{ "Event": { "published": true, "date": "2026-01-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-12", "timestamp": 1768262582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e2519404-cbf8-4712-9779-be90eb107b36", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42803ae2-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182280, "uuid": "0da5b5b4-c67e-4c9e-b0b5-6d15b2f87585", "comment": "Malware payload (Mirai)", "value": "922383ba3db707389ca2368b7a4f31f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182280, "uuid": "634208bb-5561-4f1b-8d73-4acb39b195e4", "comment": "Malware payload (Mirai)", "value": "0057ed87c0980bb0b9b57ba2db2e01858d9b8b91616b1eafb408154a88961a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182280, "uuid": "ac97dcc9-0dac-4b15-8b36-3beafd946f85", "comment": "Malware payload (Mirai)", "value": "fa07ff7be8ac51470c981e637bdb7274539a0646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182280, "uuid": "d93ef1c6-6c3e-4594-ae31-cfc5ccdb29e0", "comment": "Malware payload (Mirai)", "value": "0f8b0812013d8a33771b25c44382311315f6b9b677e109c3bf173237ed76e6e8da63b71e104f25698fe2c451d3e9f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182280, "uuid": "fe4424b8-fe5c-4ae8-9bef-a16c4d4ce797", "value": "T1A4736B32BA750D2BC5D0A87A21F30325F2F2479A25EC8A1A7D710D8EBF6065032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182280, "uuid": "59cef386-7034-4698-8f03-91aa04323618", "value": "1536:0dLStZm4fVhl9Bv82JM12Q7Vt7WZNM5V6tNBAe6RtLh8/XK:4u/35qfVBaN8V6tLyCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182280, "uuid": "32d2efc9-87ce-4772-b4d7-e75db64cf6af", "value": 77720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182280, "uuid": "774afdac-8fb5-47b5-a57f-d10f04310d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182280, "uuid": "56a97ecb-a3f3-48a5-ad09-7a6e276cf1a9", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818260ab-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216745, "uuid": "4d2129b5-bc7f-45a1-be28-3c2e43a300c7", "comment": "Malware payload (Mirai)", "value": "6bc3cd3c2989016a9d646a913e1363c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216745, "uuid": "1d674016-e7b8-4ee0-87b1-4cd548bd5e27", "comment": "Malware payload (Mirai)", "value": "01563d7779828af88279dac3d95cd3332434f5be7963254e75dc4756cdb6235a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216745, "uuid": "6b4863ca-bf09-4f94-b324-e00a6756a12b", "comment": "Malware payload (Mirai)", "value": "252fe2b9bfc5448977f3ff863b53ae42a5a34c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216745, "uuid": "8fb97cb7-1b5e-4399-a97b-0bab1c726568", "comment": "Malware payload (Mirai)", "value": "25ff3f6d54a689869538e126996f016130296f5a39e62c4c1da488fcdaaaa0d0d4e51d7146179608bb64d5b88221fee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216745, "uuid": "46bf2f72-3a1e-4654-a30d-eaa989e27c0b", "value": "T17F03024F7EA95E21E488687544EFF6432000C3E5A31BE9B5CE8C15272689F1F1876763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216745, "uuid": "37db2fd1-2682-41e6-a33a-68316d10cf0f", "value": "768:igQcD4ioAAYVyCH1D2mrDkkfux+yXJ+y50XaKKvLCnbcuyD7UHQRjH:h6diVltzkYuV5CXaB2nouy8HyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216745, "uuid": "1a2a934d-373e-4506-a25d-132cff337775", "value": 41288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216745, "uuid": "a78e1b25-eec0-4e65-b974-aaea58d57a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216745, "uuid": "2f7c5b3d-cd20-4f1d-9fff-9ce667b81da9", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7445f49-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205319, "uuid": "65d16b9a-c842-441e-8053-a7e584d30bdf", "comment": "Malware payload (Mirai)", "value": "48424840bd27fe82f3365c3347869624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205319, "uuid": "c6a32032-28fa-40c8-acde-7c74a2a49685", "comment": "Malware payload (Mirai)", "value": "022291378cdfb371eb2c533c8538e9add237948e34668996ac412d1df9f0b6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205319, "uuid": "59eea752-d19b-4cb1-a713-65c31841eba4", "comment": "Malware payload (Mirai)", "value": "c535686f56d35d9d9a2452a0e937c7af01e618b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205319, "uuid": "3033ee63-8963-4258-952c-287d7117cea4", "comment": "Malware payload (Mirai)", "value": "dbf2e8466de9d2b73e983077a2741d132ec5779f081c52bf992e278587685acc7dcfb621b6e3cea5807e485e6686b1d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205319, "uuid": "dd1b1692-c683-4292-98c6-62c6e63a4454", "value": "T195433AC18182ECF5EC091674657AF337A5B2CDA441B8FEF7F76893B20016A647146A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205319, "uuid": "addc822e-7553-4d25-9b97-ae2868224d50", "value": "1536:AV30e0wMvykYTH5bvO+bKXh23Y13+U2wquFpefRN+ZdF:Adx0wMv1MhXGXkY13h2oQfT+dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205319, "uuid": "16f408ba-3556-4879-9dde-886a80ff4230", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205319, "uuid": "93c0f528-af70-4a63-88b8-edde3fdf0d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205319, "uuid": "9686be5d-90df-46aa-82e5-498d8de7e863", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2e085e-efb6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768222804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222804, "uuid": "21ad1bb2-dd90-46ac-b006-dc09b9eddf65", "comment": "Malware payload (Mirai)", "value": "dd2ffb35bc860c25b82460626857df4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222804, "uuid": "3449fa2f-f933-4dd6-8142-634d18632d3d", "comment": "Malware payload (Mirai)", "value": "0231f9d453d755dd71814583d42f78a5cc719ca619dca87d02691f8e4cd9d5f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222804, "uuid": "2533490f-4bc7-4ae3-875d-df8e8703aa37", "comment": "Malware payload (Mirai)", "value": "3b4e0c0eae221f46b72c51cf083fdd1f0eb35598", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222804, "uuid": "27c12a35-f24e-417a-9297-896e6464629b", "comment": "Malware payload (Mirai)", "value": "1e4bf48ba3145a9d0210c70dfcd79ced07ae3c4fa977981b3845a7962ca2abe554481d7c348ab3efc420aa3211702398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222804, "uuid": "f8bbdd76-a17b-40a6-b17f-15d64be7e292", "value": "T19F934B0273654447F6A70DB11C3F7BF193EED56121A0A286695EEB0F8136E32158AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222804, "uuid": "dd022b4e-d79d-4632-9967-c14ff68fb00b", "value": "1536:0B6oHpOEsyqnD8VkrLYIHiv2D5wB4Pq0R8b3rIGAuijC7ppVg5FDeJI2tnoT2bVZ:wOEsfgmwBBCa3rI2SC7pp+5BZfT2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222804, "uuid": "a21b0377-0022-44e2-82ba-6ec6fb13e16d", "value": 97224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222804, "uuid": "3a1bf0eb-b9f8-4a54-9162-68cf5ad76ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222804, "uuid": "fd551846-29b8-4fdd-85c6-addaec903cb0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10daf80d-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205819, "uuid": "9bdcf7b2-aebb-457e-8c97-8e595ac0465e", "comment": "Malware payload (Mirai)", "value": "3b1bd9bb5596471c9a16c832347672ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205819, "uuid": "eca3a2e1-549a-4bce-a985-4553ad01295c", "comment": "Malware payload (Mirai)", "value": "028232e523ed28709cf98b46acce5ce52db3a29851841511e46c9d791795c7b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205819, "uuid": "a90431a1-d395-4548-b329-3befac6ac124", "comment": "Malware payload (Mirai)", "value": "30e03bff43857d8e21068bb571f07a3fc15958a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205819, "uuid": "e8701021-5f64-403b-90b9-f82d1fd5d187", "comment": "Malware payload (Mirai)", "value": "5b6e91d3ef9707c43b36395ffce0d3280bd271f12279293e0b5fc9ef7ed6fd2865eac8a19d1f660bff2daa632a36a8c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205819, "uuid": "800dd8b9-fecb-457f-8db6-6b5b300b51e1", "value": "T11A634B21BE766C27D5C4747B61E34235F1F6574620BCCA2A7E720E9CBF14650320BAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205819, "uuid": "b09f8c31-a7c1-494f-8203-40208063d155", "value": "1536:m3/n3hlCWV4toHUWzvf98rQLXcq3yZeplkxFmQn3jzm7uhq:QyR+f9xiekDmIzmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205819, "uuid": "2b71012a-aae8-4907-beb8-c2269fec1435", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205819, "uuid": "fb0585bb-0262-4d87-ab3f-6482e0e974b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205819, "uuid": "952f6d9f-515b-4cff-8186-b8df3e008b8c", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0ac68c-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768219044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219044, "uuid": "dab2a72a-8509-40b5-9b0e-9e1196100858", "comment": "Malware payload (Mirai)", "value": "27a5d3783949d0ada1681039d233860b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219044, "uuid": "03dcdc32-7369-4aa7-a00a-a0dee4fc3375", "comment": "Malware payload (Mirai)", "value": "028642531e4dbd31814ad2d724062c45efeb40e800225f33f1ff19e96aebda28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219044, "uuid": "6ba5fac1-6706-4efd-923a-85a7fdf2f5aa", "comment": "Malware payload (Mirai)", "value": "d2284452a8699a23aef668de07edbddc52193ebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219044, "uuid": "0436ca84-b6be-49c5-88e6-64cffc7398eb", "comment": "Malware payload (Mirai)", "value": "da4c6361086603da1ae22250425e5100bd96915dbca241de73b1f71544580785cd981e2fcb9b108c3097e1b87645f53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219044, "uuid": "76622387-e906-4018-859e-17b819e77a00", "value": "T137A30BD6BC81CB11C6C556BAFE0E61CD33134B78E3FA7213CE185B29674A86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219044, "uuid": "45db340b-713e-40e2-a5a4-393475e58290", "value": "3072:LTD+YFn6aJbEA3fmIYKfWfCTuCGUneuBttaV9KT2:SaHuIYKfWKPne+tgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219044, "uuid": "0d6cf118-f919-42f7-ab2c-c887c2e2b64f", "value": 103628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219044, "uuid": "9b4d8ffb-9a65-4da8-a6ba-6dcb0e72893d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219044, "uuid": "f733cc5c-6667-487a-a957-b1ce2ceae569", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f396b-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224446, "uuid": "c2545a3a-d36e-46ac-a551-72ab63fd9dab", "comment": "Malware payload (Mirai)", "value": "0b8ca2e38926c25afac155182f423428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224446, "uuid": "e6c74d1a-375e-4eff-9c3a-05718228783d", "comment": "Malware payload (Mirai)", "value": "028ada2cadf944e3e5c63841a7c523899f097908ddf477d8f76fc8fed6f3ef54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224446, "uuid": "698b3030-79ae-439f-8498-ed57744a99ec", "comment": "Malware payload (Mirai)", "value": "2f8bf9060eabffa36529eb7cd49f5c8dd3375c9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224446, "uuid": "0520e3bd-85e4-4439-b135-1672bda8c22b", "comment": "Malware payload (Mirai)", "value": "345a5ab7d5ad1aa3fad1b0ecdb086592f81e05022ee70531ec7de94d1a6091b4777217ae30bc236a425282ec27137dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224446, "uuid": "3b95fac8-3f14-485a-a7f1-f8acb0493ce1", "value": "T12CC3C64A6E529F6DF32C82354FB38B3AA745239633E0C586E26CED411D6034E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224446, "uuid": "0aaece7d-4021-432c-b29a-4f2f9163da42", "value": "1536:EJz+b+wzfFzf0EfTbp6eCMEu05hkufaqJOXSSeTauI97nKdcI1T2bVRJU:E8blplVEH5hkufaiOXSS9uI9Id1T2hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224446, "uuid": "d7567283-5bb3-4451-95ff-65497c9e78ea", "value": 121652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224446, "uuid": "77abfaf8-f2fe-486d-a5d1-b4fee03f325d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224446, "uuid": "d64ba423-8069-480c-b310-532fa8a9c129", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70822ad1-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214569, "uuid": "d5e02a6f-157b-454a-bbc1-4570cfc7b212", "comment": "Malware payload (Mirai)", "value": "a09074af7276ef708981626014b7c81a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214569, "uuid": "586b81cc-bc59-4129-b273-e3649730b7c8", "comment": "Malware payload (Mirai)", "value": "02eb139db753f95e753d78d9331bb0624054bad95635c63bc359a55132944a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214569, "uuid": "e33013ef-c1dc-4510-9437-6cb388a2f742", "comment": "Malware payload (Mirai)", "value": "c975eb8974b438c6efdde570579b3940ec4af318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214569, "uuid": "a37b8923-ea8e-4af2-9b37-f1ba08f9f03c", "comment": "Malware payload (Mirai)", "value": "459a07555190dd59d900c5f79b42f7a58b3e87bb1d78fb40e74b0d71eb927306d2d6c5020dd9239bde76086d8c9c888d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214569, "uuid": "78af2e3c-a2e9-4296-9094-8a8ffde932f4", "value": "T18F732A326A359EA6D5C2B47932B7631A75F142AF85A4C86CFC715E0DFF32840D20B5B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214569, "uuid": "bbcc2b6d-5cde-42b8-beae-1757f458c957", "value": "768:L2n1Wv8MIUv9BvkeNmbtrkmuoAXpyMHzY1pLHQYOVO+jvwe5XPg:wIvNfFZkeNmbtom7AX1HzY1pHQYO1c4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214569, "uuid": "6c64c5ab-cfcb-4d88-b4f4-efd2910cc39f", "value": 75900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214569, "uuid": "d7af92b6-ec8d-474b-9005-a181d45adcf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214569, "uuid": "e1d1cceb-d617-4da4-84ca-dc1d53c622a5", "value": "shadow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a371c9b-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768219551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219551, "uuid": "e63fc91c-80e9-4fc1-9a10-6c62132cc117", "comment": "Malware payload (Mirai)", "value": "3080f1a00cb49e1333127fdd1cb3061f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219551, "uuid": "e1c25831-6074-4fa0-9e66-d75af92adb39", "comment": "Malware payload (Mirai)", "value": "033b791c7d077d40e9b8077befbd80b5a25f7d99f964f38439f7d453cc0c0295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219551, "uuid": "b10d265f-34d1-4acc-a867-61d343fee32b", "comment": "Malware payload (Mirai)", "value": "9a936975b6c079b56406ecf47450d736847a1fb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219551, "uuid": "32dd6863-c805-4277-a20f-97232486949e", "comment": "Malware payload (Mirai)", "value": "1048e1a7029f60222ea937882598c48716f00960b12a2368955edb0c4909fe4fb19df1fc11b901636fb3aeeef88b43c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219551, "uuid": "103d969c-03a1-4de5-991d-5b71e1d08536", "value": "T11B835AC19543E8FAE818017520FBF3376233DA750168FEE3F3A596722429A51B54BB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219551, "uuid": "14f577e5-18f0-454c-985a-e4c0e79a3865", "value": "1536:4x05XDzAgfzeu1FE8x26Becui7sjo2ybeat4n9yj7zy+Q+YZt03bIcUbZKk5XRRJ:4S5XPpbhFEY7Q1tjObeatqgC+QPvA8cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219551, "uuid": "c0fb8aa4-49d9-4b51-965b-5b15ce5415f6", "value": 87024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219551, "uuid": "4cdb26e5-2056-4025-a156-e8bf14fdc1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219551, "uuid": "3fe37378-b866-4882-93a1-5e6e030d6da3", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b255aadd-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223269, "uuid": "3820b48c-6696-4fd6-a4be-72ac4f720d36", "comment": "Malware payload (Mirai)", "value": "ebfc0e9135d7683bd3e2dacd741def69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223269, "uuid": "839b71c5-177e-4c85-8089-f70573991105", "comment": "Malware payload (Mirai)", "value": "037af2c7542756de83e33c99326edcd6bff8be08b470d4b13cb48dee0ebb04c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223269, "uuid": "3a631ceb-96fe-431d-a64a-520d0533a5a0", "comment": "Malware payload (Mirai)", "value": "abe6940b7bfb6da7c8d9d2f9c593d5fc31c77d9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223269, "uuid": "5a2d249e-afc5-44f1-acf3-44c178f26acc", "comment": "Malware payload (Mirai)", "value": "e83fd2e507552ed09e89642b3b53ae2a0c2db92e0bdd85ae1f2d5d24327081cca99dff75ac9a0e14c4041cf8136e154b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223269, "uuid": "a7ddebd6-0187-4c29-ac57-4cac43c20bb0", "value": "T1F6836AC19543E8FAE818017520FBF3376233DA750168FEE3F3A556722429A51B54BB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223269, "uuid": "76dc13a8-9d98-4899-8fc5-6c626c199cd2", "value": "1536:4x05XDzAgfzeu1FE8x26Becui7sjo2ybeat4n9yj7zH+Q+YZt03bIcUbZKk5XRRJ:4S5XPpbhFEY7Q1tjObeatqg3+QPvA8cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223269, "uuid": "e0289619-efa9-41c0-8ee3-18bf0e49235a", "value": 87024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223269, "uuid": "45fd4325-f4de-41a5-ba81-198a92b5bb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223269, "uuid": "69b5f95f-179b-401d-8ab3-a5fd44483e4a", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b921c1c9-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231441, "uuid": "11b7a2f6-398a-4453-8ab1-2167f2dc7b36", "comment": "Malware payload", "value": "1d2469c4147fdb708d2fe5cbdf383fbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231441, "uuid": "cdf61d96-9f70-4edc-a691-f46f5fecc6da", "comment": "Malware payload", "value": "043e5ce96ba3a291188f9c379469dcac5f6c27528e1a5e608163927538a470bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231441, "uuid": "5396125b-f9c8-4145-b12f-6513a8e82550", "comment": "Malware payload", "value": "daa1b76c89a153cc0746580258d57ef4d5fcf2f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231441, "uuid": "06ab9ad0-79f3-4c53-bbce-a28907619be4", "comment": "Malware payload", "value": "bf749c315646698889359741006fd76e7f479a2666f37c3864606758beb7586d84aae539c3c85b79d7564030480c6a67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231441, "uuid": "fb6e3b4a-7689-43e7-9339-08f6740565fc", "value": "T1CBF23A13E89140FAD96202F50A766A32C27C9B01137549DB6BAC3748BB60ED7FB35B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231441, "uuid": "142b552f-0921-4995-b3bb-b28a8e3b847a", "value": "768:3o4wnRsCTB+JBAQy4zd+1RmpqbQH1WpvAf/pLFnieLzLoAuhrL:3o9RGJU1idg6NFniejLyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231441, "uuid": "2ee332b5-b217-4e9a-8678-9833ed45657f", "value": 34962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231441, "uuid": "e3fad73a-5551-4a96-964c-b7632a0d449d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231441, "uuid": "68cd9fa1-ceae-4957-85b9-78c0b9cf2b0f", "value": "1d2469c4147fdb708d2fe5cbdf383fbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9521c52-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768214718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214718, "uuid": "6529302f-268e-401b-bc31-91c573cd4c81", "comment": "Malware payload (Stealc)", "value": "68516b8a4f3598bdee5c477bb857a6b9", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214718, "uuid": "7ec2d2a5-b3ef-4625-9b02-2ab166b96bfd", "comment": "Malware payload (Stealc)", "value": "047b5e3b75a5dd976f38019c4b3c5ed4328ec9accd7f2bf448115835296f25f4", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214718, "uuid": "19ae233f-1216-47c1-a79d-7df7ad4707b6", "comment": "Malware payload (Stealc)", "value": "4d5330819b1daf1aa709573e42711d1a069d65a9", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214718, "uuid": "0c0caae9-0b57-4066-b143-13824bb24c14", "comment": "Malware payload (Stealc)", "value": "70a6ad61f89360ee933e11f3e32a9a40e01dd22e8dfcce21cb6a5be49dc299019e6315c61f0644aea0bf82f98195fbbc", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214718, "uuid": "cb4aeb8a-6201-4cae-8f67-a79247e6669e", "value": "T12BC63AE1FA448735F6DBF239D66161566230B0C8133614D7BBA90B95881BBC8173BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214718, "uuid": "f28c8556-2769-42c2-babe-9619088e9ad0", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214718, "uuid": "3e64b2ac-0ac5-4ad5-b1f5-515499ddfc80", "value": "49152:eyPPhMrv0pnrb/TIvO90d7HjmAFd4A64nsfJub+GH83L0dRaD6u2zHq9p5WsEEsz:vpEDkuRMI1Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214718, "uuid": "801faa6a-656d-4c52-b4a7-8cd700a52059", "value": 12549248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214718, "uuid": "8ffb04ea-824f-4756-abea-154a90b910c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214718, "uuid": "d7468cb9-c0ce-47f5-a31f-7fff7d4e1df8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c82bbdb-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768226481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226481, "uuid": "337c0dc7-4610-4a69-9919-a46d22196d6d", "comment": "Malware payload (ConnectWise)", "value": "a44ab0a353e7b46762821b0939c86a72", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226481, "uuid": "d0d508a2-8715-4d72-8f1e-25433f588f7b", "comment": "Malware payload (ConnectWise)", "value": "04e60ecb0da1a557169fa5035d5723c534c8eb9828496e3a20593b1a8611b304", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226481, "uuid": "9cebdac2-2922-4ee0-947a-5d2a56dd2c37", "comment": "Malware payload (ConnectWise)", "value": "962cc1f15fb380a8b7c318a47d8665fe1e917e80", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226481, "uuid": "3da12c26-df65-4ba0-98a1-a8b3293c8c51", "comment": "Malware payload (ConnectWise)", "value": "c55ee753736e22956e0f2cd460e498e004113c4e3737e362a255bb175fe57625a1bdbea18849980773e12c426e3b1954", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226481, "uuid": "87053a42-9883-4980-aec9-180b3b3b85ce", "value": "T1D2D622136BF89E67E0B1DB74FF365464A7277E055922B1EE1214790E2F70A8089A3337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226481, "uuid": "c189a48b-503f-4573-834b-7cd0d84a6c83", "value": "196608:vHxcp9ym3nltDUJVgHxcp9ym3dHxcp9ym3xHxcp9ym3wHxcp9ym3gHxcp9ym3jHQ:5GplpnGpPGpjGpeGpOGpNGp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226481, "uuid": "d991ca3a-6c65-4ee6-8f8f-d9aa4747c51b", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226481, "uuid": "4def208b-ac61-459e-bf93-3ccee5fdefa9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226481, "uuid": "5ad4fe31-da7f-42c9-8425-07adea0e2c68", "value": "e-Statement.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c900aa82-efca-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768231468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231468, "uuid": "0ea3c391-a6dd-4881-9f2f-7093c8dcf717", "comment": "Malware payload (SalatStealer)", "value": "125b061f8e9a8fc3014afa0aca99dbc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231468, "uuid": "98a13d72-044e-4e86-baa6-6617f1b606b8", "comment": "Malware payload (SalatStealer)", "value": "056195335f3050b9a49aaa743b69553ad818e937394a975689c7106833bfdb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231468, "uuid": "1f046833-fdc3-436d-81ca-71ea2e54226c", "comment": "Malware payload (SalatStealer)", "value": "0e25b695c71a475ce4770ff82cf169df37dab9c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231468, "uuid": "666669d6-c638-45d1-ac80-3afe47c84906", "comment": "Malware payload (SalatStealer)", "value": "f23b66f789deedc672ca389aa0c49b96772ba801cf204113d55b0b8741a1b0cd429aebb372d996fc2b9f7a203646e497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231468, "uuid": "bde2761f-7218-4fa3-aed5-fdddd842e6a8", "value": "T186623C46B3E8EA61EAAE07346833036122B1E26F6426E78D5CC045996F373C417537F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231468, "uuid": "b85fd542-f0c2-456a-9529-a48611120250", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231468, "uuid": "2ab48a1d-e041-4bfd-a296-0a83ed5c2a65", "value": "384:TyYgDncviKhsmBn2gyYp5vh/Zabm2k2Xh+XK66jJ2:WYgbYiKSOn2gPKbmmXyK6iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231468, "uuid": "218809d6-add5-4d93-ab63-4249a1ccd0d6", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231468, "uuid": "d8260b91-777b-4223-8901-fda4d3ba59e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231468, "uuid": "3daee468-ff5e-4d25-b262-63ded090bc65", "value": "125b061f8e9a8fc3014afa0aca99dbc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c8be3d-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181990, "uuid": "7b8b1c2e-c16f-4281-bba5-84291774e45f", "comment": "Malware payload (Mirai)", "value": "0c8d787123316253bfd36189fb8b6fb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181990, "uuid": "e191d482-dfae-43ae-b3ab-ea91e1a769a4", "comment": "Malware payload (Mirai)", "value": "05dc42a9a2c53b527e3fbd7b9896c8f158726e2a4be0f7a6e4b120a233c35e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181990, "uuid": "12eda420-21fc-49a3-a238-c3d66f14e561", "comment": "Malware payload (Mirai)", "value": "3b603644cd19320a332587187ef07efb3bb7ec9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181990, "uuid": "3a9a5dba-59e6-4a60-8314-8aa16bdfca5d", "comment": "Malware payload (Mirai)", "value": "7574f24397ae44129f0b77c814c422eb2feb46ee93a03047f337ac089eb7c9e824fd4f4570e8f76091751fa9bc89aa15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181990, "uuid": "b978fc5c-23b1-4749-b542-2415f1de0c30", "value": "T111B31224BB6D9107D96B70FA350BCF4113630E4BAA63192C8A64191BE7FB3306DB5318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181990, "uuid": "a5d0bfab-bfad-443f-893f-a79371da06ce", "value": "1536:ge8u5A4/wFMEZ/MmkTz+Rn+JDUvQC35iisBQkCEMdq5EmdMAvXx:VADFM00mkw+Jvc5m+s5D5Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181990, "uuid": "2a27dad2-f657-4379-b0ea-de737a6fff06", "value": 110720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181990, "uuid": "0adfae5e-f8b4-400c-b790-aeecc6e082d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181990, "uuid": "b0635421-b549-4d79-a00a-16b232af9a67", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa9951a-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (UmbralStealer)", "timestamp": 1768211016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211016, "uuid": "f244f54a-d528-4eb1-8162-b067c4ff265e", "comment": "Malware payload (UmbralStealer)", "value": "5decb79b2d02774afec45062ce70f66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211016, "uuid": "01eed95e-37ce-4986-a20e-3185cac8eca8", "comment": "Malware payload (UmbralStealer)", "value": "066c3fdf38b552dd2b91921e2548b29c51f929d0787b7df56005915885676778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211016, "uuid": "ecb2845f-3cdd-4db3-8e15-7c3f63a02bbd", "comment": "Malware payload (UmbralStealer)", "value": "d5942f0b5e2ce773adb02f260f10d48a22f99549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211016, "uuid": "0d373f01-75f0-4639-950f-36870e475d40", "comment": "Malware payload (UmbralStealer)", "value": "71f8d339ccd60d0bccae24b720583bf41aa455c8f2ca1a21dc742277aa025fa79c0c65ba933ecf31709bd5a761f92e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211016, "uuid": "a0ccf91f-dd69-4b25-bef9-18ff1b7c83ef", "value": "T1ADE42982E6C48640E21F4F7753F178794227AE2ABC18FE892C40F295D7367B29F1564B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211016, "uuid": "8fa2b131-544f-48dc-82fa-6e19cfc128f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211016, "uuid": "65b82524-0109-4e21-88eb-2b3019f87e30", "value": "12288:MoZtL+EP8eCjx+80dChfAJksRdEHkHyFTaP:EI8Zk15fZSF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211016, "uuid": "6ec009de-a737-4dcd-bee1-de9832f65181", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211016, "uuid": "99e880f9-8cb5-40f2-8a5d-70d4c3029ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211016, "uuid": "06902089-d236-4d6d-9bdf-e560f8839cfa", "value": "FaddedV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9152fc86-ef8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204316, "uuid": "5310a91a-dfa2-43cf-863b-3bff87f62fbe", "comment": "Malware payload (Mirai)", "value": "66d164b7d52130ac859d69784e9e248e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204316, "uuid": "8236ee22-6dd3-4280-92aa-06b52a680364", "comment": "Malware payload (Mirai)", "value": "069e7649423d06664580eecfa37d543a5e387695b369eedd48bc23edfea4e002", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204316, "uuid": "ffbc237b-81de-412a-8000-3b59de0f6d9b", "comment": "Malware payload (Mirai)", "value": "6add817dedc208401b18b8461de3a7195c710923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204316, "uuid": "99b6fc35-1d0c-413e-b375-3a292b48d98d", "comment": "Malware payload (Mirai)", "value": "430ddbd21609a417b92c93ca545c02d0fb7c3a597e25e22a185f91a9b0f6bb8f57f33e5da3f6a6dfa2d0a7278e8dc772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204316, "uuid": "e3721b47-b04c-420a-876a-8ae8977cfd56", "value": "T19A933B4173594547F3A70CB1283F7BF197AED59021E0B28A695EDB8B8272E321486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204316, "uuid": "01559ed5-0efa-431a-8ee6-97d16f578cee", "value": "1536:3SFqCbSjOQ5krLYIHiv2EIUB6yKhCdiQ7rANOieC+5ts56YynFjIT2bVRu:3SFqws4UB48JBJx5OgWT2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204316, "uuid": "e8b27fc3-6fe8-4485-8dba-e3facb2f51d5", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204316, "uuid": "23a04011-f4af-4251-bd58-af56ce493ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204316, "uuid": "dc921653-8b81-47fe-b1ef-4e78040541ca", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca6630-eff2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768248417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768248417, "uuid": "41305839-2d49-42e9-975b-ef992250ae92", "comment": "Malware payload (Mirai)", "value": "e16d348289ed196ac26dede9bb559239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768248417, "uuid": "0296ce95-f1d9-4d2b-96ac-495545f9ea51", "comment": "Malware payload (Mirai)", "value": "06b71b984412dd192c79fb589d3d3562f0c43bf8d8a5820de7569bb2e5d19c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768248417, "uuid": "be2f1291-95de-46f5-a286-a66779261f04", "comment": "Malware payload (Mirai)", "value": "4736e95cde30e2a240f5866aa406cbde28dcde64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768248417, "uuid": "83a4ab0f-8356-4eb2-aaa0-b350e3418e92", "comment": "Malware payload (Mirai)", "value": "5a7e69d70e7d2121140a038328b7bc4c3c32ea6ab851644a37d37d6fd2b09592d5a48429661b6489cae05a1c7935f2ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768248417, "uuid": "9cace5d2-729d-4c0e-91aa-38daaf4bd1d8", "value": "T16DD3F709FF610EFBE86FDD3746E9074525CC561622B83BB63974D828F24A14B0AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768248417, "uuid": "70db89d1-26ff-43d9-ae6d-329a83642c8d", "value": "3072:VK1KFAulTqmgicOUz2yGRx/osKjOf/+GyWj7:eK2ulTqmgicOUz2/otj7wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768248417, "uuid": "3826da96-c9c2-4b04-a692-8bbf01fd15ba", "value": 140304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768248417, "uuid": "191fb86b-9de5-4d06-bbf4-d37e26622bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768248417, "uuid": "cce1ae87-c014-4e1e-9798-07147d877bcb", "value": "mipsel.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1def6ff9-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768179641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179641, "uuid": "60819d95-6fb0-4e65-ab34-c54c9a635eb3", "comment": "Malware payload", "value": "cdeacf6fae101680001237b643b12063", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179641, "uuid": "8e8db395-f9d7-49e2-acba-877922cd568c", "comment": "Malware payload", "value": "0720514d06068d8bde716df23d65510924ae5472c5983e1e7d02b4f2b8729e81", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179641, "uuid": "411f1ffd-476b-4342-aadc-a292b82ddb84", "comment": "Malware payload", "value": "85db452929f65be66e1386c0ba1cc1f0f6c05701", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179641, "uuid": "e20ad2e5-c41d-4033-ab87-fdcff28b2298", "comment": "Malware payload", "value": "e3c69a042ceaea472d77a056b54cdb216b1c038e5e291e6d2086f5e43fc89b853c6edf90c15bad45e6de5976532b780a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179641, "uuid": "a8ea61d9-40fe-42bd-aa84-2a5e6e847533", "value": "T12BF0274FB086F02A808431F89761F719AC347CA75173DE9CB8843590FFC20207953204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179641, "uuid": "4080a5b5-7886-412b-b759-459e3e4c48a5", "value": "12:dSjkOLZpqjWx5ozpqF82Q/NiT+4+0j8BHAOy:dzgZpqyxmzpqF82QVgx2BgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179641, "uuid": "83460a81-e0a3-4a95-9f3b-0cff6f714f2f", "value": 509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179641, "uuid": "c7e4a17a-c34a-4b14-a03c-0f0eecb18c4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179641, "uuid": "5bcdd536-1962-4c20-b5e3-d1634cdc291c", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a45a486-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225135, "uuid": "07c860c5-1ef1-4ed0-b261-bc90bef7ecfb", "comment": "Malware payload (Mirai)", "value": "47e0b49cfa8b570a69368c330e2ebbdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225135, "uuid": "b540e9ca-7eac-47c0-86ae-5853e499621a", "comment": "Malware payload (Mirai)", "value": "07f8bb90b2abfe7999026d0b542d2393ebc29f6cdd5156e5ef9a03825fa4e065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225135, "uuid": "9b2fb2e9-899a-4bf4-8237-3e417e8c97d3", "comment": "Malware payload (Mirai)", "value": "e3509831e1594d974dd7a1ee83a429ec78919062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225135, "uuid": "aed8501e-06b2-4ce6-8c43-22a348e55971", "comment": "Malware payload (Mirai)", "value": "6abfe9cdb479bed20de3bde776e1ac22372724533fcc1246619486b414a0d8ba0d07685a4f48f2d6800453f3e2b8c487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225135, "uuid": "b687bc9a-970f-4daf-9633-8d65090c0cd0", "value": "T1D3634B21BE766C27D5C4747B61E34235F1F6574620BCCA2A7E720E9CBF14650320BAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225135, "uuid": "bdfd1cd8-680c-475c-b0e7-ba38bd7ba5c0", "value": "1536:m3hn3hlCWV4toHUWzvf98rQLXcq3yZeplkxFmQn3jzm7uhq:QoR+f9xiekDmIzmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225135, "uuid": "5904c2c7-8fa7-4eb0-923e-0b85aa976e7f", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225135, "uuid": "aaaccd34-b0be-4e20-8b00-e2ae38176f58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225135, "uuid": "3088baec-0f73-4aa1-8000-32faf94918f8", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d50367a-eff7-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768250722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250722, "uuid": "b9814952-0e21-40b2-9556-a211c4215af6", "comment": "Malware payload (RemcosRAT)", "value": "326a5ca0e9c33aa4589919c936a1bbc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250722, "uuid": "a0d65953-e9af-49c9-ba2c-a10db6f59185", "comment": "Malware payload (RemcosRAT)", "value": "0809d8fbf4c168476737f385085c9fe2b4e23f0a4268d130145016814e6ee25e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250722, "uuid": "5a9ab29e-3158-40cb-bbf5-1d0eaad0fb71", "comment": "Malware payload (RemcosRAT)", "value": "8ce14503b88ab3bac40858a9f1a1d9b904dc29af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250722, "uuid": "3a28b785-4802-4e93-88e9-16a1e8718ad3", "comment": "Malware payload (RemcosRAT)", "value": "d9e783dc5e6c3b18d0e1afbfb5adfa8720c2155e1f9e703ff3263463563c53b337775853a1e7891cb9035f3193ac77d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250722, "uuid": "ff53cac7-433d-4c35-9d56-aeea5ddc91ad", "value": "T1CB9639A2FF408765D6DBF239E46121566230B488133514D77FA91BA5883BBC8173FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250722, "uuid": "ad3058ea-ba7c-4d99-829a-7579d7011247", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250722, "uuid": "756d643c-370a-44fa-b5d5-c9480a69e4e8", "value": "196608:9herdOQzk9uiwfAgOlmSiVAvQ/KI8FMtXx+QWa:edOQzk9uiwfAgOlmSiVAvQ/KI8FMtXxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768250722, "uuid": "68272e29-8c7d-40a6-9570-1a222780ee5a", "value": 8786560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768250722, "uuid": "cf128f5a-0c51-4436-84a1-72fe2b3065c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250722, "uuid": "c2d9a450-67be-4991-aadf-8fa4383962b7", "value": "x0809d8fbf4c168476737f385085c9fe2b4e23f0a4268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe1fe05-efc0-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1768227258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227258, "uuid": "8fe38cc2-71c8-49a2-bef9-7e3784a0e797", "comment": "Malware payload (GoToResolve)", "value": "703aa7c92dc3ff0bffbc01be4d8b55ac", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227258, "uuid": "0d143cf8-e3e1-432c-aaa5-bc3d43f8eaac", "comment": "Malware payload (GoToResolve)", "value": "09917687dc2a3151f7654d9f01b38578e74496ba20660ecfd56a657837ec33c7", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227258, "uuid": "bc614bac-6644-42c6-85fc-0b8b60bf5c03", "comment": "Malware payload (GoToResolve)", "value": "440f7ffc9683a5e534c8cf2435e45a90578678c0", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227258, "uuid": "2c795acf-9715-4ede-85a6-be72a72c64a6", "comment": "Malware payload (GoToResolve)", "value": "2efe289c01f4dc2a2598a97c6ae19ccccb2ced0cffcbbb5ff5460ae1168b4bc8caaf7fd09caaee5f95dc60c1809a8775", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227258, "uuid": "0381cac8-c48a-4bc3-b71b-61008110ffa3", "value": "T1113733217A99C635D17D0072A869ABFE427CAE150F2145CFB3DCBB584F306D2273629B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227258, "uuid": "fbd9790a-8b03-4838-bc52-0165f6dd43ae", "value": "393216:tuqJ2i4eQObGUDkozmUttmljjOnLCaiKk3MRh9MYI+hQW7cwftlgDA4BZikRwtgu:gQOObGUDkozZTC/yLXikFjxgDHB9RwtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768227258, "uuid": "e2059f59-e2bf-4791-a7fb-abb3cc1e9735", "value": 24535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768227258, "uuid": "09a4389e-3fe8-4612-ac43-6db3d0d2076f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227258, "uuid": "6785b6ad-a093-4c0b-8073-3af1f02ec070", "value": "SSA-Statement.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6547c63b-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214550, "uuid": "acfa3783-d0eb-4831-a6e0-c14fa2348628", "comment": "Malware payload (Mirai)", "value": "ec170616b6773477ed9ac7dabf663612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214550, "uuid": "960927ad-7d2c-42ff-a323-f048da67644a", "comment": "Malware payload (Mirai)", "value": "09f9fc89b901a690f5b93f08741c05ab510073ff81a2a4fb6a388f4928ec2071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214550, "uuid": "e0c17b61-4a64-4d71-8ce1-e0de9e149369", "comment": "Malware payload (Mirai)", "value": "7757d99da14f892dedde714be564fe511f34ddf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214550, "uuid": "f96bfb51-be9b-4306-933f-560d77c6a35f", "comment": "Malware payload (Mirai)", "value": "8c580986e9b8ca90df5c663b8f5055936e348334e2f8a3b116ea426c58a20860084bcea3690515613cf4329885c450f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214550, "uuid": "3f7faa22-d40f-4f9f-bd59-e169f66b8e94", "value": "T13CD36E12FB0C0863C483BEB41E3707AAE3568D9214FDE108A5097F5E1A33DB69987BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214550, "uuid": "94fbdcea-f9a8-425e-93a9-525b4fd07525", "value": "1536:AnyFU2Ey3zylrbO+Bqov31CdkJGRYwtS+NI/IyLNBOar4ytbBRv9QrmB36:ZEyjyl++BqovJGRYwtSvhLNBNHtXomU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214550, "uuid": "02f33252-79b0-4c8e-a397-fd555de2f463", "value": 132384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214550, "uuid": "21776053-154f-4158-8122-ef16b910dae6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214550, "uuid": "ec5def1f-7937-42fb-9daf-9e3ffd78f13a", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7676060b-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180219, "uuid": "e8db3188-c757-4024-9352-4a609cdf9eaf", "comment": "Malware payload (Mirai)", "value": "93a20eabed149483d0ad0eebbfbba9fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180219, "uuid": "c06e0588-e598-40ea-963b-674d71ecf892", "comment": "Malware payload (Mirai)", "value": "0a48ec05639f56bab8a8f235fb45208430db3094102758c078d899b83952780a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180219, "uuid": "cdd7fa14-1abe-4766-b266-8375a4773f74", "comment": "Malware payload (Mirai)", "value": "53eb0e30b693a91e3783eaf239a7f27f7ac0b5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180219, "uuid": "02e6ad45-690f-4edb-b07b-333826d3672b", "comment": "Malware payload (Mirai)", "value": "590e29aa4faf957e8e2bd847c36cf009d0e4c2432584ac7384274d252d8e10479446f857919e62373c53e43702d14365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180219, "uuid": "f409b7eb-74fc-4cef-a297-72c8961c3f3a", "value": "T10E933B4173544547F7AB0CB1283F7BF197AFD59021E0A286695EDB8B8272E32148AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180219, "uuid": "98530903-acc2-4831-82ba-c0247835c166", "value": "1536:C30qfbjiWdERkrLYIHiv2rk4RmJ0OYBzRiTgO5kshagaHFr4T2bVRf:C30qTZEv4RweREz5XAeT2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180219, "uuid": "18c1a2c3-7715-4ca3-b19e-66da31013eb8", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180219, "uuid": "39c76c17-9388-4f48-90d4-2356ad410f49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180219, "uuid": "ce071658-70f1-408a-a3a9-f1901094067b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2cf153-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179370, "uuid": "a07004a7-7ed1-41c7-91c8-55f7cf74c287", "comment": "Malware payload (Mirai)", "value": "0cc2c1406efc48d42e80db67f24948e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179370, "uuid": "d0d578dc-a3e8-44ec-aee8-86aef26bcd02", "comment": "Malware payload (Mirai)", "value": "0a64659ebf055a07127e26e202c0e0f85dcb7bf72fa23eb24cbebc2ab144dcb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179370, "uuid": "fa924fe9-262b-4c96-b89a-7020fd2f3203", "comment": "Malware payload (Mirai)", "value": "806e85a1b85a5c26290182bdc45da8f0ac04a6ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179370, "uuid": "6913c979-3874-4870-aabe-73d22a69ec1d", "comment": "Malware payload (Mirai)", "value": "c4c013cbbef50bd0f9fa38566a9a8f128b0638881f8b22c41afd0d25e3ea77f1eabfcd12d370f7cd427175bd4a92774e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179370, "uuid": "537050c2-366c-4a96-b339-d376af4864dc", "value": "T125838E12CC649D98F16A7E3110B8CFBB4713A545AA4B6DFB3C468225001B99CF5DBBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179370, "uuid": "11b04078-f8db-45d6-bcda-05470207771d", "value": "1536:llm/49V0fI1M1EUofZOHObJfj+8Nx7Fl3wCPGjxgTAbVR:lY/+SIUEUkmsfHl3wWGqTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179370, "uuid": "1057ce2a-8401-480c-a280-9ea468b59df5", "value": 