", "value": "T167936C42B70C0B43E0575DF02A3F57E1C3AA66A120F8FA89790EDE4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267094, "uuid": "4a9a8765-661e-4fd7-bfb1-f577ded4f07a", "value": "1536:aDbQbediuZ6mJYRBNS3LJZr0YN7OQqTzp8asfFzmge2MP0l1WrSlfPp+tID:wQER4TzGame2MCWr+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267094, "uuid": "612752fd-480e-452c-9362-7363f6093079", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267094, "uuid": "a095aed4-d104-4b91-85c9-68df7db609f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267094, "uuid": "5d94adae-c65f-4747-bd38-258e91db8683", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6f4b8f-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272076, "uuid": "70beb6b5-bcd7-4617-b5e1-337de3f1c1f1", "comment": "Malware payload (Mirai)", "value": "1f89132681624b15d9ae43977128decd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272076, "uuid": "18f499d7-dd13-4c9f-9e42-b5075975a136", "comment": "Malware payload (Mirai)", "value": "e6ece4857564ecd03b063f858073c23e51cb31b99ae3d632f2f77cfdc93cc02c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272076, "uuid": "1c6cab0f-3646-4fbb-baa6-f05290cb9f50", "comment": "Malware payload (Mirai)", "value": "2ec9dfcb42e46b5cc22388fd9476c9b23e676974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272076, "uuid": "02bba189-6655-4f81-a29e-547457626e7c", "comment": "Malware payload (Mirai)", "value": "545d911e1bb0a04d6b890ecfd348d65038403194485c9579eae6058b1c5474be49804d317aa84b1adbb6592a7a66b4f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272076, "uuid": "8fa06a31-b480-498e-84dc-e81490dbff8f", "value": "T1FA633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272076, "uuid": "0f429c71-c152-492b-b25e-79e53f3d2613", "value": "1536:9yJWBrmSTKrFNTMGwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxNTMK1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272076, "uuid": "64b6c72e-7652-45a2-a4ca-e35c8486c114", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272076, "uuid": "ceb54430-04ce-4d18-8216-718c992b61d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272076, "uuid": "4b9b3eb4-bc96-44aa-bf7a-1cbcd509b9da", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b11bab-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784278666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278666, "uuid": "f9fcb237-c9f5-4c67-b0a3-7210b0d3a70f", "comment": "Malware payload (ValleyRAT)", "value": "5aee90d119558f3c43c222ac86071f2b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278666, "uuid": "42f71780-6987-4dc5-b6b1-f8badec83725", "comment": "Malware payload (ValleyRAT)", "value": "e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278666, "uuid": "ed118ec9-badc-4217-bb4a-aa87d2d3e814", "comment": "Malware payload (ValleyRAT)", "value": "3a23596f4822d61944f9aef03b7e5e5599ee68be", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278666, "uuid": "132e7b72-08f9-43ef-be70-820554d35ca1", "comment": "Malware payload (ValleyRAT)", "value": "36d7d906603843a97c6f363a89da6cbba7d70490e5e19b881207d0872ba5d34378932862dd05d1de17798f6309545c8a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278666, "uuid": "c3e3f91c-fbbe-4de7-bd15-3ce1d639cf0a", "value": "T12B9633C4FC8A7F74D547D7B49052746EBC3A3FD4B9A29E0B7A84BA001D732254A7B248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278666, "uuid": "faae2ded-1458-4463-a477-fe692ae2cd7d", "value": "196608:X/mVqb0fG86ytX2jSxZrS9wl/kvB5xLWW+xOr5wQxLob/Rk4HmwPTE:PmVqbn86yZ23vHxa2qQQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278666, "uuid": "69b6ecb6-c1fe-4374-997a-0dd444b14f07", "value": 9461760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278666, "uuid": "d8c71fc0-f46b-4ba5-b865-43f1bbc1188d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278666, "uuid": "a0a4377f-88fe-4711-a8f4-7205191279eb", "value": "intall_app.66553006.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2399108-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784325155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325155, "uuid": "15b03a71-582a-42b1-9cd8-a5c600c3e332", "comment": "Malware payload", "value": "68a0611a987a8f92db3fe0e8de013da3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325155, "uuid": "e3cc93dd-f2e9-4b90-9bf4-6b7e53bd7517", "comment": "Malware payload", "value": "e7553056122ea9670392682be84901320bed1f7cadaff9e507cfa783c03e3cd7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325155, "uuid": "7f0c0091-26e0-46ff-9f9c-5feed326be3f", "comment": "Malware payload", "value": "d7cb3e37e4109aa5187f3524cc882f029118779a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325155, "uuid": "19e4af52-6980-4419-b95b-4aaeaabd6cbc", "comment": "Malware payload", "value": "af1c4f2e04c38d564decd706e13a0d85174d60c58d7db969eec3c2e4e025a56837084a85734dc86a4354319dafa14f11", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325155, "uuid": "664ac225-ac61-409c-a567-2753a2b21e69", "value": "T161E6335819E022EEE2B3413CFEE1868AE66574751B72CDCF1BA486627E171E14C38377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325155, "uuid": "bb35ddbe-2e91-4946-b609-1e6e4c8eb1b0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325155, "uuid": "85d5e421-907f-48c9-a783-434bc0a5d914", "value": "393216:IhI+CqIqdVrFANmd+9NeXMCHWUjXJcuI3/PGTAI:IhRtZDFZd+9NeXMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325155, "uuid": "6ba2fa8a-9345-47a5-ba86-6d26f0ca3e4e", "value": 14197904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325155, "uuid": "bea78756-8ac4-4575-9948-c79a76980065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325155, "uuid": "44d5dcf3-084c-4a1c-98b4-a85d19c96c6a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2325ac-81c0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784280127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280127, "uuid": "f39a0ed7-a009-49f1-88b2-98a002180554", "comment": "Malware payload", "value": "c7544686b010f7edc2aaad0beb30df9c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280127, "uuid": "3387e3f1-73f0-45d9-b657-dd66fd171b86", "comment": "Malware payload", "value": "e78621a003939efda0a6eab548c07a25167275be9fd70da1d4c2b8833fbff104", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280127, "uuid": "d6f3796f-5bbb-49dd-a0f6-9ddf8a6d5b35", "comment": "Malware payload", "value": "ea9d7f4cb9e38b10defc8799c408d8669e92d61c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784280127, "uuid": "0312ffe6-7140-4da4-a695-d56cc7b12e47", "comment": "Malware payload", "value": "77d65727ea7ff36d2dd460865347b859ab21fe6d1c9eca9f675772cb496cfba80aef89abe2c2fd14e3e61752c7314042", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280127, "uuid": "863525e8-c2b7-4f77-8aba-c7057e7057e9", "value": "T12601179C1E1ED018FBE2CB4BDF1CBBAAA9D29C968A304474E5B8401C943B1BC0ACB444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280127, "uuid": "f64514c5-be84-4423-ad9e-2d252d944884", "value": "12:CYhMHHHTE8EdHiDRncDkDiDiNFDEHw6dE1jiknHTRjiDQDOEdHieHmcDOVjI6Ear:ZKHHzpUHwRn1DweGQ6dkjHzRjwXUH1Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784280127, "uuid": "849a1dd4-9ecc-44a8-9487-4a7594b2b60e", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784280127, "uuid": "3e33c1f7-4859-41e3-8fdd-6acff9126bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784280127, "uuid": "1cde5415-fa8a-41ab-9d0c-b2b59e33c769", "value": "AdobeFix_WRQ4CT0J.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3224ebb4-8232-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784328752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784328752, "uuid": "b7891ce5-e365-4cc3-888c-ea9209e4e917", "comment": "Malware payload", "value": "eec45dd828c3a40c158aa74b97f086f3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784328752, "uuid": "fa28f5e9-28ec-4595-827d-5d83963c0c6e", "comment": "Malware payload", "value": "e7c92caf850de1f30e8ba00d17025ff795bd9fdcdb346cb4f1b8915d534c57a2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784328752, "uuid": "77fbf162-009a-4bcd-b441-777050e596ca", "comment": "Malware payload", "value": "a089d36cbc44b3f59aece3cb9477be9f71bc33a0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784328752, "uuid": "a578c575-84a9-4113-87ba-482e936ecccc", "comment": "Malware payload", "value": "6dc10d0b36849811cef29a93eeaea5db4e85bed7038c138b6eceee52f23a317b595967930a632dfccc00bc53b2d0657a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784328752, "uuid": "5ce67cab-bb4d-4fbd-9b47-f20bcb1b6803", "value": "T13AE63308B6D423EEDA73817DEEE28552E5FA74640335CEDB875842A52D032F28C39797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784328752, "uuid": "bac67e11-9628-4b7e-8309-e2bc1f4946de", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784328752, "uuid": "c05d0af8-8649-48c7-a5d3-2634cdafbc69", "value": "393216:01BK/WFsXvvA+xhDJXMCHWUjX6cuI3/PGTAI:0jWNfvA+NXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784328752, "uuid": "a37a56ae-4695-40d2-a247-29cb7e45a1a1", "value": 14298214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784328752, "uuid": "d6056457-a074-408e-a650-79e03b0da184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784328752, "uuid": "74315a88-1e4a-4dca-af34-d7c401b2ecd2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82ecdf5-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325138, "uuid": "f1105631-23e4-4d89-ae23-7c22482cef9d", "comment": "Malware payload (Mirai)", "value": "e06267366529ca2d21b384cbacb1c9cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325138, "uuid": "b20b3f91-1892-46f1-8899-33a73353fc47", "comment": "Malware payload (Mirai)", "value": "e7fc163bb51b02a1df59919f0b66b2feb0b58a7f69b6c1a74b33dcf655c43c1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325138, "uuid": "3a6af5fa-7583-4db3-aacf-97ffd2189bf3", "comment": "Malware payload (Mirai)", "value": "bc4c785b06441a3e753dfd46357c7e176ca20c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325138, "uuid": "cef56c71-e253-4bb9-81cb-124431957974", "comment": "Malware payload (Mirai)", "value": "c64df9c3ad4c5cffb1a3de47f6bc5277621ad2f2b51183928b25318ea4b9d3f57d1a72bb4b02e035c61f99918dec7bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325138, "uuid": "4ffbbfb0-a2bc-4e8e-9bbc-c6f1b4c2130d", "value": "T1D6F2F1BEDA881CA6DBD1A5F409F97299AFC14F093D905C8F34A0FF10061B0336A1DAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325138, "uuid": "f54a229c-6980-4b93-9d8c-e82fd2d528e2", "value": "768:+RNe6I3u3xGtklTASdcHZSm+dnljODdeEV9d4uOjqwC4uVcqgw09az:+ljGtk5Aycgm+dnlj+deOd4uCqt4u+q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325138, "uuid": "da9eb3d2-14ac-45b3-9b3f-108a6acf51b0", "value": 34348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325138, "uuid": "98a2e236-caac-4c65-b55b-69ec59b24142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325138, "uuid": "4946bcaa-c8ae-49ab-8e9c-16ce3846e91a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b4c4a7-817c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250543, "uuid": "763213e2-f37f-4f3f-80c4-d0e1f5c89e82", "comment": "Malware payload (Mirai)", "value": "adf1b34c494b3eca02ae3316c31db77f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250543, "uuid": "1b365ee4-a9c6-4595-b662-72bf529a7706", "comment": "Malware payload (Mirai)", "value": "e899c163318892d3d121b80e85b53c4b2d6361a27820b921a11d825413d457a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250543, "uuid": "2caa9845-29ce-462f-ab7f-e45ea50567b2", "comment": "Malware payload (Mirai)", "value": "7a9039f0537278fea97f244afc5bb25d45af1da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250543, "uuid": "2cea6013-9448-4525-ae93-3922ad84d8ca", "comment": "Malware payload (Mirai)", "value": "c184ac50117a36c4872d39573abf721a850fa0eb3ce90946709504e5e926208e0d9e298ec5cce9dc3a9fb814d655bafd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250543, "uuid": "a6e7725a-3cb6-45d6-93d6-6ca2c1a761af", "value": "T1D923E16250D68909F8750273C9DF2F5FBC40F29768459AFF23C86066A152A297F19B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250543, "uuid": "72190749-4a8b-4f10-8a24-f472caa18751", "value": "768:A5SFVzSlajq4M5tMbf8Ksm3CzFB9ix3DZkpae6wCawrbei3Glr2sbat3s9nbcuyK:A4i2BIFmypB9Av2grbeCuHnouy8Hy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250543, "uuid": "f14ca429-c2a6-43aa-afe8-f7f2dcd4f840", "value": 49832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250543, "uuid": "5fbeeab6-5c20-4991-80e7-cc1cee419f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250543, "uuid": "f208e1de-6886-45d7-ba84-f68d99a085d7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3654777b-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272066, "uuid": "79288b29-eceb-43e5-9fb6-9611419e6a22", "comment": "Malware payload (Mirai)", "value": "519fe853e4f2499aee0156dca4f210fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272066, "uuid": "8eb828f7-9a11-44ab-b861-55470e002dc2", "comment": "Malware payload (Mirai)", "value": "e8c081511d2d321547d48deec558d4201ca0f6a2bf63931a49a4447f957a53c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272066, "uuid": "1b61cc92-c721-4a1d-b28f-cedf948a40b4", "comment": "Malware payload (Mirai)", "value": "666bd406b9846f4e1ea3a63478b6ab786fe42995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272066, "uuid": "5f60887b-8ca9-43a7-919a-fe06137c116d", "comment": "Malware payload (Mirai)", "value": "e7f16467489461f3aa1d156ba6bcb05e2289a131f5df7f974bfc5caba4febbd42ed19b90d3afe2ad96ad53ee62e0422a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272066, "uuid": "5b5ab140-0a58-42e7-9ad8-18bbe6c99ec0", "value": "T1DA535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272066, "uuid": "2d4913f5-44a5-4047-a6a6-e556fd7b3943", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx69QnP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bFP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272066, "uuid": "7b5e2a31-f8b9-48f0-b612-7daa5c1972a0", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272066, "uuid": "afdb7394-ec22-4750-be4f-3fc9408214ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272066, "uuid": "31d0738d-f3c4-420c-b4cd-0ba367577ffe", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60e194e-817a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250053, "uuid": "d2195c2c-db6f-45bc-8999-1e4f6a84d9fa", "comment": "Malware payload (Mirai)", "value": "d2bf1805d108ea443fb850ae8baf173f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250053, "uuid": "f7e0a53e-d07f-45ea-bc7b-ea15e45b33db", "comment": "Malware payload (Mirai)", "value": "e8c0c3b714243b977d7279d191686a355c2ef73bcda1dbbca1c4f751f33c2286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250053, "uuid": "599cee17-e683-4ef1-a472-2d8ddcf8b38f", "comment": "Malware payload (Mirai)", "value": "7193de687e717e5104fa3d9892e192bc0210b66f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250053, "uuid": "88f6639c-5b34-410c-9278-1dba1c9eab5c", "comment": "Malware payload (Mirai)", "value": "7b029ea44cfda5245312b4c47c126cf287d8c45a4e9c3442ecb79a10b40ba270681ee242f9a03092051f19f57f77b836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250053, "uuid": "b68a2a31-67cf-4ec3-847f-b836eecb1a47", "value": "T14F23F156A43E2A08C66B7231757D31C310A4D08D7EB2803B8E80E4AA9A71F5DEC7D3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250053, "uuid": "eb2d1cdf-9860-4295-b67a-18505e3fc536", "value": "768:IQKTOSNoekrlarmeqOskbRUXwE5L4owd3jdJZQc3WrqamIHDLn4aCOkOwJnbcuyv:IQKTOGoeO1eqlXwOEowd50MTIjLnjaJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250053, "uuid": "a1d76c1f-f4a8-4517-807e-55d2a3c24eeb", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250053, "uuid": "57d10beb-6a7c-4921-9d52-a1f3f7eb2c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250053, "uuid": "e94e54cf-4d50-4e0e-9fa3-14eb8b4fb056", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55df5bb0-8173-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784246778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246778, "uuid": "6e26fb1d-d81c-4d3b-93e7-e6036c026f35", "comment": "Malware payload (Mirai)", "value": "369c3ba06e1a86ed979e1ac18be5d235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246778, "uuid": "88064b67-026e-44f3-8ec4-e9735bdb50c5", "comment": "Malware payload (Mirai)", "value": "e8e7b13785d70a3055fdebe8005305d6c76fca78530bc1f6497b4a76dc47806c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246778, "uuid": "25706697-5427-41a7-acb3-dff750758539", "comment": "Malware payload (Mirai)", "value": "1ed6709d7d370242bb69330437fab23d612fcd75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784246778, "uuid": "2dfa458c-cc72-4487-861c-48e4b57710d7", "comment": "Malware payload (Mirai)", "value": "b82db6c85ca071531842d53e95aa01fb586ab740cc4ec9627b169365e9a168209b90e5db7dda11e5aaa4021fd8296acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246778, "uuid": "68014c4a-bd36-4429-88be-1d1df07a56d3", "value": "T188F2E144BE7082CBCD84DC3E1E8C1735E6BE9A11BE05903183E45275DBB3DA5DAB3295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246778, "uuid": "d936750d-2b07-4de0-a8e0-3bbd0c60b7e3", "value": "768:GfI4zlmuIruFUZ+47HU49oc2UIFCPI1St0M:ABEZ57049bI8PGQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784246778, "uuid": "91dfc8c2-6590-4697-9913-8eb0506c5f43", "value": 35392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784246778, "uuid": "329584d3-5a70-4cb2-8cf1-7ef6832be754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784246778, "uuid": "636c2ef6-31b8-4b75-8dac-9856599a0e89", "value": "e8e7b13785d70a3055fdebe8005305d6c76fca78530bc1f6497b4a76dc47806c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df3948d-8212-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784315082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315082, "uuid": "c194ae23-5e02-4dd4-8a62-e15c6a2c70e4", "comment": "Malware payload (Mirai)", "value": "05072840d46e5d52716678d318177d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315082, "uuid": "4d89f41e-3b00-4455-ab39-c9863ba0b156", "comment": "Malware payload (Mirai)", "value": "e945fa3536a97c047b30b75a4efec6f9c225ed1bdeca11c4758c209873f68c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315082, "uuid": "ccfae4a8-fe99-4ae0-8831-0505d20778fd", "comment": "Malware payload (Mirai)", "value": "295a1deabc9c09eea23a631302c23ae4ee0efa6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315082, "uuid": "0fc193cf-1807-412b-9a7e-cd4de1940feb", "comment": "Malware payload (Mirai)", "value": "847c655dd0ad2d73924358e39eef5206ae5ab2287a6014ccae937d0b2c81131569ec6933884d87d1f9db01f7149be5fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315082, "uuid": "88247d98-eeb9-4439-b2b0-a2a6205fb1de", "value": "T12233F1E455CE8BB6CB7E0035803E8BCE7B62977C86262A31D414A31EF3706CA9D7D255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315082, "uuid": "52003725-bdad-49e6-b458-179a468d9519", "value": "1536:uK0yJ7rWjxB/x1dgOPXmFYxKghH/ObUExAIF1V8Dfw:3WmOvwYxKghfvEvuDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315082, "uuid": "8d6ab87e-0102-40ee-95e6-565fdecf5a09", "value": 55044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315082, "uuid": "4878f938-f052-49dd-89e4-04dc3e29ab33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315082, "uuid": "35ba7cc1-3830-4943-9c5a-06c3b4c57f1d", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277ead8b-81af-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272470, "uuid": "86889545-0c3f-4b95-b5a1-092781aae6dd", "comment": "Malware payload (Mirai)", "value": "1498093c07274dbd402be90649d0e515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272470, "uuid": "e80ac02e-f1ec-4332-804f-f1f20e9cb9b2", "comment": "Malware payload (Mirai)", "value": "e9d12fd62fbf22e4c98492bbda54cec19a3ba684739f7200a1eff1476657dc06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272470, "uuid": "cdb1cab8-afc3-4744-adf9-d7b3479be481", "comment": "Malware