83152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179370, "uuid": "f1c44cdb-381a-409c-a6a8-8292e73ab163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179370, "uuid": "681f9af6-9237-42f0-84ea-e8946428a277", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2c40da-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1768212171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212171, "uuid": "2f4129f4-a2be-4b6e-8fab-2a89f4745862", "comment": "Malware payload (NetSupport)", "value": "b8bcafb5167fbd63d88206a20916d9d7", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl8-com", "colour": "#25992F", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl9-com", "colour": "#8F3D65", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212171, "uuid": "23fe2479-affb-45ca-a066-25f4dba786a2", "comment": "Malware payload (NetSupport)", "value": "0abd4adba75d43196e3387abc2d2fed4da29e4926ffc1d23fdcd682d107f79b1", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl8-com", "colour": "#25992F", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl9-com", "colour": "#8F3D65", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212171, "uuid": "7d613c29-2045-485b-9140-385a4cd0cf08", "comment": "Malware payload (NetSupport)", "value": "993ebed59b8612d0466c860fcff3187ae69319f6", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl8-com", "colour": "#25992F", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl9-com", "colour": "#8F3D65", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212171, "uuid": "d1f3e3a9-aa9f-4d88-83a7-82dfb1fff400", "comment": "Malware payload (NetSupport)", "value": "f164669d1800352afe4e1117f2fc08cf6b9ba508cd9fadafe47e8cac315672ceb0541598fc73924f307f04c79aeb476b", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl8-com", "colour": "#25992F", "exportable": true, "hide_tag": false }, { "name": "stnbiontaryl9-com", "colour": "#8F3D65", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212171, "uuid": "cdd62474-481f-4a3e-b005-8d7751321ee5", "value": "T14BA2D0F20826CC58C49BE1BD12AF0B5623793752E606A325BB827D79CE12107E1E83D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212171, "uuid": "62d2b4dc-4056-447f-8482-55f62b687496", "value": "384:zuRFC4pZ2Zr3xe4q14W5ZQ6Tv1fA2tZF90qvKg9GVrEfsVLIXJ2TMBEdHHupCbkA:zgC47a304qmpSv1fA2tZ8WKg9GVrEEyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212171, "uuid": "9c8bff51-dd54-443b-9475-c0668ec1e90a", "value": 22151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212171, "uuid": "58ed20c1-2f16-494d-a481-e047f3f22985", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212171, "uuid": "838bb2c7-5cfa-4de9-85f2-689396afcd51", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f362bb13-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1768237552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237552, "uuid": "69280508-78ad-4e2b-a74b-50a1acb0a849", "comment": "Malware payload (GenesisStealer)", "value": "784235b21dd97163fd9389f07f563254", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237552, "uuid": "66bd9277-ade5-4ee0-9ab6-39eebf646d88", "comment": "Malware payload (GenesisStealer)", "value": "0adcd1e921555f89157b3fbb929cbc5a3b9533aca8d633d9e1a5efb22d114a4a", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237552, "uuid": "866ed75f-d1ec-413e-9343-f44b8262d9be", "comment": "Malware payload (GenesisStealer)", "value": "ea4246b30f53d100909c2bc9199bf42f8a3c7879", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237552, "uuid": "41b9d49b-2278-4b99-851a-bc0532f991cc", "comment": "Malware payload (GenesisStealer)", "value": "e02f6f1b623e40d74ae7b2d593c3db1bc3ef902286195874c5db65ec3ec97c7f3f424a44a74923c003223f223e2428c2", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237552, "uuid": "310708f0-1599-4f42-bb19-6a84a2760f6b", "value": "T1AAD4F29C538537C9A223B01F517754E724BC1D2B865838BAFA9CEB36DC19B0660D3ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237552, "uuid": "ea7636a5-ef42-4c3d-a018-8e0fc0962432", "value": "12288:DwADj2vqPV5lzzzS9ixK37b2N0aglzE32pdY8XXelvKUJ:DhLvlzzHq7/zECdhelKUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237552, "uuid": "38afa665-fd2e-4056-b9e6-56c4fe080cda", "value": 639930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237552, "uuid": "da704d00-2f1c-46f9-9f14-23d32fa167f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237552, "uuid": "5821a814-8627-440c-aaf0-c77d79358e83", "value": "835986ab500c63a9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf49d065-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179939, "uuid": "6c76ae11-7a4f-44a1-9d45-c8857eba198c", "comment": "Malware payload (Mirai)", "value": "e5deead3152d7a831fab8d13a89b586a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179939, "uuid": "1e044c68-2cb9-48ca-a15e-610cf01198c4", "comment": "Malware payload (Mirai)", "value": "0b3ba60ee4695c07e39026b6326539783ca6791cc11006fd3e18b3f538b348a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179939, "uuid": "5f09d434-87ab-495d-b24a-8ab8f6b0ee6a", "comment": "Malware payload (Mirai)", "value": "420336e3baac1f02ca560a9c7bace2ed6bc3db0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179939, "uuid": "484c53fb-bc06-4b77-bf41-0259662d07c7", "comment": "Malware payload (Mirai)", "value": "09b86087f41e3ac7c63211155f53977d5e9a927f8df1810180d3c3034afba9b2056b25d32e08f0e5149c92c78cb49b4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179939, "uuid": "15076c28-c297-4444-8a5f-3636c078f0a6", "value": "T18C532997B400DEBDFC0DD337D0E70E11B134B6560A522B63B623FC67A971098696EE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179939, "uuid": "656d26ad-d159-4aca-910c-21e6fa563f1b", "value": "1536:W78M/naATmQVA0DiEE+2Xy9S6WbIrpH8JhBETPJ:wPy4M+LS/bIrpcBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179939, "uuid": "5b5cf52d-bbf9-4ef6-a0e9-1ac2a0a091d1", "value": 63112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179939, "uuid": "df006bf7-f1cc-4852-8d69-33493b7e4eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179939, "uuid": "97dfb124-29a6-4b3c-bca3-c3bd6af6111c", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c06bf20-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216736, "uuid": "1f70952a-c51b-494e-80ae-4d33d4249db1", "comment": "Malware payload (Mirai)", "value": "0c4cf43bcdabc56c9983e04aa3ce8b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216736, "uuid": "ed4c0dbf-cb3a-4130-83ea-22314ce6bb01", "comment": "Malware payload (Mirai)", "value": "0bbed3bade9eb683c8de2830666302183923641e7d83a7fa4c5bdcf2a7a53d1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216736, "uuid": "99609551-dacc-4b47-be84-8ad49ae4fb83", "comment": "Malware payload (Mirai)", "value": "90f82a0d6744b3362619747883c8df7518b4de86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216736, "uuid": "8d28667c-cdd6-43ab-924e-35bc7751e90e", "comment": "Malware payload (Mirai)", "value": "704d945a519aa1e1f42d9142575e0785bf467790d061ab164eecd969f3b91e189361044b81122c0840fca3363da5f87c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216736, "uuid": "d7b5a49c-7894-408c-ab43-4fc4e39176e2", "value": "T14A13E05E641100B8F228947217FA57621EA1CF638582F84F58AEE3D6DCE59DC3CBB9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216736, "uuid": "5b43059c-897f-42a5-a0a9-fccf8807a100", "value": "768:oVKH+MeiZH7D0d2a2MS/tuSYfS4z871Mu2Jrmbs6MDJogZJgGlzDpbuR1Jz:oV+1eObwKEfi1McbKVoSVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216736, "uuid": "9fb20d20-0113-4bfe-98f3-a953d2d86d60", "value": 43224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216736, "uuid": "fe4fd0fb-ab4a-4a88-a1a1-7cd36ecf67c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216736, "uuid": "8351e219-4256-458b-a09f-fac427f56c49", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8037d367-efab-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1768218031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218031, "uuid": "e0f3bb9c-1e1b-4ee6-abd5-fb45ca4cb088", "comment": "Malware payload (DonutLoader)", "value": "a11a617d9c31c8964db95b8a62342402", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218031, "uuid": "f8af8d9f-5546-49a7-a285-9a1e0c61ad5f", "comment": "Malware payload (DonutLoader)", "value": "0bd1d24e8009c65086ecc928e526d5668703e51a09aa0c642a9ea80f6a92fdba", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218031, "uuid": "70e62e69-cc7a-499a-8158-53c9c77e7092", "comment": "Malware payload (DonutLoader)", "value": "2af4e3d29d34d4446c8eb2a9e0e6b38f9ef5c7f9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218031, "uuid": "2d59e5d2-e965-4eea-af9f-87f56c79a7ab", "comment": "Malware payload (DonutLoader)", "value": "ca6fbb0c67e73b1a924e716df379fb7836efad4786b40e84a7b4c751c145e02994757b3dffd2535490b8ced57a192946", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218031, "uuid": "ef579ea9-fe1f-4004-ba09-4b85987c1296", "value": "T1CA267D5B337511E5D1A5C139D667ED02E172781B8321A9EB0AD6CBA61F373E0AE3DB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218031, "uuid": "141fc948-8713-4d8f-8cf7-8f59028fbe25", "value": "afafe1bc17da846601dd9343debe4bff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218031, "uuid": "249fe263-2968-4b52-8e9c-83026ebd6b70", "value": "49152:89CVYIliyVMXHjQh/PERTLBsX1hfQikQ04La0c8DDOXToGo4b/iJVUm4FnMorZJ3:rdWTQh/PhJRJCoRO/ismwrldMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218031, "uuid": "6cfeaad1-32f6-4f75-95ac-9d669772c506", "value": 4847616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218031, "uuid": "835e2218-60bf-4e75-b520-31e83a1d9ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218031, "uuid": "1e8cc69d-3ffd-49f1-ae1f-8a21a3684559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95487e32-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230522, "uuid": "ca244759-7acc-46f0-9da3-b8815d7cf416", "comment": "Malware payload (Mirai)", "value": "7d2614c881747b43e0696812155c712d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230522, "uuid": "dd02765b-b4a6-47a0-bd2b-fb24f7de34fb", "comment": "Malware payload (Mirai)", "value": "0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230522, "uuid": "a45c14c1-f092-463d-89b3-a7b61555c886", "comment": "Malware payload (Mirai)", "value": "35fc684108de5e79c88e584df5d9244f519085aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230522, "uuid": "99382f85-ee45-4c3f-a9c4-03e080fdbf02", "comment": "Malware payload (Mirai)", "value": "6bd3284d5437e769bb01f31d0828b7431bd2ec7ae948abc941d28676f4d5f51915fa008105f846bb54998c5e3084282d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230522, "uuid": "cdc36277-1104-472f-89ea-be9277de25da", "value": "T12631C9CF463F39154EC7CF1B73E107CA5185A3E1E097DBF59808192668C5888749DEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230522, "uuid": "49b332bc-dad2-4003-af0e-f96a3e724e9e", "value": "48:AVThJWdVjNJ6C9EyrNjAiGOWy48Tk78GQn2:AVTh0VjNRE0NjAu743vQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230522, "uuid": "5f1c9988-fac7-4068-94db-cb4b3bd376fd", "value": 1716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230522, "uuid": "e16dcb8f-a04f-4acc-bf2a-d5c340f2508a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230522, "uuid": "182b5f94-af00-466e-998f-b13579aaff5c", "value": "nigger.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f25b49-efd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234981, "uuid": "09e3cc10-6530-4eb2-9e97-171d636b7727", "comment": "Malware payload (Mirai)", "value": "f1bed9f11d1d2ee489314b80c0b69603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234981, "uuid": "f35f7a29-3b77-4e70-a973-2202b2728958", "comment": "Malware payload (Mirai)", "value": "0c250b04c0aa5d0fcbaedc4c58bed45a7553f4129fa160c507bd457ad443a4e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234981, "uuid": "e7c53b3d-b60a-42c1-9ca1-24b8e6cf6799", "comment": "Malware payload (Mirai)", "value": "c61f464b37dd156097f15cd9962457e1199aa7bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234981, "uuid": "0c688831-5536-4cfb-b939-1d6949c586dd", "comment": "Malware payload (Mirai)", "value": "edaa58500dcc8fb95c8dde683e8ea859be9c81338c3eb07ff6c247a035e396b241171622535a14a2443a43b44bd19c4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234981, "uuid": "9a3f2853-3a9f-4f45-9664-a335b6db1894", "value": "T1BBF45B06EF891FEBC46FCD30492E434715ED89EB0AD1933461BC8949BF8D66A4AE345C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234981, "uuid": "3b0a8076-8ee9-4f65-af8b-59c30d82ebbf", "value": "12288:rAv/iirpmMtVdiSnhwzlzDzkzTulUenFbiGuS6yAmaKw0C73cHaf8dm73Fwn+AZv:M23ep+e+c3tyns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234981, "uuid": "65fd2fc1-2375-4acb-a492-51dd6b75b590", "value": 731944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234981, "uuid": "015c0da2-6f0e-4335-ad14-8a9ae9fb74f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234981, "uuid": "8ac50baf-09f7-4074-9057-d1242cd105a1", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7a080d-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229732, "uuid": "ff05840b-9c9b-4e11-9e13-d4fe5af2848d", "comment": "Malware payload (Mirai)", "value": "56eb872eaa140a3ad381072e69b16089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229732, "uuid": "c531a6a2-4a68-4a53-8cbe-6d1ae679666f", "comment": "Malware payload (Mirai)", "value": "0c9fec4a86b3d5f01edf6cac086e519055f646f9edbe19593fa6752fa9c71ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229732, "uuid": "233b91d5-9681-4c70-914f-2891af0c3d15", "comment": "Malware payload (Mirai)", "value": "4c214fa6397b5443c25bf8186fc6439251166909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229732, "uuid": "74984c71-efb5-4fb2-9f6f-c7a9d9bd832b", "comment": "Malware payload (Mirai)", "value": "8aafb577bd549a80e70ac13f9eca15b780fe9d130e6eaa36f270c4b60bbdb160b82c303640808f07f27c794255ed0817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229732, "uuid": "a208a393-9ec5-432d-90e3-c178537cd3cd", "value": "T16C74E796EB411EBBC40EEE31011F4BC511AD809953E7876BB278C45EBF8EA0E69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229732, "uuid": "269bb866-91f3-47e5-ab44-d5abe3ae304c", "value": "6144:2eFEOrQTAdKWIkF3ubj09WjULVVnn9kwDLvB2rgoIUCT4y0Wm9MFbU7Z:JFE1sl9psCsy0Wm9OU7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229732, "uuid": "085d1ba3-a195-4c07-a9c6-8b5a897f29e6", "value": 