payload (Mirai)", "value": "a005a6b88a75b0d77f3f34e5d63fa8ca8fb9d405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272470, "uuid": "e0e28b3f-fd23-49fc-9168-f29cabd286f2", "comment": "Malware payload (Mirai)", "value": "c7579183892fab9ba1ac953f2a91fb551dff9a19b56a04c00d16c2830247a6716d7cf2516e74b299871cbc9391e280bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272470, "uuid": "193c7a81-8116-42f2-a3b1-f75f7b664360", "value": "T18BD38E989A4F6D82D3C7E37EFD593F63313678B442D4C2760A00955EEAEADD48CE2112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272470, "uuid": "137c7e81-8747-4501-a30e-895067728596", "value": "3072:xOs9+XkeobdMutVnQ75GfkFHKutwOjrgSYAKhR7A:xxVTbq775G8FJ6OwSFKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272470, "uuid": "9d4219da-e971-4684-a085-e6d3495202b6", "value": 133024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272470, "uuid": "570246bb-71ff-45a6-adc9-816504d356e6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272470, "uuid": "143106db-9502-4565-86d7-8d9d00c60288", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae90ed1-820f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784313788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313788, "uuid": "0e45fe55-1647-4d3c-abb5-341c4c1dbf7a", "comment": "Malware payload (Mirai)", "value": "1ffef8e2e9a327b7aeed36dd6d673ef0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313788, "uuid": "47f8e81c-db13-4b7f-ac82-683da0aefa39", "comment": "Malware payload (Mirai)", "value": "ea9da81fb5e4cf59f1ade367cedbea964fbc05b747248e4cfdf5083ab44f3329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313788, "uuid": "0551e965-1ee5-490c-bd64-f9ea06071a67", "comment": "Malware payload (Mirai)", "value": "47a7de31704831523303098d1aedd0309b09c035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784313788, "uuid": "fccd8921-79cd-42eb-9c7c-b2192e2170b5", "comment": "Malware payload (Mirai)", "value": "abe8e606b3f6d8c17012a6a0eaffb913e3a45bf09bb3faf1f980edc83289275072c097249c772078e25f1234abc65fad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313788, "uuid": "da1c1c5c-3586-4306-beb4-18c818c36f81", "value": "T1FBE39F68DE0F7D82C2C6E3BEAE490FA3312734B04551D2F74901A78DE5DAED58CB1522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313788, "uuid": "1866574e-0afc-4af8-b8bf-05a821e76c4d", "value": "3072:5Z8r0dZ5o86x9d1IYkIhi4Fs0jElAg6J0WffddtTsKhRcFH:5Zog51Ud1zh/Fs04lAkW/toKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784313788, "uuid": "b44cbe4b-5d91-4c4a-bc3c-61e19cc13e9b", "value": 145272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784313788, "uuid": "f4d000f0-9133-4af8-ac41-8619b1a2f171", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784313788, "uuid": "c73368bf-c45b-4944-a906-c05bc574ecdd", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d71766-8180-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784252573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252573, "uuid": "41cfed7e-dc30-4b8c-aaa3-3dfef4920961", "comment": "Malware payload (Mirai)", "value": "5c78ad0b879be5aa317767d14263a234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252573, "uuid": "f9cfe825-aded-44eb-b228-48b51ae8293a", "comment": "Malware payload (Mirai)", "value": "eb3f3fdc3f19e5ee7dd861389b3fb1fbd6b27b869b0977a11c5e8ead42582f0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252573, "uuid": "c608667f-c781-43fe-9039-77275bd7a004", "comment": "Malware payload (Mirai)", "value": "211b7dd3b7c5d7d5c797a3aafc5a576bf940e272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784252573, "uuid": "d1037841-0b36-4276-8e81-3ebf0fb35ac5", "comment": "Malware payload (Mirai)", "value": "4a7be0cc26590e9543cb45c77b89289d32f6be19c74b56d676383035236519f947cc92203525c515d6b8e77266c52d70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252573, "uuid": "ad11e92c-8f23-440e-89bf-9056664d5840", "value": "T13DC36D22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252573, "uuid": "9752734a-1728-4055-b270-0b975ff8b992", "value": "1536:qZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnfAlQAQKC1D+tAlPYm5XLxgFxHD:n3IbE/HnQBKC1ySNYOX1FXvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784252573, "uuid": "7473561b-ffe9-4427-baf1-4c791ac11dcd", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784252573, "uuid": "819fdacb-5a4a-43f9-97d2-256c4787c9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784252573, "uuid": "ef0bb49f-496c-45cc-91ac-60d97079f981", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88dc63b-81cd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784285652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285652, "uuid": "22ce3631-949d-4860-8031-c1bbaedcd24d", "comment": "Malware payload (RemusStealer)", "value": "13ded12e159546d1211e020c24e2a3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285652, "uuid": "a3213699-cade-42c0-9715-179380317f27", "comment": "Malware payload (RemusStealer)", "value": "ec6ec9530a5464685d0339faa60f39b1f9929688a5fa6ca65e009c5fd6102773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285652, "uuid": "38be6bb7-4778-446f-8998-b612d7beb463", "comment": "Malware payload (RemusStealer)", "value": "9c813ceef54cb9064a7f6bfcac87aafd8fd89358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784285652, "uuid": "ab296090-9e81-43f8-9d2d-02ceea61757f", "comment": "Malware payload (RemusStealer)", "value": "66a30da97349874b829854cd4312773f1b04e0a4f9b1c0d235aca88dbcc52c93caa002086a48d5b24de6446833db336e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285652, "uuid": "c740b668-5a3e-41a7-8cb5-5879c2120033", "value": "T120950219D7F404FDE1B7E974CE924906E77678490371E68F03A4A9A21F336A0993DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285652, "uuid": "e19856a1-83f2-4a47-93d8-5d33a26a41be", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285652, "uuid": "778de685-5d2b-4919-892f-60a7ab0cd629", "value": "49152:PgTbH94YxYqLFOiDG0c5BXbE+OSmCbSr1cnJceSIIvQ1tVC:42QLFOYE5lQSbS+nCetIY1HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784285652, "uuid": "e0a547c7-6c08-42d8-b40b-a67ee01ff18d", "value": 2028910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784285652, "uuid": "d108d01a-c86b-4733-977c-92fb172b808e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784285652, "uuid": "9b0fa0a4-1f57-48ee-9016-d82483c96d0f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88648a36-8207-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784310428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310428, "uuid": "8c2a11a1-cf71-4299-b2b0-40e1159ba82f", "comment": "Malware payload", "value": "34904485f6697cf833439fa96bcf9f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310428, "uuid": "492031dd-6e09-4841-9e8f-057aad320085", "comment": "Malware payload", "value": "ecac0e65d1323a93049136ece2c6ced6109aee4907f67f739f7b407b3e750f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310428, "uuid": "6bb5b69d-5f39-4faa-9b68-767a4478479a", "comment": "Malware payload", "value": "271ebd3973cdaba5e2c762374f7c4e686e1ef2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784310428, "uuid": "a4cab536-b343-467f-baec-b3462e491662", "comment": "Malware payload", "value": "8d0ef420ae6ea54caea674784063990b6f0569773f364a86ab487e0c9a25bccb58068a822ad05cfaf3d6b74a107688c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310428, "uuid": "64243d98-47a5-4403-aeef-c9c5a61e1c54", "value": "T1F696D42BEEB18228C55BC53AC4AF8E00D4FF7179073ACEE7599113657E02AD46E3E560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310428, "uuid": "70a5fdff-aa94-4ee4-ba63-69fd6451632a", "value": "fc8f02921a06b9af961f79067d418147", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310428, "uuid": "1f6f6772-510f-4227-963c-98f9474c4648", "value": "49152:tvlqNe/jFjueZYTXeHbmA+6SSagoz0pJjp/TGVUim13Le4H++FUQRR/TAW:nDnz6g13X7RR7AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784310428, "uuid": "0e5ff4f4-b5a6-4827-8d14-362dae902b3c", "value": 8708136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784310428, "uuid": "ab386d5e-dae0-4893-b874-a65e8f65509a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784310428, "uuid": "91fd875a-5553-40ab-a29a-627beea70c01", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82802bba-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784311278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311278, "uuid": "d859b866-ae6f-4980-9364-5b96bc1a42ee", "comment": "Malware payload", "value": "0e7d28454238fcb394d7360eaa764b3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311278, "uuid": "09d3d677-4f68-4777-8efb-1a407c20f987", "comment": "Malware payload", "value": "ed00b6f3764bbc97768ffc858b63a45a09bb472acb884eeff9f89d28c0e53269", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311278, "uuid": "122245c0-1b63-4eb6-ad05-4a0ce5d8ba6c", "comment": "Malware payload", "value": "8af02cccbc544aee1cd999024594acd6f9a8b4ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311278, "uuid": "51dc5dd7-cb39-49c2-93e3-586059af08c2", "comment": "Malware payload", "value": "87dfc5bda2d2b650f330fd45d018d72168ce81e79728c0e71f51c65644ccfc2d5682a8731e35a2cdf0ebed75ce507193", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311278, "uuid": "acb8a55c-51d5-445e-bd46-1742d15762ac", "value": "T1DC012D8AE25914C38919DF277F5D44009E88BBEFB1574B4C54A02D230E4D570793AF75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311278, "uuid": "3380fe17-1c4f-4d7b-8398-c89a3c8128bd", "value": "12:Kg3Jgeogw2L5gcxMg94sg8/ygpbTZgjwsIkGyg/YaG+grRFkRzR4:Keka/MUKuhk3IPyt+sk1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311278, "uuid": "5394a95b-447f-4910-872c-bcf9c0bc7007", "value": 794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311278, "uuid": "12d31a87-481a-4c0e-9cf6-1da7c5b34eb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311278, "uuid": "47a356d1-4e35-47c5-a8a7-99f647274591", "value": "top.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27f6a43-8192-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784260329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260329, "uuid": "5f64f4eb-7291-4677-8460-98bf2bb9b1bc", "comment": "Malware payload (Efimer)", "value": "e82a19747800d65ddf304d39198eef69", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260329, "uuid": "9f35382e-d819-4a84-8eab-61bae972f1a4", "comment": "Malware payload (Efimer)", "value": "ed92e83b34b68c9898477f927fa6de6571ffa2f305703f99c7a27fd4cec9241b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260329, "uuid": "c1015388-b383-4b1d-855a-f379a6db54f1", "comment": "Malware payload (Efimer)", "value": "32065d1a7c26eb1c464f095af5f6107d209be5ec", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784260329, "uuid": "4e7093fb-86f8-4a5d-8cd4-1e1b521db813", "comment": "Malware payload (Efimer)", "value": "423b4198865cd43f9acea2f3c5a8362a55748aa5e0a70f04bf18cdac1f0c100ef32524ad6349d6856cc0664ec85939d0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260329, "uuid": "2ca267e2-307b-458a-a762-158933699900", "value": "T118E6334865D002FEF673923CFEE15665E4A9B4665B30C7DF4B68D7A2AF072A0483C607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260329, "uuid": "3fe5df04-b327-49aa-8b04-55cbe43e2563", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260329, "uuid": "9fbd3c3a-5c44-4045-87b5-f2523982f773", "value": "393216:Fbs8U33yRMsanX+vq4448nXMCHWUjXhcuI3/PGTAI:F/444tnXMb8X2H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784260329, "uuid": "f1322a15-09a7-415d-a79e-5e0b4a92afd7", "value": 14314875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784260329, "uuid": "38fd2828-43dd-41f5-afd6-c910d4b33c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784260329, "uuid": "8f85c218-8a0f-4864-8a54-a8ea5f4d981b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48be4bec-81f4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784302161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784302161, "uuid": "da2eaa82-d347-4cf3-9ff1-26cf53f3462d", "comment": "Malware payload", "value": "9635dbf389258924544f46dc21c6d264", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784302161, "uuid": "7c0f2148-a2c9-44ef-b2cc-e863853e0c33", "comment": "Malware payload", "value": "ef8bb83a9be7d70ff03d653e5b8769bcb99c529b33a15874efd2d3439c63acf1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784302161, "uuid": "7df93450-496f-463d-8f2d-c030b31284c3", "comment": "Malware payload", "value": "0ee9482b76e3d99a7f77aaffa844475ab8f710bc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784302161, "uuid": "8e53fac7-fe84-4ea9-8d16-5abfe1097753", "comment": "Malware payload", "value": "d1369b3624a6e28183c072ef5ffd0e42226658409a04b45d5132d27053e68b83224acab743df8ac7007625b9f4cddc6c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784302161, "uuid": "74760f35-7640-401e-b371-e1025fb9f503", "value": "T1442733A66C222E83CA6526BB23531742AF310DB33B1187112D79F92D1CBD1F95B5D38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784302161, "uuid": "969b7907-930e-42bc-9350-f91b6d476482", "value": "393216:qxpcnQgoS3glFQv87upi4GCAKUdGCu3et11Gia98fiY:qxUmpi06JA7d5IezqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784302161, "uuid": "1e7cf8ef-9ea2-4bf1-97e8-5a8c64026370", "value": 20357120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784302161, "uuid": "24aa510a-ff6e-4729-b60e-a641c6378587", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784302161, "uuid": "0b99e52f-7933-4132-b122-2905e337ce00", "value": "Game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cb9b5a-8190-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784259227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259227, "uuid": "34fa6358-e20a-4ce4-9f8c-fc4af1fd0c84", "comment": "Malware payload", "value": "a59e1081c64b62686bc941ef7ec38c36", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259227, "uuid": "cbad19d0-5335-4d77-8f8e-5dcd6b6c7cb9", "comment": "Malware payload", "value": "f01dc226fd5602bc34e89dc712b84d8dc3783ff049d3a1344d698f1cfcb3dacb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259227, "uuid": "aa784d30-1c63-451d-b9ef-5280743bee1e", "comment": "Malware payload", "value": "58a8fe2fa581596b63b5bea4f7722e5a8ae2a63c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259227, "uuid": "61926a95-ccc1-4d53-bc51-3d51396d8b39", "comment": "Malware payload", "value": "971a0b89dc028d4583301743d9a9816f342f353600a503ab390b285e494ad69827ec57fe05be9fb5fd083d4e9bd08a67", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259227, "uuid": "44bdcba8-8c42-4f33-a1ad-e0ba781d75e2", "value": "T153C20AD3BF5106938DCF139ADDBC0FAA8C94CA6580317C70ADBD761AD441B5822BD62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259227, "uuid": "d0606f7c-0bf6-4c42-ab54-ba364402b2de", "value": "768:o6r2zEWuuytebDf9TfGfbfKff9K+NqDCKR2jXvIzKc6hqiiEIORLPcY9t:+zbGeblbqDCKRmXAec6hqVEfRrcYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784259227, "uuid": "d4d236ae-3d05-4f42-94b3-7f0fd09cd795", "value": 25904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784259227, "uuid": "e83774c8-c9d5-4186-bba8-b5b095f8b1f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259227, "uuid": "39ac2632-238c-429e-84dc-983ad509150f", "value": "DHL Shipping Document-2774038374-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d6f8a6-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "445d88c6-2bab-46ac-abf9-47fc500a08c1", "comment": "Malware payload (Mirai)", "value": "1ad220c97e6dc56080c65d24b71261a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "9099ca98-579a-4f09-a70f-e376d9b1bccd", "comment": "Malware payload (Mirai)", "value": "f0245ff2a2a0086c7c21184688cfecb13c72cfafa64bf06608bd673a79939002", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "1a2fa179-f30f-472f-8ba6-fce11d4aef55", "comment": "Malware payload (Mirai)", "value": "538d80373c2d165b7fda794c1e5f440c7202736d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311369, "uuid": "11c1e57c-e83f-4531-9ae5-b15878feae80", "comment": "Malware payload (Mirai)", "value": "c15a559d11ab3167ba7c7a2fd5a3e06f48a8bfdf44c00f1fe8ea55d97c3e1dff5f6b24ce2b1999972a88ed203fb7e17d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "7c86cbd7-3294-4dac-ba50-20f93677eee7", "value": "T18E330233CC5F61BDEB3559B16E00418F9D0AB9177A0E825B56D64AEEADA38093D21F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "082e411a-75af-4466-b469-69a7476ddb3b", "value": "1536:y3aErvPWxcHGWDMrfnY3FKIRQxqwHb0pnI+ToyShKGO:y33CxV/Y3FKIOxWnI+ToVhbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311369, "uuid": "9ab9255f-8a2d-4e12-a67e-495c0dc65e4b", "value": 54824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311369, "uuid": "386e9967-030a-49fe-b08a-a241da55ecc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311369, "uuid": "4c46e112-3380-4c2b-8942-4f094b0c5054", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5d9a9a-823a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784332470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332470, "uuid": "98c4ac6f-a0e3-4720-8340-7df21786c8d6", "comment": "Malware payload", "value": "f1cb1044e428a4ace0ecdeddc8bd0310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332470, "uuid": "f1064ae5-a49f-4893-842e-c1c91b18c029", "comment": "Malware payload", "value": "f0506419d1f60d7180e72fdcca97d5446d3cc3218d61b11dcd39b49086553683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332470, "uuid": "738873bf-2edd-45ba-b4ef-efdd9b30d374", "comment": "Malware payload", "value": "f3dfc49825a5b870d77cc4298326df10cdb6cd23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784332470, "uuid": "ffe79bcd-1893-4942-9b5d-460355c9d343", "comment": "Malware payload", "value": "44639ce93168a39a68c1f1b7d525f11a4071663fc971609c6dd17a95c1fd4c6c453835107b66016f1b6e17abcdbb974d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332470, "uuid": "3c73e48c-6c78-4ad1-a1af-f7bf54721f47", "value": "T1CF530240C0D39857C5ABD6B93A8DE75867E419527AA8CBE023EBFF49783A7C0317015A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332470, "uuid": "3a7c2621-15a6-4ba3-88b2-16c991e9f593", "value": "1536:8KUohruhQWQL/wB6E++BOpw1CYAPwJb1Jw7oI724u+qgw0rC:NruhQFHF+BOG9k2nw24u+qgwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784332470, "uuid": "364dedbe-fa74-46b1-9a85-8abb46bc66a3", "value": 63812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784332470, "uuid": "508c3ee3-7996-4099-a875-a3e38f4d6305", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784332470, "uuid": "50c3bf48-8c62-41d0-9e65-e5eebcbc6922", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd32b7fc-8205-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784309765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784309765, "uuid": "a972828c-317c-4d3d-add8-d2ba24c64967", "comment": "Malware payload", "value": "30b745701be57954babf44deeae61207", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784309765, "uuid": "25fab4da-2c0b-43e4-9992-a109dd220136", "comment": "Malware payload", "value": "f1399b63b5e465a0814715ed4c424818cabb90c897c0370f16bd4a7529218841", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784309765, "uuid": "142c456a-452f-47fa-9a4f-500d3ddb9600", "comment": "Malware payload", "value": "d8cf63456d4f2babcce0522f2187f8a2e8c8dc9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784309765, "uuid": "8bd62342-1155-4eeb-aec9-331d53ac0818", "comment": "Malware payload", "value": "2c188f5611f11e048b4b484a0ef7fd240eb3bc6cb16d5d48ab91f8eac5e8da1ddf2179f409ffbc0b419efeb8ea7b4785", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784309765, "uuid": "b8daf0cd-6b1c-49a9-9bc9-f77284a0a7b2", "value": "T18657AF15A3C8E5E8D566FA3C8B51A2F2C1B2F4167F71A0CB1A9DC3051E7EA914B3B701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784309765, "uuid": "9134ac1a-dc4c-41ad-9465-d3df1e2d6136", "value": "6c7c7d766e0c19989a7d5bda167a464a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784309765, "uuid": "ca0f9452-db84-4e1f-961b-c03ee9c8dcc2", "value": "49152:fQ0eed7I99gkfdmwYZ1WtDPQTUX1r/p9MS0l9zAP:1K9zrfPQTUX1r/p9MS0l9zAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784309765, "uuid": "fc5882c4-5ff8-4352-adda-51bbe9642011", "value": 