364672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229732, "uuid": "2028d58e-3432-41d1-a01b-a6cba988522f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229732, "uuid": "c2b0433d-35e1-49ea-93e1-89b4b014b731", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62205853-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182333, "uuid": "954e14a2-8caf-4798-9b68-9c89576d6ea7", "comment": "Malware payload (Mirai)", "value": "a8a6deceb33e8341c3fee6ca700c7960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182333, "uuid": "4a31be45-c718-4de6-a46b-7270d654b075", "comment": "Malware payload (Mirai)", "value": "0d0a594a7ffb37d294ca431e94263bebed5fcdcbfb5bb0a6e75df3f292d26f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182333, "uuid": "117f6dfd-ccda-4b64-9972-68e065892ed2", "comment": "Malware payload (Mirai)", "value": "79fb34ff37ed3781e88334181635b5e9e6232e0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182333, "uuid": "ab458a87-5cc7-44ee-8101-f9e30fb67d6b", "comment": "Malware payload (Mirai)", "value": "539bf1bf6ac9568b728ac535f1ea9ca51bc348fa4581a79bb920d65b6a38dc9198bf4fea991cbd16f283c55a25dea989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182333, "uuid": "b395238c-bd81-42a0-9d5e-77569166bd4b", "value": "T144646C8CBB4CFF42C29093BAED6B0613B33934607B4A86637D15222DEDD37989C67156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182333, "uuid": "cd61054d-e032-42f1-920c-acd2b050188d", "value": "6144:47UzBsdXUqY/wku8HJkZ4x8Px8KwODQWJfLohjE0Xh2utyEe:4Qz6dXUqY/wMWa4QWJTohGutle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182333, "uuid": "0c52b0c1-d732-457c-b3bd-d73e52f58525", "value": 332368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182333, "uuid": "3a85ecdc-79e1-49e2-81d8-9eb42e6e2f60", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182333, "uuid": "5929fd8e-4233-4b2b-ac06-769a5589ae8f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c82a39-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218690, "uuid": "afcdf4e9-63fa-4209-9165-6192c2fecb17", "comment": "Malware payload (Mirai)", "value": "7849000712d9bdd033c701940926974a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218690, "uuid": "f9bfde99-0f93-4f9d-8dc7-8169accd0cff", "comment": "Malware payload (Mirai)", "value": "0e257f4bb69885c6da9ce472b0ebe26da63c33e12e7fbb72e6913d03eaa2c2ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218690, "uuid": "fd7c6218-59d7-43dd-bb76-f9ba19a137da", "comment": "Malware payload (Mirai)", "value": "a13b7f3a411e38d54480e9778a8ada2e7865e12f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218690, "uuid": "c1f5aed1-8fd5-4647-86e2-269e0c083c2c", "comment": "Malware payload (Mirai)", "value": "046bb6cb747bc1e36bf16bce9d14de5dacdb95765161916305adca2cbb9e8169d771aa2fefceaec9b6e5fdc41fd5cd1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218690, "uuid": "a5c2bbf5-71e3-4f5b-87af-6f54bcc0a586", "value": "T1BE13D1AFE275455CD01E24B5048FB69A5450BB0F1994C5A7BBC0BC6D2CE0FA236743BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218690, "uuid": "22c7c592-e1ef-49c6-b6bb-1b57fa6e5510", "value": "768:uzTR9eprUTCqhF24cOAe8XSh/Sd+sc65/rfqp8dhXQYQTd2t6fJWFnbcuyD7UHQi:uOprMCmIjJ465TA8zXYTdUJnouy8Hyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218690, "uuid": "01ae492d-e394-4bba-8441-27a151b2066e", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218690, "uuid": "11c69529-20e0-4e22-b84d-4d68b8ca3074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218690, "uuid": "68af6ef7-392e-4d25-ad22-87ec515ec5a0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ccdea1-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216799, "uuid": "567ee0ad-6131-4321-8b69-c5f0e80706fe", "comment": "Malware payload (Mirai)", "value": "63b7fa08453526958ca3c818fca88914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216799, "uuid": "2ffd5fc1-2109-43e7-9c17-dcc506cb06a5", "comment": "Malware payload (Mirai)", "value": "0e3acf2634ca7d82be156749ff8ad2156da1c4b070265821121995ac9120f453", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216799, "uuid": "d7610ee0-0857-4f45-8c70-c3ae946e4d28", "comment": "Malware payload (Mirai)", "value": "288e465f6a21aa765625c3b2b0638e45a89b0002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216799, "uuid": "828d2e7b-011f-47cc-9143-a0cbcb805353", "comment": "Malware payload (Mirai)", "value": "7a5ece0d80c671ca3817ac1b3014fdb90cc9354f5df5e346893bb2620d1a0561b9fd91995aef35a2a5466cc8c6a23890", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216799, "uuid": "a915d7b6-703c-4b46-b087-730ca8f2b872", "value": "T1DEB3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216799, "uuid": "cadac34e-08c7-45a9-956a-f11359764c52", "value": "1536:aEkWiTLiZECcpHOWWJDmun5Pd1Oe4AYLxlrwTH+E7+TeVedVPneQBZN01Qan:oni50po9tYNlrwr7+Te0dVPZ01Qan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216799, "uuid": "7a68b5b7-7e21-4330-8e05-d192c1a44d0a", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216799, "uuid": "47a6b331-fd27-4829-875b-35e48837d78f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216799, "uuid": "c8989969-a125-4a25-a6df-d8a6a9972b3f", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5016edf-ef8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204054, "uuid": "26eb9d81-a42d-49a4-90c4-97e9f2c69cc3", "comment": "Malware payload (Mirai)", "value": "94be77cf549ba523614349c79b78969b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204054, "uuid": "0b21984d-0aa2-43cc-a410-f5dbbce0572e", "comment": "Malware payload (Mirai)", "value": "0f05b49b254dabf8cd6f28c2fb6b7f2c50ec3b39bad8bd7f65d807c38a8d33a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204054, "uuid": "b1a26a4d-a7a2-4643-a496-04cbb06d6351", "comment": "Malware payload (Mirai)", "value": "135c6b1a4637d4cba764aba9722c419977d5c797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204054, "uuid": "b35386cc-f875-4c42-8f6c-ae46f2cdc45b", "comment": "Malware payload (Mirai)", "value": "fccd82424bca1626eb7d926f1f0f44a143276e64a95191a4560dc7e11a260b80f296eaf08067669666fc422124e95c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204054, "uuid": "46f333f7-0b8f-45fd-a561-545ff308d9e2", "value": "T1DC933B4173584547F3A70CB1283F7BF197AED59021E0B28A695EDB8B8272E321486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204054, "uuid": "349b79cd-e55b-4a7b-ba57-7359c19b9116", "value": "1536:3SFqCbSjOQ5krLYIHiv2EIUB6yKhCdiQ7rANOiAC+5ts56YynFjIT2bVRu:3SFqws4UB48JBLx5OgWT2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204054, "uuid": "e21d4b59-748e-45bc-aec4-97e23b00c816", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204054, "uuid": "f15a0518-0327-4a65-96b3-4592c3d24fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204054, "uuid": "bf5d5b9a-35c6-4d9d-b509-920bd61caa2c", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908fadf4-ef8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204315, "uuid": "7da86b5e-bd57-4722-ba2d-7032db81961e", "comment": "Malware payload (Mirai)", "value": "8ed9bcf0daca4da41fbf735aa538c0dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204315, "uuid": "cfaab9ab-8d63-4a8d-8dbc-5adc1d143539", "comment": "Malware payload (Mirai)", "value": "0f5c61816b5c0a220147d397841beda45c4108cca9c991c29f09da542aa744a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204315, "uuid": "c4ef736f-c56b-45fc-9bfd-a3a990950079", "comment": "Malware payload (Mirai)", "value": "93816348c1fa608940c9a4d8b0b84c0f45e73649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204315, "uuid": "35befe94-7b85-4d99-80c1-8365094014c1", "comment": "Malware payload (Mirai)", "value": "fb2db6e10c9a1d40922ccc0c2c74f5f755c36eae3adbe84eeaf542652ef6c8a133ab08723b3fc256f25c0de4b988f3e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204315, "uuid": "f245c563-b10f-4057-886c-1d823b847413", "value": "T159532987A804DD7DFD09D333C45B0E11B234B6960A631BA7B333E967EA710D4586EE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204315, "uuid": "87177d63-55bb-4f57-ae3e-c2d61b7196ac", "value": "1536:jbkloKDo3/aDZZAens0lERmx3L9IHGs1b5er846qYETPQ:jE8v6s0KmfIms1b5emqYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204315, "uuid": "5656be03-da87-4ca9-b721-f90aca94c0d0", "value": 63224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204315, "uuid": "f71f3cbd-d9aa-448f-aa39-9ca30b5dcc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204315, "uuid": "e4fdf824-ac1f-4bf4-b14c-ee1a77b1008f", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3623fbe0-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206311, "uuid": "96390c60-ad6f-4baf-93a0-7983312123c9", "comment": "Malware payload (Mirai)", "value": "67a63837e8f144dd1ecf451919ec01f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206311, "uuid": "879f7d42-8b21-4e87-a632-800a9680e7ea", "comment": "Malware payload (Mirai)", "value": "0fdfa488d620fddc5005a0da4f4a279c054094895ff59b71baff2f2edbb67601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206311, "uuid": "f3c1ac18-5722-46e0-b41c-dc48a76e67da", "comment": "Malware payload (Mirai)", "value": "c153bebd284ec2b1b5b231361468000e0c0bc59a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206311, "uuid": "81bcd2b5-9d9c-40a8-9e41-aac771544a34", "comment": "Malware payload (Mirai)", "value": "7a471325637cdcb9d4d33243921e03ddaba078f4a035d6d519a545739bcf0f05775a50026af4fd115cdd3bdb3d6c9476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206311, "uuid": "fe63d2d3-d00d-46e4-b83a-c67552bce833", "value": "T13443E885F991C616CAC4627BFF0E43ED771643A8D2EE73039919AB25379782B0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206311, "uuid": "74df81ae-ce5a-46d0-b4e5-c388a79e81bf", "value": "768:tuBV+B2Lz25tQLuEjd82ztIIX4WpeIDgYxy1sC0LF+auPSc1jFT2bVR:++B2LZq2ztItyxDgn6WSuFT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206311, "uuid": "b10788fe-7397-4d8c-b1bf-d14f79d802ae", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206311, "uuid": "fdd59c99-8c36-4682-99d4-ce156d99aeda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206311, "uuid": "79b2c559-f724-44bd-8252-c9ec3c3723c2", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fb7a6f-efe7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768243722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243722, "uuid": "0ad97883-537c-418d-b4cb-7b99b5376764", "comment": "Malware payload (Mirai)", "value": "7c8312339e07c922a1361e5fe194eeb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243722, "uuid": "062aa1e5-e949-4406-bbb8-12b6d22eee39", "comment": "Malware payload (Mirai)", "value": "12b139465cd9d9535e453062c4417e4a8c4ffc5a672c50529a4b3a91ca6ec20c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243722, "uuid": "8903a127-0164-420d-8d7b-069dd0a3e21f", "comment": "Malware payload (Mirai)", "value": "903299280997dcb5997936c8f767e77e5de7dec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243722, "uuid": "0dc3e5df-1fa6-4094-89b5-8905571f05bc", "comment": "Malware payload (Mirai)", "value": "617aa199fe7f6b43083b68f8c62ae5287374663174649a4285bdc87aeb201ae370ac9c673645fffb037a5a8d6aa91525", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243722, "uuid": "433106a8-6d57-4a17-b80c-806bcb0ba13b", "value": "T1E9C32802F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243722, "uuid": "ea85b5c4-0f91-49e0-bdbc-636f3ebd5ad7", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7B/UcEzkzQ5AdojgaR/L:eH3TghM/1weZbcnITeyosFAIxnJdhgJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768243722, "uuid": "68e7aee4-06ef-4a6c-b717-35db11ee70de", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768243722, "uuid": "fc0539b2-51f2-44df-ae2b-579c05aa9f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243722, "uuid": "208dd6ea-137c-4843-9a17-851397481cab", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88eb3a86-efd1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234367, "uuid": "14f4760b-ea4f-48c1-8bcf-233d601da344", "comment": "Malware payload (Mirai)", "value": "6c19a10dffd9c0b53d00c9dba69e5193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234367, "uuid": "035de7e9-8be3-4110-a135-49917d1fc371", "comment": "Malware payload (Mirai)", "value": "12ddf42868d6893e3e3617b9faaeecb02534c3d22f737b99843266e6ca739022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234367, "uuid": "e5ec1f73-5110-463b-b52c-fe148880914e", "comment": "Malware payload (Mirai)", "value": "251e8c125dc6012db75c6602eb3a2ae127e2540c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234367, "uuid": "0c1e1521-616d-413f-9952-2524f9aebddb", "comment": "Malware payload (Mirai)", "value": "7bee8d9140263a8e1a08223172b5d2730f0323cd4cb341e9cc1605ac1ee351da4d22954a9c6f31c9f281922901a53215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234367, "uuid": "c83cea70-9186-4b5d-ab9b-0693d186efd9", "value": "T188F33846F8404F53C6C612B7FB5E428C372A07ADD3EAB103AD256B21379B85B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234367, "uuid": "1a00beb7-4545-43a9-bf29-4534241fd027", "value": "3072:MYd4685wKQKJrVzQv54eqFawtmHDzpBrYOjzbWha6hh1wO:XQ3QKMv5RvwtCDzvkPh2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234367, "uuid": "dd958bbd-d568-4ecc-9626-91842e61fb06", "value": 157736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234367, "uuid": "6e3af119-aac5-415b-8547-f1a0fbd7c7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234367, "uuid": "4a693e72-eb74-457c-b784-b45c2d756c03", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaac36a6-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206077, "uuid": "79220577-9115-40d0-b0d1-d006be11dec3", "comment": "Malware payload (Mirai)", "value": "5f073fbbb88bbeb61b415b6bce702550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206077, "uuid": "e95abe0e-3fc5-4ea9-b3b3-59d1e45dce52", "comment": "Malware payload (Mirai)", "value": "131cbb28d96e99e56e97baeaddd148a03ceeac42a5685d3d80367db4e9d087a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206077, "uuid": "174332a9-2a55-40da-af43-8578782a4f6f", "comment": "Malware payload (Mirai)", "value": "3f7eddfb1f54e696ed1ac9813506a103e265c3d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206077, "uuid": "5a8e1323-d4d9-4d05-9475-cdd8854df17c", "comment": "Malware payload (Mirai)", "value": "3d25e0c9748a4cf564c7580f950bd93a12fc152aaf29f4d8eb2fd92d587895673fab6fa33e4ca8334643451d221843ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206077, "uuid": "b5ba289a-f3c4-4683-a82f-5b944a407e30", "value": "T1DC837E12CCA59D98F07D7E3060B8CEBA4713A545A94B6DF72D47C221001B98CF5DEBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206077, "uuid": "a6237b47-fc80-4e86-b84a-2bc23c516105", "value": "1536:S9nE4O8DTLWMYosFVwD2BsqoRJ2jtcNxpv36Cs/UZlMTAbVR:SdEqfLaoscGLQ2i36tsLMTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206077, "uuid": "435c2b23-590d-4743-bc3e-ce472c5bcb30", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206077, "uuid": "22a32427-2334-47dd-8bde-85ef61192340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206077, "uuid": "cfc2cf62-4d0b-44e8-9363-3dd2ac95def0", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055dee9-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179377, "uuid": "c22938b3-b924-4f46-9cdb-f081b68258dc", "comment": "Malware payload (Mirai)", "value": "a83fcf99eda393b7cb56080420cfc0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179377, "uuid": "5ca94fc1-efb6-4c28-9c4c-53692f2f000a", "comment": "Malware payload (Mirai)", "value": "145fe06803d39dbea0d77afc7b2eef04f3481f78f6f4a9e96a1118a5170285fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179377, "uuid": "f738ac1c-da2c-4348-80c8-ffd42b925ed3", "comment": "Malware payload (Mirai)", "value": "721561d7e5738952c5a80cf8b0379192190bf6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179377, "uuid": "5b1d214f-8d51-4a8d-a7e7-eb113c58134c", "comment": "Malware payload (Mirai)", "value": "73d87bf69d19d4d9cbd2bbeaf67559e7e38f5173db2883196f5bc05a566fbf214b5aeb56234cc209727ecdd15f9fa1d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179377, "uuid": "668b8dd0-1efe-4e85-8bdd-dddfd05ec41f", "value": "T16243F985F991CA16CAC46277FF0E42ED371643A8D2EE73039919AF25379782B0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179377, "uuid": "cc388f18-0217-42ef-8735-c33e4a79ce81", "value": "768:Vc04soRPeN9D89u1B7772ztaoXCXVx26IAdxfOK/T4+PAreuPx31RtT2bVR:XoRPecsb2ztaTz2tATOK7GxHtT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179377, "uuid": "a3ce16df-aabe-4886-8553-f7ea0bd57973", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179377, "uuid": "b066c58d-a549-4125-b906-7df9dacac825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179377, "uuid": "f7878ec3-692a-4460-a85b-d4a8b4502279", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06369c50-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218686, "uuid": "896f0e66-3703-4bf5-87e9-ebe2d3f524a2", "comment": "Malware payload (Mirai)", "value": "d7433f796d5c20f4e3fb0f495b9538df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218686, "uuid": "4533dad8-2695-4b1d-8a55-d2ed38797ad8", "comment": "Malware payload (Mirai)", "value": "148ab876a1369b50822d60d9d6f8dc25f43a1052f570118c7deab86f5edccf73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218686, "uuid": "0e8cf983-0f0a-4d2f-a7a1-ecd4599ededb", "comment": "Malware payload (Mirai)", "value": "3a9eeb6a2f462b8297e14ff0517eed243b5989d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218686, "uuid": "c5fdf4d7-f4ad-4124-94c7-8128b08f2ce8", "comment": "Malware payload (Mirai)", "value": "ce5a10da5d8da210e255e73552f786e5ef60e6536026a586b0cd8ffe3f8c76fa762eb82110d6f7920510b5788ae56e5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218686, "uuid": "8805ef89-84e6-4a5e-8349-9bb766ddb64d", "value": "T18503F156696ECD0CDE26757E01FFB14F4580AB3F0645CAA682C016BF9DA923124392EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218686, "uuid": "5360db61-eda9-4932-be92-b00802dbd389", "value": "768:FAW+GkX7xgBSxKLgTcSw7S6YPDCxu4C7Se8xKPgnml9ND5j0/VjZytB32uNmXnbC:F9sGBSxKcTc3e6YPDCuS7sgn+9tyjGm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218686, "uuid": "02adee1f-bedb-46a0-9d26-8a79cd21f945", "value": 39676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218686, "uuid": "2f907d8b-c2ea-49ac-82c1-806ad406d79c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218686, "uuid": "ff768d88-1d18-4cd9-8710-56925733e024", "value": "johen.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff8d39d-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180772, "uuid": "d7d04402-2788-4203-8bb1-38a059e40d3f", "comment": "Malware payload (Mirai)", "value": "ba9b1495dee84d4adaf33d043568fd8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180772, "uuid": "0d8e3d22-49b7-4f61-b828-61bc5a66021b", "comment": "Malware payload (Mirai)", "value": "14b4b19dc1e3e6200d5a212ddeab6b7a86967e977e727267e81e33713c2714d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180772, "uuid": "2dd43eb0-6cc9-411c-88ca-ee2f015c94a7", "comment": "Malware payload (Mirai)", "value": "de1f68fba3441ad50d2a56567560300b28377914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180772, "uuid": "756d688f-8b16-4b74-8760-0db110db26ac", "comment": "Malware payload (Mirai)", "value": "f99f1e750e36b7b444f341f7d909ac797e1db7c66a78edc702bc670de06e6cf2b50d4d292b603a2b9c62ce92db6bcfc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180772, "uuid": "2f7b0d1f-c13f-4ca4-997b-7c6e8e8d3659", "value": "T13B834AC18683E8F6E8080179A176F337A6B2ED750178FEE3F75496722411EE1B14A34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180772, "uuid": "c5536d0c-7d19-437e-91d7-22d6ffeab654", "value": "1536:zU1laMHKOtSkYITINf4+SJjg2WOzaZBRjq0jPcE2AeRUYsnbz1dHViHb4I8P85Xg:zUT1HKOtVHU52jiOzaZBd12Adnn1xE75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180772, "uuid": "51ead0a4-464a-4ace-b2d7-b519daf5bba2", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180772, "uuid": "d83f55de-2cce-4069-b0cd-76ecce05690a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180772, "uuid": "31b806e3-4296-4ac9-8cfe-0b1815b6664f", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0676b0-ef67-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768188897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768188897, "uuid": "6c01ceee-c697-4064-9a98-dc5144674244", "comment": "Malware payload (QuasarRAT)", "value": "e2e49da442e01f75f0294110ece00498", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768188897, "uuid": "6f8722b8-563b-4407-8b42-0db9bf9c817d", "comment": "Malware payload (QuasarRAT)", "value": "153c95a6f37c2deaa6d6f38d643cdd08fad6ad4ba58d81e5e19d01193baf76b0", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768188897, "uuid": "26bda793-3cbf-4983-8a53-18608d5507c0", "comment": "Malware payload (QuasarRAT)", "value": "2941bed13667ddbab876933a65f95f055f911387", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768188897, "uuid": "9b25f281-9e5e-4a56-b7cb-e3ee40e5cd95", "comment": "Malware payload (QuasarRAT)", "value": "b6d78bbcb797e09ff2eee62d7fc5451640f69d46fb309f2d08a9c101d50509566fdcec8a7916c7c24d0591ea13720888", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768188897, "uuid": "237620d7-30f9-4e75-83b0-f33cf082240d", "value": "T1A053023C2E3FC21A7ED6C99C5A06860D77FBB74E28211C446D41F658E23D1E87431A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768188897, "uuid": "baab88a9-7c2b-4349-bae9-6a426462ef61", "value": "1536:/tW4aPeTWBQNmid/yuu7Y0rj0o/+fZ/nmWc4+GuIUv:/tW4aNeec0/vWfBdev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768188897, "uuid": "a50b852e-f2d4-4779-930e-b518f7bb3859", "value": 61603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768188897, "uuid": "470c684b-1ddc-4ea8-ac60-bb829ebcc653", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768188897, "uuid": "c1c5d50c-dfbf-40a4-bedd-a87b0085cb0d", "value": "gameverseinnetMalware.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847d2403-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246385, "uuid": "22494965-2e26-4ae4-a613-c4bf14d46fe5", "comment": "Malware payload (GLOBAL)", "value": "0eb3bce50d5ec62dbca9ba8787c8206d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246385, "uuid": "439f5720-35a6-4481-b8b7-9e301c9e66f1", "comment": "Malware payload (GLOBAL)", "value": "1582320a0c27d70bde7a97cbe53682dab83efc95124f5e2449bd066960c7e5b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246385, "uuid": "4ffa8e03-50fe-40f6-9a83-354d5c390a45", "comment": "Malware payload (GLOBAL)", "value": "cb09ebd296e08054283dcb81a6c75cd07cfbab7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246385, "uuid": "3afd6007-5217-451b-963f-3837072f6145", "comment": "Malware payload (GLOBAL)", "value": "9e1d67a8225e26fece7e2c8b8b508a25193f63d37bd1afb7fe8faa243dc380e622e20479434b637e18593a7c06aa2d9e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246385, "uuid": "d833bba8-b995-4495-9dc8-69c78233509e", "value": "T1B0347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246385, "uuid": "72d8f024-5bb4-4b86-b6d5-40fa08d8b21c", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246385, "uuid": "051346b2-a1e7-4263-818c-7a3f6e3e03c4", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246385, "uuid": "1b1c8e6d-6787-403b-8ae0-517cf137b4c7", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246385, "uuid": "6f0db21f-d060-4757-a91b-61a3e2e475e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246385, "uuid": "ce716434-3943-4919-ae56-5b10bb16c3bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d36d64-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216749, "uuid": "9fc76fbc-4646-4f8a-bc6d-ca756405a53e", "comment": "Malware payload (Mirai)", "value": "9a60e9e8e0f4966652163d5028d649b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216749, "uuid": "e1123987-e292-4399-9a67-12545b157517", "comment": "Malware payload (Mirai)", "value": "15d22fe6d17b10f7dcd5e5336526743926031355bc9b396a6644d59890b3fa71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216749, "uuid": "03ccc081-41d5-4ea2-89da-8a834c0855d9", "comment": "Malware payload (Mirai)", "value": "307e522c89a4926ddf8c12bf68eea5a50379c0df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216749, "uuid": "658cc5d6-8cea-434a-bbc8-f73a7a992368", "comment": "Malware payload (Mirai)", "value": "9781116f5dbd6a0c5ed8d0569c19f5ed67c5a9e2af4d0c98579e5edc6f672de098e7a774fd1e3d1bd0e879c3dd2ab9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216749, "uuid": "fabd2bd0-3f64-4c1b-8a16-873ed38b4932", "value": "T15B9318C6B401DC7EF80FDABB4463690EB630E25116931B27675BBD93AC321E05927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216749, "uuid": "6a7751c8-6cc0-4587-b22c-20a360b9ae69", "value": "1536:rsdLEbXJld3p+E69RU36Vz/HpU65wtFWeLU4xPP8bcjqL0n5nvt00z/TPVoPWy5l:r7+H946Vz/JKweLU4JrGQnF0qwWy534a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216749, "uuid": "ed940ba2-b39b-4e7f-91a8-51e420d35416", "value": 96724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216749, "uuid": "8b236eed-44d2-4b68-a85c-d814eff5607e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216749, "uuid": "af33fa77-1c6d-4752-9802-0a04428c32de", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d176d3-ef59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182872, "uuid": "3778a725-62bf-4d47-b1fd-0face5a07847", "comment": "Malware payload (Mirai)", "value": "79b4d7905548322c42c0fb361e00e2d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182872, "uuid": "3e9d769e-fdb7-423c-8c10-891b76c75e42", "comment": "Malware payload (Mirai)", "value": "15f754d33706e68f6888eb869f6565ee4d129903fe66916c416a23267520d217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182872, "uuid": "b898ac01-7087-449d-8b19-bbd5e4d408f6", "comment": "Malware payload (Mirai)", "value": "076ad2fc0e138bcceb74b8c0adb509f617ef613b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182872, "uuid": "8b1151f3-88ed-4d9b-b7d1-729a0fb18749", "comment": "Malware payload (Mirai)", "value": "c1dbf8e0fb5cf5a32b298e717d80a370f32982b6ffc1fac47b5062b6ff647338120a77dce66df49d7ead24cea37eb957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182872, "uuid": "10ad7b1c-df61-40c8-8779-0cabc58bf33b", "value": "T1FBC42367A127F323D99854F86A06CB5226586A7FDDCCC157EDC8CDAE017E2326CF0445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182872, "uuid": "c7855c7f-db61-41ab-af24-ccd886ecf75a", "value": "12288:Eb/wrfW8ytWAm7WuLZm8VWoEoVXygPbznFcKsWx7HINM:v68ygAYhLZEoEo/FZ5VoNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182872, "uuid": "3eba8b44-0bd7-4072-8465-504f3a7f49b5", "value": 543716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182872, "uuid": "2961895a-e816-4da5-9f55-41ccc98efbde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182872, "uuid": "09f756dc-f4ce-4fc9-acfd-e70f70f6485b", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb25dc3-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179642, "uuid": "61860e1c-3a94-4ec6-9dd7-a64f3e0ce210", "comment": "Malware payload (Mirai)", "value": "f8f491505a5453b8a4f671ca648440a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179642, "uuid": "19612e69-9dec-4250-8686-4463600e1690", "comment": "Malware payload (Mirai)", "value": "15fe6abe35773afa4c2760e132f5504cec055df4768da0d88c902e2101f487cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179642, "uuid": "ff3a77b4-8c43-41f7-bf72-152adfa4fc1f", "comment": "Malware payload (Mirai)", "value": "747a80b042cfcafd8407d4675924b53e2971a4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179642, "uuid": "42b77244-80da-4008-a4b1-ee70b51b897d", "comment": "Malware payload (Mirai)", "value": "2b24b404f907eff8ed6845a081f9305c8c47dc3ff2cf38cc84528aa95d8651a18c8eff9ea8b6ea8458abc636a6423740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179642, "uuid": "77a141ad-f2b7-48af-a6e5-7aa4bfd18ee5", "value": "T152A3FBD6BC818B11C6C566BAFE0E618D33134B78E3EA72138D185B2D674B86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179642, "uuid": "97dbe315-09d8-40a9-b0c5-bcad05464a4f", "value": "3072:ywg2eSQq8S7KfEzScp6r7wxu2TzSmYe8u8EE1LvbT2:yj1Wpp6r7wxS7e83EwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179642, "uuid": "04e39989-92f2-460e-a9da-fe9b6967f868", "value": 