27113984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784309765, "uuid": "948f0147-bd02-421d-b60c-1177dee135c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784309765, "uuid": "7658e7f1-a747-453d-ac9d-d0582b1ac6c5", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468be108-819b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784263932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263932, "uuid": "9d50a698-0e37-4ce3-a5fd-c2820fd16555", "comment": "Malware payload (Efimer)", "value": "70e28da1774c159e38203a81f26cfa05", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263932, "uuid": "99b60aef-18e8-44b6-9433-47e594e6ce3b", "comment": "Malware payload (Efimer)", "value": "f14937900247bbc5690a77efa2c85f55fa8d88c7ef0128c177aab9581290e9b1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263932, "uuid": "efa53516-37a8-4e2d-8ca4-5671522d5393", "comment": "Malware payload (Efimer)", "value": "a810e7a0af9b714511fd377548b6e0ca29f17f0d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784263932, "uuid": "d6ccfbc6-a73f-468b-a665-b50f28077b36", "comment": "Malware payload (Efimer)", "value": "25bf934b35d4de6d2808fb556ab26b2bc3ff08f2441edcf31381815879785c9f8bca3de90eaf9e8e543bd2e12a26533f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263932, "uuid": "6cad98b8-9f3a-4f82-a79a-5b945b447e58", "value": "T15CE6336856E011FEFDA7023CDEB24996F218B8A947F6C69B5B5487921E230C04D3DF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263932, "uuid": "3cf3d7e4-dbd4-4343-ad35-e0e23052af7d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263932, "uuid": "01851a1f-5af4-4662-8423-caad2fc19a68", "value": "393216:LkDt4UKvrFWI5Byzty3H40DMrFImVFXMCHWUjXocuI3/PGTAI:LkJ4UupWI5dDMK0XMb8XdH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784263932, "uuid": "ebe82104-83d3-41f1-9d64-adea1d2abd33", "value": 14332359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784263932, "uuid": "d78cc4ac-da4a-4f1d-a268-d9bdb53d776e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784263932, "uuid": "be70c304-361b-4060-878c-58ce5bb113e0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f943e8-8215-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784316570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316570, "uuid": "851d1230-58f2-4d22-9a23-396997c1809f", "comment": "Malware payload", "value": "9f606686c3d975321a05a6436f0f5674", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316570, "uuid": "ade4d7a1-91b8-4772-ac3f-52307879862e", "comment": "Malware payload", "value": "f25f1411b52a0b9c903a79b77d10991717028da89b21decbc3f1c1cbea482f31", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316570, "uuid": "f15c4065-b165-46b1-a504-53b08c9f3d38", "comment": "Malware payload", "value": "479394ed6ac3cb353eb0baebecac5893e144efef", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784316570, "uuid": "b060155f-e227-459e-ab6c-9caa01e70b34", "comment": "Malware payload", "value": "4660f1d7e07c49696dad1085dfc02c8e248e5e40a0c731a5ca441f0b530b0330bbf40d325d573c1ecdbb633741c1a478", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "completeyourcheck-com", "colour": "#C3385E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316570, "uuid": "165a50b6-77f7-4030-b99b-578ef3466105", "value": "T141A2F13BC931FC94875E360063641C9922995526D3F34E6CCB1A3CFA7D367A5FB24A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316570, "uuid": "efb20eb8-21cf-4a9f-b5aa-2d7776c5b5fd", "value": "384:Q9lojCEnmRGour9zvvW9wVgMeW4ewQ3tY7bv4BWyUmYqJFPmy7Af7dFjOimb:XjiB9PMeDrQAYvL7AxZ6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784316570, "uuid": "5fca8f65-5b78-4234-9a57-087f14e46f1a", "value": 21502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784316570, "uuid": "73a65d5a-4702-4e0d-b924-66bf02d08b14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784316570, "uuid": "964efe42-b1ec-430d-85ff-9c0a2104b639", "value": "Delphin311.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0d8069-81a7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784269314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269314, "uuid": "6041dd11-dc0a-49e5-8eda-2b787208f966", "comment": "Malware payload", "value": "dd23c555dc75ba47510c4c0a9013ada7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269314, "uuid": "5c79ca4a-d3d9-4390-a958-73858de91f71", "comment": "Malware payload", "value": "f34687d44e10545ce63c1d36f3fa8ff1b012bfdd0a3d0e4414a66faef2a9adb7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269314, "uuid": "20eefdc0-c6cb-4398-873d-4f736b7b4b36", "comment": "Malware payload", "value": "b44e3194241fb0148ff972bf07dbea9e2158ee5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784269314, "uuid": "75a0cc01-d268-48e2-a676-50f717272327", "comment": "Malware payload", "value": "b54557ac7c5496113e8526e9ba6aff18ae5f99f44b1d8b533cc6e87f8fb298751dcf849bbeed5fd5d32a5e055b069209", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269314, "uuid": "f8a4e01d-20f7-4ea9-b9ce-b5001f86e694", "value": "T165237D652A857C14AA98C4371D7E2F0CB9AD43E6320452ED7FCF3CF68C4A69DA21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269314, "uuid": "6251f93f-c9ec-4679-b31e-4be28dba8b4f", "value": "768:IXOGVvx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:eLScr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784269314, "uuid": "4f34707e-c85e-49ef-b63c-dfa7a1ac0b1c", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784269314, "uuid": "c77f2f19-6fe6-433e-b0f8-56a6f3d4acce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784269314, "uuid": "261e12c6-e11d-4691-8857-51768e59e682", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b2041a-8213-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784315437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315437, "uuid": "0218eb6a-b7e3-47f8-a07e-841b66b11868", "comment": "Malware payload", "value": "0f7d41fbd9c501030bbac601cbfe1f51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315437, "uuid": "694f7e77-98bb-4273-9571-28d7a33c6f0d", "comment": "Malware payload", "value": "f4414c6a299b73dd0100b0912bf943c8cdee505179e22609fba6fdc0c4ff6e33", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315437, "uuid": "4653cf84-4955-4841-8acd-529ac3b3073b", "comment": "Malware payload", "value": "4f786b33398c8b2bebb4242045e06a670b050b43", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784315437, "uuid": "96a53f4f-7bfe-4ac4-9510-3e787943675b", "comment": "Malware payload", "value": "63cecde81b061b1ac799539b202f2b07997660d56a52ab9d747d666f8ee43cab35cd69c97156cf0a62fdbdecf5a3f784", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315437, "uuid": "755893fd-dd20-4fa8-bac5-321d504cd4b0", "value": "T1BA236C6516857C14AE99C4365D7E2F0CBDAD43E6314492EE7FCE3CF28C4A6AC9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315437, "uuid": "3d5fb83c-dd10-4c19-b08f-44d8a3902d6a", "value": "768:wr9NyXsZztCr9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:+HusZRcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784315437, "uuid": "df6e170e-d285-4f59-b1d3-9a89ee65e5ae", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784315437, "uuid": "16e68531-083d-41ae-bd79-6ad13a6d8f51", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784315437, "uuid": "751dd7ac-0cb2-40a1-833f-cb9171f18244", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ef180e-81b2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784274023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274023, "uuid": "76d631c3-6007-4bf2-9cbf-df1633ff326c", "comment": "Malware payload", "value": "b8fbf3f47f93f6a69bf27c37aa4f523a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274023, "uuid": "53083d1b-c4ff-4a2b-ac8d-d0b60dc118be", "comment": "Malware payload", "value": "f5a03272e3e0d6960f1fa2402086c33800f19742f33817a41e2467bdc84c0610", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274023, "uuid": "189d17bf-e009-4420-9c78-c05af1e07a4f", "comment": "Malware payload", "value": "513c502c931463903702749dffce0f1bc86e95bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784274023, "uuid": "1357dedc-f694-4024-bdaa-f7f17fe7dfb1", "comment": "Malware payload", "value": "c48223768321c908c9866247e27e9afddf353b1a10dfc67fb567191e936805844cdcb221fc4ce05e3fabd460c4b1eb01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274023, "uuid": "578ab78a-db84-4b2a-ac37-56f0ad59baa1", "value": "T19801ABCA8610AC1050AA962D32DB6064F821C3CF255A8F68FFAC2D3DFB84D14B076FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274023, "uuid": "abbda978-104f-46bc-9111-9ca88937f109", "value": "24:kXCKysE2hi0ziQvZohaqFx+DUBpPPias76CX:e9Qp+MsqFsspniTzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784274023, "uuid": "ca33ee79-e991-479f-8910-e94fdfe76f5b", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784274023, "uuid": "be97497f-8870-4584-ac2e-75d8bfb50ddc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784274023, "uuid": "27402bf8-8260-4f93-b57b-05ecec77d843", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b03e73-820b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784312093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312093, "uuid": "7b162783-e502-43bf-b46f-48e2f18b6f08", "comment": "Malware payload", "value": "afe11bdaf1b9a20d09b93ee751a62fd0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "stage4", "colour": "#C95A61", "exportable": true, "hide_tag": false }, { "name": "startup", "colour": "#DB54A1", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312093, "uuid": "1450c132-da75-4ab5-a6ab-f9eca0fa0f12", "comment": "Malware payload", "value": "f5d529b55ac008e42e36d580ffc94ab73f1e26e67a3efc24c46b007dbaff29b1", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "stage4", "colour": "#C95A61", "exportable": true, "hide_tag": false }, { "name": "startup", "colour": "#DB54A1", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312093, "uuid": "de7fc082-401b-446a-b2a1-e287b6c59457", "comment": "Malware payload", "value": "6245b5fb06c6f016116c4a9e96212a545c875262", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "stage4", "colour": "#C95A61", "exportable": true, "hide_tag": false }, { "name": "startup", "colour": "#DB54A1", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784312093, "uuid": "34df30da-7b2e-4e8a-8c1f-e6cef5d4dbb0", "comment": "Malware payload", "value": "93715715fdf8048789c62789ed21486fea3accdf8ec996b893c4e92ba9bd5956fbcd800a1afcf24771a8cb856cc984c3", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "Polymorphic", "colour": "#A69B19", "exportable": true, "hide_tag": false }, { "name": "stage4", "colour": "#C95A61", "exportable": true, "hide_tag": false }, { "name": "startup", "colour": "#DB54A1", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312093, "uuid": "95ceb365-b24c-428d-867f-5e5b54766dd6", "value": "T19273A35973FC528DF9EB1BBDBCF007904FB8EE332202D21D698950956921BC99D04AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312093, "uuid": "dffb08f2-8b51-4fc1-8940-2c55634cec6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312093, "uuid": "7995f8ef-0d1b-409f-b05a-901c64f81ef2", "value": "1536:mUrnNpb9CE+AR8MdEgY9vVXghuoBbEQ7c8bby7+nX:mUrn9zR8Mw1VXghuoBbEGVby70X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784312093, "uuid": "fc87aabb-cc61-4cfa-a584-794c30834f60", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784312093, "uuid": "99b256e6-a21f-441d-a27d-f3f37750c9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784312093, "uuid": "be5830a5-1485-45c5-a559-b1973e498b77", "value": "getconfigurator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca878535-8229-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784325142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325142, "uuid": "cf0840be-62e8-4360-807e-dcb2312fbb1a", "comment": "Malware payload (Mirai)", "value": "8be43983df3f0a4831bb19e7156f8839", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325142, "uuid": "91fc35d4-4560-4e8e-8300-f6842eafa29a", "comment": "Malware payload (Mirai)", "value": "f61b34f5102379e1909af5679cfce9100c238c729b4c5b3dc7f435e232461768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325142, "uuid": "0ded0597-6791-4f46-89a1-19b9461decfb", "comment": "Malware payload (Mirai)", "value": "cc35aea55528f73b92d9c2899a3ab901c68d9870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784325142, "uuid": "d6131d40-76eb-4d95-b361-cc4d1dd8a6be", "comment": "Malware payload (Mirai)", "value": "4235815234449a27dd90a54e4252c3b27b8209d18fa69e1f092b106c0363c7981bf5c6699d968a24ba04467dd678dd41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325142, "uuid": "34435848-1e4a-4978-9e4c-24492d24f96a", "value": "T15603F1A9E9906E0FEC9F14FCF9EC5B61C92724A03696179F1301C88DE126F177846AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325142, "uuid": "8b8f3c51-819c-44f3-8215-aec376545312", "value": "768:CIfYhW5y5yShFUP1jWQYhaca8LIw9eB9spfWdNhrPcWLu5XNWt:zfYgkMShyP9+cILIw9eIUUXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784325142, "uuid": "5ca455b4-398e-4b6a-99be-07877c5cb36e", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784325142, "uuid": "4f6cc40c-cdbc-4e27-aeda-b2cc150387bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784325142, "uuid": "7d5b1f85-a9aa-4f28-b956-5fc72d4ce5cf", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc58e35-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "d0594652-1fb5-48b6-ace9-3d7dacb5a1bf", "comment": "Malware payload (Mirai)", "value": "876f31e632456d251d3975b6cb2de84a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "a5466738-66dd-476c-b93f-efc1a75cdb86", "comment": "Malware payload (Mirai)", "value": "f6da52888afed6ffcf530fbea0c2eda80ee58b3f3dfa08ebce040a3f6bf6a254", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "93b657ac-e13f-41ff-bdaa-1cc0b259f245", "comment": "Malware payload (Mirai)", "value": "d6a8c5134e214cd09534c190cf562952f5b50564", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "08ff34d9-bf0b-4da6-98d4-58130b1e1b33", "comment": "Malware payload (Mirai)", "value": "59595b00eb0cdcb49432939d6d0260a4c18294ef8c919117a30776fafc2eaab8785f74179706746d3b45e658cf2feefd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "77aa5fc7-f068-4bed-948f-5822e74dd076", "value": "T12BF33B56EA418B13C0D22779F6DF424933239765D3EB73069928AFB43F8679E0E63106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "2e94f1d5-7528-4c97-80fd-3a6a617aa049", "value": "3072:nkOsKrXxvtau5XLjXILBsgCcFzlI3yjrM/9B7K1:nkzK7xvtau5XL7IqgZFRI3y3M/9B7K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311266, "uuid": "31381071-4332-4588-a1ea-8c33a43dd6cf", "value": 171052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311266, "uuid": "d52b8cec-d484-4f5f-87c8-21ca9d607307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "a5fd0936-e9a1-41e4-87af-33ec451f4930", "value": "byroom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5786c97-81ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784270990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270990, "uuid": "6f96967d-9453-4127-b3ef-1966d06cdaa9", "comment": "Malware payload (ValleyRAT)", "value": "0aee8c4a3d2dce923399b73a2e12cda0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270990, "uuid": "ca89110a-32b2-407b-a4c6-46f411f5e035", "comment": "Malware payload (ValleyRAT)", "value": "f7cfbe384328e18a2fd0396d3c071c435b2e52ee76d7e163213ef56ea264bdf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270990, "uuid": "e2d90052-8e91-4d1d-b3fc-1a78a32a2866", "comment": "Malware payload (ValleyRAT)", "value": "852455896e03318639b5013b7edfebb6c49b5339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784270990, "uuid": "80b90921-d086-46e6-aa45-d3f36603a2b6", "comment": "Malware payload (ValleyRAT)", "value": "5970bfdb8ab6bebf9f4b72d19e167ab412286fd42f2465a33c9037599eef22f40e36129f3f4ba6f37e673204c289c9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270990, "uuid": "8c396dd4-f997-42a2-b1ae-9b3aaea019d4", "value": "T1DA0749FB30D4859DC19EC13EC2538F55E93F71BA0736C2E7629452A41E16AC42E7EA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270990, "uuid": "9a8fec44-24b7-461e-b18a-103b7f3fe76b", "value": "df663ae202ee069eb0afc7b268b8bcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270990, "uuid": "8e9ad32e-0405-4a5a-9307-fc50588a862e", "value": "98304:goWSLr6oM6DvnGyO4q/Ys2eFMeqggEnITJIOvOLoNNvqJYktz8a5gkUwQbfBEEn8:zLrlMKTOTYs9FMKXITpvqZtvgkUwQND8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784270990, "uuid": "5f40b75e-9bbd-465e-ab0f-7c9ff765c89d", "value": 17926016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784270990, "uuid": "aa09b9d9-1c1b-45f9-8e0c-bc81b06d7b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784270990, "uuid": "68cb022e-217c-4615-aab0-788cd4b5d99f", "value": "2026.07.17\u9ad8\u6e29\u4e13\u9879\u8865\u8d34\u7533\u9886\u6307\u5357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49ecc45-817b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784250427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250427, "uuid": "6e71fa74-81dd-4b4b-b3ef-07bf9ad8fa19", "comment": "Malware payload (Mirai)", "value": "da92e64fcd280f8c65a38ab9e611db29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250427, "uuid": "e756bcb6-7f23-48e0-849c-b602b1f64d2b", "comment": "Malware payload (Mirai)", "value": "f8956e30821ef8a73215795e607abbe14b6d3efa17f9ba47fcdafc44b1f20e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250427, "uuid": "54931734-9abf-4a31-892a-45221c03096b", "comment": "Malware payload (Mirai)", "value": "d825e5512e4e60df767abb7ec848a9691f19fb2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784250427, "uuid": "fdfc70ad-a642-47bf-be74-a777da12ca30", "comment": "Malware payload (Mirai)", "value": "853d12c42108ffc1e2e80ac2ac5a58258d042162df7efeabf1c8a6bb3f3c34f951012a83d95dcf6cea5f65f9b26763ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250427, "uuid": "2ccfca36-0cb7-4670-ae56-8d16cb39a43c", "value": "T1444301FEA9ABD1B8DA1388F6958022C1BE341C0B77787967145843DE4DF7DA12B20F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250427, "uuid": "fd05165d-f609-4bff-af94-1f0b76bb619b", "value": "1536:hc0/7x0Cn9SsMwkDeQaWVcsnMywKu+oavnkzvgZUd/v:xtZnsUkeq+l4vnkE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784250427, "uuid": "5995730e-f131-49d8-9ebe-0dc0e4b23455", "value": 59676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784250427, "uuid": "19aa92d5-6999-49b9-9df5-572d0ca6912c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784250427, "uuid": "56490f51-82c0-4eb5-9c7e-898424c584e6", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52213ce6-81ca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784284138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284138, "uuid": "8e4983b9-1156-4d06-8371-cf42e1263d97", "comment": "Malware payload (Gafgyt)", "value": "6f0638dce9849e8e55a62e1c55d14c1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284138, "uuid": "92534dae-ec2b-4e2f-9dc8-04f4d893e83a", "comment": "Malware payload (Gafgyt)", "value": "f8a9d922bb5bbc11e2e4e4d195d259cdcd6e6c9cf45e19fd01f5dc078deda035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284138, "uuid": "4dfaa69d-6765-412e-b88c-299cca5ee261", "comment": "Malware payload (Gafgyt)", "value": "655383f7ae6f02407680a3b89bcde5cf3ae2cc61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784284138, "uuid": "df9f8b81-b6a6-413c-9a26-4bbca789e622", "comment": "Malware payload (Gafgyt)", "value": "645cd85a28e918b048c3b0b76a48d6d05cdab1266eebb530d627871ae6be58541557db208f60fbe9e03a53afcebe5003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284138, "uuid": "391877b4-1efe-4584-9fb3-fbb631ab3d64", "value": "T10EC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284138, "uuid": "0d318a49-f62f-4876-b237-855ddde2280b", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBetEdWfRZrmW+IFj:Ted0W0MZQHdd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784284138, "uuid": "ec88ae74-51f5-4716-95e3-5ae580a97364", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784284138, "uuid": "0c177720-dfc1-4825-847b-4d38bdb8c31a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784284138, "uuid": "7177f6b6-ac39-48c2-ba53-9bde1da66802", "value": "mips.