99948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179642, "uuid": "55bc09f1-33eb-4cd6-8b75-760be2162572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179642, "uuid": "ebd1d9a7-2461-48d0-bdf1-1fa2a0b26fa5", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4073a0e3-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229950, "uuid": "f756782f-2848-4d56-9774-47a4d53a7344", "comment": "Malware payload (Mirai)", "value": "443aa764c2efa9083d69d8cc832aa58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229950, "uuid": "49550822-a817-4226-9ec7-23a936b13541", "comment": "Malware payload (Mirai)", "value": "160dfec7b55ddd783e30994df8b4494f53cc2fe6c3c069f610a2441eac106dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229950, "uuid": "56d1fa63-6e03-469d-9d67-dba58e49c90e", "comment": "Malware payload (Mirai)", "value": "ad5844a386ce2016ceb16b9b9d13c83c905ce4a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229950, "uuid": "086ac519-c3e1-4ee6-a783-815131e3e777", "comment": "Malware payload (Mirai)", "value": "6778ea2f270923e35a615199cad1c509109e6f80e750b930bfd79ee0fe9920cfde47e629a78550b249a1a7445d76c987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229950, "uuid": "3067db61-04d3-42a4-a3f7-4dd933d5a2eb", "value": "T183247D91B95E7D7FE2A30F3FC54217097B3CEF128A029926B05E615A2DFB1814F6224D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229950, "uuid": "7a51df55-8ea6-43ae-8931-850a7fdd315c", "value": "6144:igkgBqAQmfIqdNiJfvFJz2/gxhz+SP8eBWV:ijiqXmAa6rR98eBWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229950, "uuid": "2c9442c8-e40c-47e7-8507-ca19b9e14077", "value": 221492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229950, "uuid": "35200a9d-f00b-4737-9766-67f4b044faa2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229950, "uuid": "879a3f48-a5e7-4583-abe7-cd54c688115a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbd0481-ef91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206807, "uuid": "c5c4502d-3893-433b-8cc1-a009e89c415e", "comment": "Malware payload (Mirai)", "value": "eaedd2fd040d8e6ff35ec39798a8f0df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206807, "uuid": "e6e07aba-8c84-4721-a5ec-5b9fad94d16f", "comment": "Malware payload (Mirai)", "value": "16ca96b2cfc4b3fef3bdf83bf29b46e9587926b3b926c687e7079adde9c1775b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206807, "uuid": "11ea755a-ee6b-43af-9bf2-a3a21f929d5c", "comment": "Malware payload (Mirai)", "value": "3238e2025f5b53b8b953968c8916dcce6d0599f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206807, "uuid": "312b1ae4-4caf-4371-8813-208c836f5f13", "comment": "Malware payload (Mirai)", "value": "66e9019ce33260c525c32a963df51c4b350a31ee3a34786e5d4061c42ff81cc39cc423820e7725d3dba43de6d782c289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206807, "uuid": "cb75d9cc-01b6-40ed-b6f9-3cefaccd2ee2", "value": "T161A3FBD6BC81CB11D6C566BAFE0E218D33134B78E3FA72138E185B1D674B86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206807, "uuid": "e927eee7-e05a-447e-a2bb-be3b929a52a0", "value": "3072:ZynWl/HHVEIBpgk3UMvUqT4Qak5f2u+DET8JrT2:ZJf3gk3UMv/aUf2JDma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206807, "uuid": "07ef7409-1462-47b2-aa73-86e7e7c52d0a", "value": 99964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206807, "uuid": "61676ecf-f136-4b1d-9292-eeeed3f58b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206807, "uuid": "50bb07c8-c935-49be-87dd-6761feb6ea40", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3761b1b4-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206313, "uuid": "cdee3e09-cb2b-45a1-840f-0c275cb3bd79", "comment": "Malware payload (Mirai)", "value": "4e9a5d2b53d23b076135d544d1591362", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206313, "uuid": "7f304a3a-b80e-435b-b6a0-c42228f955f9", "comment": "Malware payload (Mirai)", "value": "1708adc04ffdafe8003050771dca01ec585c92d52ca2c72426d19bf150843274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206313, "uuid": "e733f248-63db-4543-b10e-2419b6acf04b", "comment": "Malware payload (Mirai)", "value": "db6e2d36b58a65b8b2ec358de5c0802dd4a23856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206313, "uuid": "b21e5174-4347-49e5-9e7e-6a65a18cb030", "comment": "Malware payload (Mirai)", "value": "a163e22db63781072bb79c3ea482645a41ff84140cb9b0987c0c877eae671d85b4b4818ff18070ae5180c3b7fd26eaf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206313, "uuid": "a2afc3ea-e431-4d71-b023-6b6a0903e722", "value": "T1C0736CC18543E8FAE86A0131A0B7F333A172D97502B8FEF7F7949672A821615F14B64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206313, "uuid": "c57b64f1-5882-4e60-baff-370fd42c1805", "value": "1536:rY+2FLGJB3kYEHmvvj+pARR23KQWidjnOLN4K915WjoYekbXqx9ZRR:rPILGJB07oyCR0KTip8N4K910czCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206313, "uuid": "594382d0-dce1-4c08-8b0b-05c4e8ca83a7", "value": 78836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206313, "uuid": "12770dd9-1a0d-4f7a-9efc-e80a5c4bdbef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206313, "uuid": "5fad82bb-d829-44e8-8b92-ac9e2a5e9d84", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcff4667-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179103, "uuid": "a2db84a8-cc92-43e1-ad17-3e89a72f3283", "comment": "Malware payload (Mirai)", "value": "f6b338da1d8baae866f75ad1d8e65518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179103, "uuid": "b391002b-1129-4b35-92cc-79c954354fea", "comment": "Malware payload (Mirai)", "value": "175df9558b891b8e9cb76bbf1f96386e088c6fa49ab2aeef95ab1b706a99f117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179103, "uuid": "a120aaa9-8e0d-4a8b-bbf0-3eb07349ce5f", "comment": "Malware payload (Mirai)", "value": "27c631a2dd6947227144f27a9666069674949675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179103, "uuid": "43d44f57-93bf-4824-be19-0de7a86b14ee", "comment": "Malware payload (Mirai)", "value": "373bf50a8872019e7d791bcc00150ee92654c63a332245bb8fec9054d0575032aa7f09a17acc8309bfa9a68e0736eae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179103, "uuid": "1e8e1d78-59b4-45c4-872c-e7960543729f", "value": "T112833A4173544047F7E70DB2283F7BF1579FD5A121A0A286695EDB4F8136E32188AFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179103, "uuid": "45666a48-4232-4bad-8525-706f58de6253", "value": "1536:ZUEqSbeV+K6krLYIHiv2aDdcWi80wOyRxgyhtRS9ZJMDLfHvZtTAbVRM:ZUEqgUEdcWpRRxgu3S9LGfTAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179103, "uuid": "b42001b1-fff8-4433-a029-fd678f1c9b3f", "value": 87768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179103, "uuid": "70a40539-c2d8-4a2e-864c-21506972c595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179103, "uuid": "286316ff-9bbd-45be-a71c-f9bd7f968c31", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f384575e-ef88-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768203192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768203192, "uuid": "7ef5d632-ad2a-472b-95b3-d71d2cb0abfb", "comment": "Malware payload", "value": "0565fa78002a5ca108c3693df5f248b7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768203192, "uuid": "60f7caeb-044c-47e2-a920-2429d3ca74a4", "comment": "Malware payload", "value": "17b5553458d022f27f2e5895b303bab036a0912e3a0d8b1c0138f4d7900bc2c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768203192, "uuid": "6aeaa3ff-d5f0-431f-83e1-c77954d8906a", "comment": "Malware payload", "value": "ff8625fd31578d6da5c9e1f2c15fda8ceef612b1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768203192, "uuid": "39030b6b-dd70-4a30-a9ad-31b4f70aeab9", "comment": "Malware payload", "value": "a99cb1b7df4d434d14af19204bb0d9f64a677eee99056d16b0bd490e19c851d73be8d4df72cb8fe7c849da52b405175b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768203192, "uuid": "6622c8f2-c767-4361-8f22-64fff59370bf", "value": "T1FF47DF0DCEC0DE71D56A06730806E8B9E32B1DBAB9EB87410312BF3D79761CA6765D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768203192, "uuid": "14bffca6-6dc5-4c1b-89ef-02b8d06afd1f", "value": "393216:95iHbMj5PuJPttsnomF5ZpugGu7W/SccToQGDfJneTpl9Ugseh:95jj5PzoA5ZpugGu7W/SxTajJeTpX3Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768203192, "uuid": "bb37c994-3144-4095-86dc-4bec8279678f", "value": 25009056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768203192, "uuid": "77fd0d21-af74-4881-a790-51125e0e5d03", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768203192, "uuid": "2f9af520-5e56-4a48-a58f-8f90f320dbef", "value": "Fotograf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84977b4d-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216750, "uuid": "8b052e37-8b71-4487-9625-fc8e9f7d4be6", "comment": "Malware payload (Mirai)", "value": "e3cb3acdd9c87a2013eb10b47b5d07ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216750, "uuid": "7081ccf5-9e84-41bd-82eb-91874024cf57", "comment": "Malware payload (Mirai)", "value": "17eb2359948a9d523b3c15b97364c0658eb74080c042d319518c9f706accdc15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216750, "uuid": "a4f53932-b84a-44cc-9f60-234f0e8c4ea2", "comment": "Malware payload (Mirai)", "value": "36b9e62f4cfcdbf5175c25f3a86f9857bfd65bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216750, "uuid": "3c2042e5-a963-4baa-b826-4c3711d203d7", "comment": "Malware payload (Mirai)", "value": "bd85308fe3dcb91dff40b7a6547cf389ab9b89c01878ed4a6e239861d4df4242ffc744b0c345320c560bcdc2aa1384bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216750, "uuid": "e860ade1-c233-4593-aeb1-7ed9dc17c93d", "value": "T1EA13F2A54A95735DCB73867184CB82C08D4E6FFFDCAE30220E2847979D1442777B85EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216750, "uuid": "edabaadd-91f1-449c-92a1-680e4f2f7e41", "value": "768:+NrzD+GW3iCn+PXq4Eat1AVM93jU4bYhow1VWSVsD1TM9q3UELnU:+NvDhbvj9AoMhvPgzLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216750, "uuid": "25081d90-85d8-41a0-93d4-b3dc060dafd6", "value": 44760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216750, "uuid": "e7379070-62cd-4d89-bfde-b1ad8a958427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216750, "uuid": "1649f4bf-df41-4d73-98f9-49b24a37dc00", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858c8c97-efcf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768233502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233502, "uuid": "8cdf7cb3-f1e2-4440-bc36-d6a92ede8c05", "comment": "Malware payload (AsyncRAT)", "value": "ebc372aad87da9cfc772caecd392dec5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233502, "uuid": "921ce6f5-e8d1-4d2c-a7da-c76645447640", "comment": "Malware payload (AsyncRAT)", "value": "17ed1939aaee4c754526278c582cb2ecee565fe700f69847ea38070403ad88b0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233502, "uuid": "d2fb600e-b55e-4a88-a3ca-a21b87e130db", "comment": "Malware payload (AsyncRAT)", "value": "9579caea8e579b57e6297a00b4fdc67b8b1e3a9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233502, "uuid": "db45367d-eac1-44fc-88c8-432571222abd", "comment": "Malware payload (AsyncRAT)", "value": "8d6a03604b5adfa8a06cf08c61a58dc7351b85dd54b0fc3647f8d8f9694f17e8f902e335fdb79f26c0f910e85f1c30e5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233502, "uuid": "9358a881-bab3-497c-9dc2-46eb708a5496", "value": "T13F737B0037D8C925E1AE4AB8BDF2554006B9D5772102DB5EBCC404DBAB9EFC64A126FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233502, "uuid": "4d086895-5e3f-4df6-9c62-1e850f0b329f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233502, "uuid": "13c9dd19-8abc-4272-bd3d-18730fbb6066", "value": "1536:c5mVbVJa8HQE6GbbAwwTrV3CGdvl0IpoTvVclN:cebVJaMQzGbbAF99hQtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768233502, "uuid": "d724922a-46b2-4e82-90d1-d0fd2b6b0c9a", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768233502, "uuid": "38991b4b-d258-429f-92a1-bdfa94e17160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233502, "uuid": "68899117-bc0b-44b7-b1c1-eaa81f7c8727", "value": "Google Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa90dae-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179376, "uuid": "89745940-c32e-4143-9866-62bd7e7e7fae", "comment": "Malware payload (Mirai)", "value": "a370dfdb62af4f3bef67b66fd7e8e730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179376, "uuid": "72ff2fc2-6c20-4f10-86d1-9329409f3bbd", "comment": "Malware payload (Mirai)", "value": "18246ce074aefbed216b01ef14e30c3cae1bf499dfcb7498b74b4ecc9ae4be94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179376, "uuid": "dae46a33-1054-440e-9996-7c400518d262", "comment": "Malware payload (Mirai)", "value": "dfaaaf793b78bfba7a8b9f9130d20708ef2761ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179376, "uuid": "6664364c-9a08-4c3b-80ce-5d6cf15d9835", "comment": "Malware payload (Mirai)", "value": "5df680ab5371d19f3b8867e16077bdbf09a639b16d9932517eca6f110b85a566a4380307b56e2f0b8da013db667e3eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179376, "uuid": "bb98e0c5-aeb5-40c4-be61-2358b9f833d6", "value": "T159A302B86B768ED4CBC661F394272F3A033A35794CBBAC1FC51466D188117A58352BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179376, "uuid": "731274cc-e0a8-4336-98cd-db89cfecbc7e", "value": "3072:oLETuT4iZSOhdNJQRzmX/2kOkry4zGnA0EDQLLD9F:ZTuBTDUBmXTOkry4S3EDQLLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179376, "uuid": "b06a2c5d-5353-4d18-9a9e-713122a2f7b6", "value": 105352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179376, "uuid": "67c3dfb5-acf8-4af8-bb9d-9bf0c6139cf7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179376, "uuid": "1d30ac9a-2763-416e-9bae-fdb06bc9d3a2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f517aad9-efd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234978, "uuid": "829515ce-dee5-4a95-b83a-f7873a7c7c1a", "comment": "Malware payload (Mirai)", "value": "048c23529ee5efd0dbbf4a9a97e6a64b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234978, "uuid": "33fcb141-2b9d-433e-96e4-1a49f8344ca0", "comment": "Malware payload (Mirai)", "value": "18f4a45fb6764953201c9f0eed0d5aa3e0ccf81496a8442fb32b761465528fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234978, "uuid": "4522492d-b4cc-4613-9b90-0da9864e12e5", "comment": "Malware payload (Mirai)", "value": "d7db4dd07754737283e56794a2384f8d40e4d964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234978, "uuid": "5495320c-aa2b-4bd5-9972-bf9cb103d9ee", "comment": "Malware payload (Mirai)", "value": "7372dc1bd1d706c7acffcb33b2140871abc31996d1fab1b1bf29a6035715e2e6b75fb65eaa8a762cad2266d1b7dda74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234978, "uuid": "33bb903e-c2b9-4a60-af0a-bc6e85df7012", "value": "T1A4F35B07F5C184FDC896C1B44BAFF636ED72F09E1134B26B27D49A622E5DE201B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234978, "uuid": "6a259a75-3cbd-4f4b-aeeb-3c7a7e57d284", "value": "3072:JBx7hJMJdMjDTgzTYJanIZlbupbiik2AKzopC6FyqJhYx1Hk:JH7heXIMFp8BIbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234978, "uuid": "3a38ffe2-5fbe-4085-bc53-cc20d6b10237", "value": 159256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234978, "uuid": "4cf0f5fa-7d59-42ff-b3d0-b22c75d9f495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234978, "uuid": "7c48f7aa-e627-4058-9b29-7aac2b6dc415", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aaf206-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181374, "uuid": "4222075f-0758-4002-8d78-cadfe7eb4f2e", "comment": "Malware payload (Mirai)", "value": "815667f71521d9895e1dde1d55182103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181374, "uuid": "3d81697f-103f-47f3-b095-4d4e9afc5110", "comment": "Malware payload (Mirai)", "value": "19430120c35a479e9fe510ac0537ecaa9653870f938c0b0189919e1942253b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181374, "uuid": "12fc72c3-4d84-454f-acbd-273043115c7f", "comment": "Malware payload (Mirai)", "value": "f35110420bef18b2c2b88ae7f021edc8662677af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181374, "uuid": "5d67b942-d9fc-4295-b2ab-f212b6132b8f", "comment": "Malware payload (Mirai)", "value": "94971014f74343ecee2b20cd19e4dabab7b06b6859d2cca59c0b56309613ce566a56cdbfc466f99b91a93ffe85cf889c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181374, "uuid": "a26ab83f-e3af-4c1c-abf1-3da4d85d6a40", "value": "T16C73E819BBB14EFBD86FDD3345AD4B4525CC824722A83BBA3974D418F24B18F49D3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181374, "uuid": "e542e8bd-0a43-4a25-a790-470eeabe6be0", "value": "1536:fXLcz58BIVJUNpAwL23F3wSb49AY4lET2bVR9/:fI18qNK4WT21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181374, "uuid": "21a8a220-a0aa-4757-a9d8-5aa167a2b692", "value": 80672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181374, "uuid": "d85e31df-c871-4e79-870c-9c5ff98e1a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181374, "uuid": "0fdc7f91-5e38-447f-a152-0607cd8d2709", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055fb60a-ef9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768212671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212671, "uuid": "9efdd1e9-0c9e-46be-8ba0-0b8698eb6f9d", "comment": "Malware payload (Mirai)", "value": "509a6f0ed974273193c2fae572db130d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212671, "uuid": "8aeef2d4-7aaa-4814-9afd-f56fecabe788", "comment": "Malware payload (Mirai)", "value": "19932b64a799a21266a683aa546896591dcfadfe10c00b17480d36262c1aac77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212671, "uuid": "299083ae-fe28-4c67-940d-4ed8d8452936", "comment": "Malware payload (Mirai)", "value": "d88a57c723211d8e4ee2f05db65bdd75a7e34e2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212671, "uuid": "c9ac3c37-3bf8-40e3-820c-823cd1334730", "comment": "Malware payload (Mirai)", "value": "52980dbce8287e91d87c92a1b5c4493acfb03dc283592c95bc50c9bdc44865057a85cf9f40ca6860c4e1567d2194b30b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212671, "uuid": "0a7d29bc-beb1-42f1-8d57-20c2fb7f868c", "value": "T18763078ABCC4C602C5F061B5BB0FA68E372643B8E3E2B157DD1D6B5A674F8570A37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212671, "uuid": "4b059e70-d921-4e1b-b41c-bc1d00429c71", "value": "768:3tIIC/YGCAlmdnJyjzqBCuODOUGOqJf6dQTdjxeKMFFKnKT4cXvp6zt3aL9diOvB:uf9CdF9xBiXRXUyvNOMRxqCb9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212671, "uuid": "d089e183-f3ee-4cf5-bb8c-79a62c8435c2", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212671, "uuid": "be1973cd-2d9a-48d8-ad66-517382bcdf14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212671, "uuid": "829c569d-751a-4e2d-9cd2-d85175dc454f", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfc6aa7-ef96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768209141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209141, "uuid": "c1ef021d-77d2-44ef-9d43-3dc8e9d7a51e", "comment": "Malware payload (Mirai)", "value": "3c870e4be7d383f3dc3fbf55eb83cc5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209141, "uuid": "c608e3f8-54c0-46b6-8afd-0292dd5cc86c", "comment": "Malware payload (Mirai)", "value": "19db43b2aac24ba5fc078eddd43b97320b53865c9c843c3d0bbca1d8b4362528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209141, "uuid": "0eac9ae7-9fd3-45ca-aafc-346b4969e83c", "comment": "Malware payload (Mirai)", "value": "20689ab37c6a0734e11774e10fe6563f5127d601", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209141, "uuid": "c17ba375-9cb0-405a-863f-38327734724c", "comment": "Malware payload (Mirai)", "value": "2e327bf66afb79aec046b6d3468c660d727a42cecabac774d4250262c9d4fc72c0112410b0403573d3f2679e72e27ba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209141, "uuid": "902bfd8a-1218-4509-88c2-78591c536d13", "value": "T12EE32A56EB404B13C0D61775B6DF42453323AB64D7EB73069928AFB43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209141, "uuid": "7cee8fe6-5841-4ad9-8d06-642374ab6de2", "value": "3072:hytBmcrSngNjZhWaBg9mrSPsGEQ5HyYh20KlQM/9psVIop:hyLdrB13WaBg9mrSUG1yYh20rM/9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768209141, "uuid": "ae9b54e6-a31e-4166-865b-03ee78cc06a1", "value": 153800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768209141, "uuid": "55fa5209-1e58-4e89-b155-37cd3bbc0e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209141, "uuid": "8a597083-39aa-4111-a6ee-f69e2579936a", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdef7d4-efed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768246263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246263, "uuid": "26108bb8-6661-4e90-8a00-49116eade8c4", "comment": "Malware payload", "value": "da497ce2ac02306a67cd9f74d94bca23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246263, "uuid": "1721d84f-ba32-45ec-bda8-fccc0c15a188", "comment": "Malware payload", "value": "19df6947289cc654be998325711f47f4cee047956abfd54ed26a812a5e958913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246263, "uuid": "1ccb8556-8403-4e57-8082-16f584fa747d", "comment": "Malware payload", "value": "2525df7acdf9d1abe8051190ba635f063027859d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246263, "uuid": "2c517f3b-1d43-4acd-8617-11e60bbd353b", "comment": "Malware payload", "value": "aa8cdee2d0a085459de2c7042311d8acd388035269d881d250798097be0e251b074b8a6d4c71bcc94f9ce4ac7bdf00ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246263, "uuid": "35290b3b-59bd-4880-8a3a-0a1ee0906829", "value": "T14122B3C0A067E8F4ED594275E132F736973670BA112EE5A3A3CAEB53BDC0680D9461D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246263, "uuid": "f1de03e5-4abc-430d-a4ba-e1acf2070d34", "value": "192:fhzntnq8SZ9ox/OwPTp4ByBZeITQc2FUd5x/OyLwcjWrchwaZpTV:fhzn1q8SQ194SeIMHFAT0cjWAhwavTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246263, "uuid": "e8fe160e-5d11-4f45-9ede-2aaa75695e46", "value": 10781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246263, "uuid": "a050fdaa-1c94-4bdd-8d1e-ae9a0aedcbfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246263, "uuid": "deff5961-c856-4a1e-a206-08191202c580", "value": "odin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76be9540-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217586, "uuid": "12678b3e-0709-4675-8b71-9677fffdcbbb", "comment": "Malware payload (Mirai)", "value": "f4ed7e7b1f94aa3b6b2a4ca7abdcaad0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217586, "uuid": "83003006-f04b-4b04-af3e-1a02a4149a97", "comment": "Malware payload (Mirai)", "value": "1ad6d7dca7a543ea92c0e5648cb6c4a1805e2507432a64afcc4d8ec7cf06c240", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217586, "uuid": "9558fc1c-bc7c-4e0c-b92e-f19b7d3061c2", "comment": "Malware payload (Mirai)", "value": "75a6b00fe475c42054048f4d4318c2e8387ba692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217586, "uuid": "62e22019-4622-486f-9f9c-9f243ef0174d", "comment": "Malware payload (Mirai)", "value": "645242e154ab0be31638283247d0ef4c3301e2e53d44f2f3c8cb5bc74ec9fc513c46943c97dfb6f12787aa798e6a9b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217586, "uuid": "c1ff97bd-d3d0-4f75-8a43-8ae4783d76f2", "value": "T1B6735DC5AE43D9F5ED150A343073EF725AB7E13E2029DA97E3986937AD42A02D40339D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217586, "uuid": "af771164-c60b-43e7-9043-bedfcc099d83", "value": "1536:QU1UKc80j3L341HxvictIpi8H7JoKvz8UyX0D4561mZikkkkkkkkkkkkkkk:QU1880rL341RviciLH7vYUyEc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217586, "uuid": "c978c7f0-085f-4e2a-ade6-fd374380205b", "value": 75088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217586, "uuid": "20c0747a-5570-4fd2-be42-7bd016c8f065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217586, "uuid": "ece83320-6963-4d2b-95cc-a14c47253529", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0defcec-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255050, "uuid": "088523d2-3f63-414e-a9df-bea0f3deb8de", "comment": "Malware payload (Mirai)", "value": "be81a51d3b9be81fdee540ae582062f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255050, "uuid": "90e48b10-109b-4b09-b586-26d3b5cbe7af", "comment": "Malware payload (Mirai)", "value": "1b180937282f7fbde92bc69749bbb9d92b560bdbd4a4644bee256ae23c60c3e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255050, "uuid": "0afb639e-3622-4016-847f-4e00502a6281", "comment": "Malware payload (Mirai)", "value": "026b57373d192241e488f058b08b128f8aaf4330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255050, "uuid": "b22660de-1dff-4c0c-9c18-4a8ff70f27d9", "comment": "Malware payload (Mirai)", "value": "bfb1748c2e07042d81092eba34590516bcc0927c868a6ff7b8fc000a8d0f6bec90c0522b5e43865f812677befeef03fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255050, "uuid": "fa65548b-77dc-4030-a5f6-d57cb5e712f6", "value": "T1A203E603361D4F17C4936AF4267F0AA087BABD6228F4B5C4752EAEC58635EF62041F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255050, "uuid": "072fe387-1df4-403c-8ed1-1e86555d1b62", "value": "768:qnm0l2DxbPvKdx/R/leHnWuQ98qkJp/S6G+AHxB:qm01xyWJ9RkJp/S6Gj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255050, "uuid": "1a20afa2-afb3-44fa-80ba-06a85f33730c", "value": 37768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255050, "uuid": "20581a03-24ef-4f3a-8603-25e484c56e9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255050, "uuid": "726314a8-09a2-4f70-a618-1da5ab821aa1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1378c73-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768230998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230998, "uuid": "7e71da35-de43-4e61-8a74-1b783a148f10", "comment": "Malware payload (ConnectWise)", "value": "c5bea1f85fd03ab96238b7f873c1f492", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230998, "uuid": "665aa255-d95f-4dfb-8997-a8dd6a0024e1", "comment": "Malware payload (ConnectWise)", "value": "1b254fda74a87ea8ffea096103311a5c4ce2980873f9564f702bcd5c32776126", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230998, "uuid": "52554ac6-58d9-4a3d-b1bc-952ee90301bc", "comment": "Malware payload (ConnectWise)", "value": "c06bd868cb6cddba29ad9d8e7f3f7a95df79d9d8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230998, "uuid": "eba93802-2014-461c-9b88-e8f0bcb92bb3", "comment": "Malware payload (ConnectWise)", "value": "13d34be1f7aaa9226e95344c11d99129d259c4105b84514ee1017846085dc165d2b5207dbd587f1a65993aa7c2bf3e42", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230998, "uuid": "14c5cbb0-9879-499a-9523-5e06251e9f3e", "value": "T167A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230998, "uuid": "3ad96a5a-1bd2-4bf3-8270-763257eed9e3", "value": "196608:iKaLNkbgzi4QJKaLNkbgRKaLNkbgpKaLNkbg:0WgziHtWg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230998, "uuid": "1d30e16b-4670-4221-a0b1-fcfc560c42fa", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230998, "uuid": "c445258e-68d4-4d2a-981d-17ff88d336c0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230998, "uuid": "b604c6a9-fe17-474d-8b6c-786c233870df", "value": "CORPxPT.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d00a7c-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218692, "uuid": "0ea371e4-3f61-4049-82a7-b17ef1bf7e7c", "comment": "Malware payload (Mirai)", "value": "90bef3fa1c89e9b089fb6075d810771e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218692, "uuid": "95c2e222-8709-4837-a585-5ca10e07775c", "comment": "Malware payload (Mirai)", "value": "1b9d6b20838cf34022d891984d6714b49825b06fac1e16c842d07baf3efb277a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218692, "uuid": "98cb0d2f-d4ae-4e67-819a-f033f762218b", "comment": "Malware payload (Mirai)", "value": "2804121d2984b0ba93935f4d2e384a151be778e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218692, "uuid": "b8c58f0c-7fe5-49df-a917-3e3dfa1ca61e", "comment": "Malware payload (Mirai)", "value": "e8e6813d0113a0e9f823081e56026dba2ca5cfb52a355c49efe8fa08817326accd82535f2491bc758abf84f51cfcb3da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218692, "uuid": "97036b97-a44e-466e-95bd-db4f3592dcdb", "value": "T1A713E16A221216E6EB41C0B015B64B693FD94FBBE004D51D3F96A5514B8F6F834B2CF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218692, "uuid": "d5e333c8-4d86-4f4f-88c0-3e3c0ce8e87a", "value": "768:/VSrYS3JuIk8or7wskZ6BQucjRmHazJ1FzqoatCyZ5S2ZJGJgGlzDpbuR1JU:/8DY8oXwsbQucjY6zJ10Jtr82ZJyVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218692, "uuid": "70a04842-e743-45f4-a0b1-6fbc8782ca64", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218692, "uuid": "d2