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e889199-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278683, "uuid": "1731729c-bdbb-4b84-9c15-7eeb18e8ddcb", "comment": "Malware payload (SilentNet)", "value": "22dd342b94e75f41723caea57b703c51", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278683, "uuid": "75710267-b24c-46d8-a37a-5a1c9a5feadd", "comment": "Malware payload (SilentNet)", "value": "fb1484da86fde095c472120323958e0e9f4ccbc6a42045782afbdbabbdcf3bd6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278683, "uuid": "f79028db-c25b-495b-993f-683816caa4e0", "comment": "Malware payload (SilentNet)", "value": "244ba834423020e937b4f2c0fd887969cd994e81", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278683, "uuid": "bfb6b926-dc2c-4949-b368-726c7d02a0bd", "comment": "Malware payload (SilentNet)", "value": "3c5af4f28d900a6ca8546543145c4804ec14169c52777f5f22489829b02b665b3fe4f744c58082f075a09b12854ab384", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278683, "uuid": "7d9d4ab7-32fb-4bd5-83fa-09677fbe36ea", "value": "T19B353384BC1EECDBC081A9F944E6454ABFCD2399A62CF3AE07C3A5681879D14D1DC3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278683, "uuid": "32b3296f-d335-44ec-892a-3bbb48562824", "value": "24576:ORO9d2xg0/r0plSxHnywp7Etm5h40E0K2ptGM6JiR/Cf0xr4w:A/r0pl2yUHY0E0K+oM6O/Cf0J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278683, "uuid": "a264bae6-5197-4b7e-beb1-0e3d1d0db467", "value": 1074444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278683, "uuid": "293973c2-4d8a-4a2f-93a4-e1a3a2de3280", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278683, "uuid": "b33fd524-2c0f-40cd-9190-94fa5d4ae487", "value": "lemons-txtpack-hub-1.21 .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ad13a1-81fe-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784306372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784306372, "uuid": "b148f8ef-c1f7-4f51-9a40-66b51d2797cd", "comment": "Malware payload", "value": "6cf0d2d0df8483c81b8ab00e10127398", "object_relation": "md5", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784306372, "uuid": "0db9c3c8-5f13-4235-adcd-711972b8f689", "comment": "Malware payload", "value": "fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe", "object_relation": "sha256", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784306372, "uuid": "9b8e9b8d-4cbc-434c-a1c9-af6136da56fe", "comment": "Malware payload", "value": "1e787ae4c593cb20864dab2aec242b12c2b3bb52", "object_relation": "sha1", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784306372, "uuid": "ec317fb1-5508-46ac-9824-40b236c7acca", "comment": "Malware payload", "value": "db70d3eb955c78ad293b069239109f09884ff67cf0842b9a8f814a6e45c674410d4dbc555d3dfd7ac2b488779c2f6a87", "object_relation": "sha3-384", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784306372, "uuid": "50ece4b3-f890-4f04-ad76-cb18344bfc54", "value": "T158516AE2F39567F453C511B7C00B390BA0EA9F761D1D916CFA21BCA3B43A33580A6744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784306372, "uuid": "289a4fa8-43ab-49f6-92a1-135c2313f3bf", "value": "48:WnVpb2KIyxMckbLwzkbjexXyscBPS+iw9BnJYjQmA0o9zWv7vHE8PWPQD:WVd2wepbLwAb6t03XJY0pP9zc7vHE83D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784306372, "uuid": "0030b114-0ddc-47ce-9409-d9adb82044c5", "value": 2744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784306372, "uuid": "b8c74288-e935-45b7-ad20-447690ed30e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784306372, "uuid": "7a506680-2a91-4229-b347-4396a149bc7d", "value": "Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6ee807-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "30061818-6036-4921-a5c6-6e52370935f2", "comment": "Malware payload (Mirai)", "value": "cb9e3310783f1d09f134fe8e60567bca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "7e90f36f-97ff-4926-9f83-161edf19aef3", "comment": "Malware payload (Mirai)", "value": "fbea872b415ad69d7be7a4a7a2b4c8314395ee8dc71e2055ef36f8a1357a15ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "4c773ce2-979e-4040-9754-92a0c19c11ae", "comment": "Malware payload (Mirai)", "value": "b4567d0e885074e72b10084d65e3424c0b40ded6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311266, "uuid": "cae109d0-10b1-44c8-820c-8b749b780b77", "comment": "Malware payload (Mirai)", "value": "33e50b99472766f4872aa6e7603e2b1450c603a2e6513956febbae0b27bf667ce7d5af3ab9ceb9cf947d680005e15cff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "0bcc49a5-91f7-43bd-915c-5842b6a60624", "value": "T183931956FC818B11D5D1127AFA1E028E331307BCE2EE72229D246F2477CB96B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "1b4ed281-5320-4fa3-b059-a7511257da6a", "value": "1536:nXnLVk8uhTBy7VhTyUky8oktdDAwmGaAUoXBzNZISigVOCsdp37RA5bYJqj:JkfdooAwZaAdOCsdp39AB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311266, "uuid": "2bf513c0-9947-44a6-9b24-a7428e30c010", "value": 95896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311266, "uuid": "309c469f-e869-42fa-93ce-a361ba681c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311266, "uuid": "99a608e2-3b91-4452-b2e9-de3ee2b21f69", "value": "byroom.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371310c4-8235-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784330049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330049, "uuid": "83c621b6-ca64-4402-9d2d-771092c28fea", "comment": "Malware payload (Mirai)", "value": "0d3b8238ad92d6d863840ad22194fea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330049, "uuid": "92b5c0ec-bf1d-4a5d-978e-6880265164a5", "comment": "Malware payload (Mirai)", "value": "fd0ff75925ea15760d72c1a9ffbcc0e751abebb2f4cd49f0bd11274a04706217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330049, "uuid": "e7aadbf5-959b-4047-bc9d-512adf771d98", "comment": "Malware payload (Mirai)", "value": "3a4653631a0cf18fd218daa4ae5a7bebe01e0c59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784330049, "uuid": "8355071e-d7b2-4298-aa45-f234beaf2222", "comment": "Malware payload (Mirai)", "value": "b74e7b6fcd941932d390420870058800759f3bde67ea105ac319e31aca476462ceb9de27776262b0e8f398fbf6ac09f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330049, "uuid": "cf3e04b9-f99a-47ac-a067-9b1247f408ea", "value": "T13BE3B50E6F394F2DF3798335D7F749259B5872822AD1C649C27CF9121E2024E641FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330049, "uuid": "104d0018-777e-4fbb-a56b-f26b0f58555f", "value": "3072:vHMGFeCUOsBxhj32yUP34+1Rb82Jh1WQot8d8fEda5FC10z5y535VfFmgqToRKV6:vH/FNUOs72WfGKT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784330049, "uuid": "b45a0bcd-7035-411b-91ba-981022d310d4", "value": 157092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784330049, "uuid": "6bce720d-acb8-4f24-be48-338f8007cfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784330049, "uuid": "b3780057-3a8d-47f2-ad73-801a3ffbc5ae", "value": "gmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd09c2e6-8209-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784311376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "0e29edc9-b417-4a32-ba9c-b876f8a77947", "comment": "Malware payload (Mirai)", "value": "c2547bfb25445f34b35497698672313d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "c35f7619-8f33-4d1f-b4e4-8d2a503aa1b6", "comment": "Malware payload (Mirai)", "value": "fd5a23382914de09a0bf991ddea3ce286fdd996a5611be4abefaa82fa29a706c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "51959834-87d8-45ce-bfb1-7d7bbfe8b77f", "comment": "Malware payload (Mirai)", "value": "7e38d40e145c7ca13518c47e5fbadaf616f72221", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784311376, "uuid": "b2e9cb48-fbf1-49c4-9b2d-48e3817d282b", "comment": "Malware payload (Mirai)", "value": "18eee1e1fbefb6d93ae0b80e4dd7eff96ffed1c9de25a912654811dd6d362a49482482afcb2733164575f43c1afd543a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "fa442f5a-aeb8-40f7-8d2d-9f7958963546", "value": "T19543F1CCD110380FCCBE1EFD66C527E6854474515AAFA74C5B120E94B2BE90B78EC66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "32f0b786-9f41-4210-ad2e-8c7b0ce23828", "value": "768:43xNVbSG0bAEfALMQ9WzRz5PFWz3w/nCtgwkvMXrA1bXeyyrzo5o+WuZ:43xDSGJ9Cl5PFGAwiOCbO1oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784311376, "uuid": "630e34ae-ce39-4ddb-a106-d301270bbdae", "value": 57408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784311376, "uuid": "c197537c-e22a-49c6-a1db-b3cfd08b3c91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784311376, "uuid": "b648d5a3-8b1b-4dec-86ce-ed19bdb37932", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe3881b-8191-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784259895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259895, "uuid": "98226a7a-2022-4bb7-9609-7639cc411523", "comment": "Malware payload", "value": "5141cd6e40a9e679152e0bc204023a4d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259895, "uuid": "fd779405-67ab-4d2d-847a-c21cfa9142c7", "comment": "Malware payload", "value": "fd8d4423c933a7eadabe22e580dea1f75289f63e7f87cab1b9511507d7f8cdf5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259895, "uuid": "2f98141d-95bf-431f-be66-5889e56ee422", "comment": "Malware payload", "value": "614766600875cbf72089c87737862110103d9919", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784259895, "uuid": "0c5168cc-66ef-4d8f-9646-2ecaa6231f16", "comment": "Malware payload", "value": "a97651d95c36ad69baa35ab9bac5a73c75b1b71f2f6a9a3c3d78596f4bba0debf2c9465feeebcb502e71710a2376f644", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259895, "uuid": "b30f8330-c5ca-4e7b-a1b0-d8fbdf2200c0", "value": "T171C27D956A967C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259895, "uuid": "f6636ff9-6d73-483a-9da0-1ae0c38be499", "value": "768:58vCB+25j6es8R2V9FYpMSUpi+20qUpi+20YQX:58l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784259895, "uuid": "e85ebc8e-b178-4688-ae31-6a329ac46935", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784259895, "uuid": "6ee7e000-8e45-4f6f-8010-4e2692b62b58", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784259895, "uuid": "309e6594-5c45-4b0d-a7b2-8e5c4047cd43", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462e1af3-81d6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784289272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289272, "uuid": "e129ed08-d41e-445b-80d2-a4b940cc1188", "comment": "Malware payload (RemusStealer)", "value": "202e055e07bd31f372dfb6d652eac8ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289272, "uuid": "20e5991c-fffe-491f-956e-4f93ed19f088", "comment": "Malware payload (RemusStealer)", "value": "fde7039a7b78ed36845d67fe5799e9185bbf753f78de7c8fbde423812fd74299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289272, "uuid": "fe29a9ff-8f63-4791-80e6-ac87a3b5144a", "comment": "Malware payload (RemusStealer)", "value": "c0189aa9a22dae0d99e5aad7ed368e037e19d96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784289272, "uuid": "e309062a-6d75-4102-99f2-32c7cb4dccbf", "comment": "Malware payload (RemusStealer)", "value": "cee6de6a1c906b09761c1f4ea5a6884d1f60a85a19b3fb546a56ef34920562f5536b467c898dfed6237cb6e25401f6d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289272, "uuid": "ec220b5f-3481-4858-bf3b-e536155a0ded", "value": "T18BE53907BD9108E6C09AE63189B652527B74BC4D1B3233DB2E90BBB82F727D05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289272, "uuid": "e4a61de9-b2a1-4589-8dcc-7b245c824619", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289272, "uuid": "99282cdf-61fc-404c-8586-b0ddfd9c821d", "value": "49152:o+K3EwPd4g98d2x1fUMySjhjQijM6bpaur5:oRHjBMsH0u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784289272, "uuid": "0890cd77-d80b-42e0-9885-dcbc4aa0035f", "value": 3249000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784289272, "uuid": "e6e14f2d-1c2d-4f3b-a1dd-3cca397fdd14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784289272, "uuid": "12003e03-ac2a-4822-a07e-3c78655da5f8", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a064521a-81a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784267090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267090, "uuid": "228f9245-2478-4d2c-bb01-04616fc69a58", "comment": "Malware payload (Mirai)", "value": "840f1faf4ff59537b527301f2da83a4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267090, "uuid": "a06e9172-217f-485e-b44f-ec72b6e73dc1", "comment": "Malware payload (Mirai)", "value": "fe4fd739e956d38323e93966981a85487d9735850e7a018c067415d11f514f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267090, "uuid": "d724ee64-eeb1-4f9e-97f2-d368d68465a2", "comment": "Malware payload (Mirai)", "value": "f3595b635be669076054667c13646e4994ef95dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784267090, "uuid": "7d9c88fe-d987-4f08-91bc-9fe47b0accd2", "comment": "Malware payload (Mirai)", "value": "553b51edfd6fbf827631ad31015640edb08001f6fd6e0d27b8813fcad4a6c173fc3fc841ddeef0ec67e92321d3f405f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267090, "uuid": "192c4e51-c29b-4411-9565-eb710be04716", "value": "T1FD935A53B9C480FCC849C17057AFB236D923F17E1239B19B67D8EA167D8DE111E6EA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267090, "uuid": "7ba9868b-35eb-4b95-b45e-04d010190fb6", "value": "1536:lPfYtYZjnRc/6UTgUdQNJ7B87yaAQ01B1ks/Vyec5fwlLJH27ySHA:RxZjnudTgUdGJ7Ayaq1B1ks/VW5fGLoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784267090, "uuid": "c2be75fa-72b1-4021-858d-5792902c7cae", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784267090, "uuid": "0c7a98e3-9839-40c5-9451-f0614148d78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784267090, "uuid": "a421dea8-d023-4451-86db-3ea74fbce386", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c41f71-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784272170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272170, "uuid": "0a62fdfc-8bf6-4afc-9816-895f4d6e5cdf", "comment": "Malware payload (Mirai)", "value": "6941647cd595337e52de06efc4080a27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272170, "uuid": "4c140dee-8ec0-4d33-aa67-36b408e84efc", "comment": "Malware payload (Mirai)", "value": "fec5b29fac5d211c9a71f6cda332f1368c176ab77cdd44ad35cdb4dc4eef9949", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272170, "uuid": "325bb243-0044-4bf7-bd80-5f734f09cc6c", "comment": "Malware payload (Mirai)", "value": "8be798dc52a3fffd7cc766ba7ec45340b4cf49c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784272170, "uuid": "6ef03a11-13d6-49c7-b796-f9351de01eec", "comment": "Malware payload (Mirai)", "value": "8d55152e0d4b637b8c8232b813284005eb968f2b31cb0dd9b8c5c1b0d72cb287cdd5e5e6865495584a88c87bc5dc7ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272170, "uuid": "f2ac6151-8dea-427f-84b9-2fa9ced0b7ab", "value": "T14FF2E120EBFE3D10EAE2A974953046C73A1B3BB8D787B834539400949B3DD29E17D599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272170, "uuid": "a567e729-4c62-4d89-84f0-00c93f95d304", "value": "768:3ZAb2jdTWDPtuRl/+PPqVkOI60mbiprqvZ0XBc9fK/69IFWXkjO3w9LJs3UozL:3ZAKjBWDPtuTntIY++Z0XBcf9IFWz3we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784272170, "uuid": "4dba43af-7f34-41b5-a696-f24e302722a6", "value": 35516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784272170, "uuid": "9618bd1b-ab7a-44c4-88b4-34b444017594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784272170, "uuid": "4a5210db-bad0-4d51-b590-e05579910032", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2ea0e7-81bd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784278709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278709, "uuid": "172b4c08-e5ed-4669-ae06-c5c9bc0c579d", "comment": "Malware payload (SilentNet)", "value": "a14d89a41ba4b039d639e8adc877b590", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278709, "uuid": "dda0786d-79d6-4af1-82b3-29ee21d5bfad", "comment": "Malware payload (SilentNet)", "value": "fefa44f1a88a69b16f38030100a60c38dddb77d9c2f2089f8c51ffd782917cac", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278709, "uuid": "6f217b8e-6a7f-4bb1-a161-184c0e683903", "comment": "Malware payload (SilentNet)", "value": "56d56797a7c6b5a9e8d1cdca08592062e71ca6bd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784278709, "uuid": "3e7d739e-51c6-40c7-958a-b025d7ba83e4", "comment": "Malware payload (SilentNet)", "value": "489f743c89ad2dd71e7b1b4943e6d9388917f89f958a3e63f6afae8cdc588ae0715bf5922a48ef0c8e0574a93dfd41d5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278709, "uuid": "576ec9d7-8e0e-49ba-a63a-85ff7d972772", "value": "T161473320DB1D0036F833BF365142B5E028BBEFA16207F0AA7A7D094D5855A938F7D95B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278709, "uuid": "a6cdfb97-4aa4-4f18-90c1-13779d9c456e", "value": "393216:aondoeoKzBfagSLbPkmx09FWxjtyX732p1apcgC9cwmizPv8wbYDXhadc:aoCQSkm7xcywcgwmqfEbkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784278709, "uuid": "7f54ab8f-1a5f-4d7d-9946-1380e9b33853", "value": 25826136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784278709, "uuid": "4b50a42b-8e2a-48df-a2cf-e745218bbddb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784278709, "uuid": "5e3156e2-7849-409f-8e3b-b3215271e1c7", "value": "meteor-client-1.21.11-82 (2)-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55dc9e-81ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784271993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271993, "uuid": "e61971f1-f5a8-4cc9-bfea-df59c8f0b821", "comment": "Malware payload (Mirai)", "value": "41abdba80af01d5a5db3d62b20aad417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271993, "uuid": "d4544d57-1f28-4236-9598-3f0498a5c2c0", "comment": "Malware payload (Mirai)", "value": "ff7512cdfe54ffa3ea18709364d1c3e81881faa5ba3e6928d309c3c3efe2d9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271993, "uuid": "4483893f-4ad5-483f-9b11-b08e073e7cd3", "comment": "Malware payload (Mirai)", "value": "11bd03bf866a7c1e198569089d26e5e1d645eae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784271993, "uuid": "89da3c68-d547-468b-9f2e-c40b33db99d9", "comment": "Malware payload (Mirai)", "value": "919a5d12beab179ab85b9b54f778f3fd4d3c5fc06c3e33faed1ad7c2d5915f81bdf3b552392aeea325d3d22178e12fd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271993, "uuid": "1d4aa579-e4de-46cd-a77f-9b42580308ae", "value": "T1EFE2F1A076137D61F6A2D8336A3EC3C573A79B30D2697068A934067B33C3C154BBA453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271993, "uuid": "d1845751-fafe-432f-b63e-444734d0903a", "value": "768:ueBsVPxhgxtEHPOuZ8AgeJDRjt99389u6JZs3Uoz/:ueGVPxGxyhJJDRcu6Jkz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784271993, "uuid": "47626ce9-6a91-4788-b293-86f88ab4aa1c", "value": 33864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784271993, "uuid": "a0369072-ce5c-406e-9597-f5def5969864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784271993, "uuid": "1bd84421-a9a3-4311-8125-95d9723fb312", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }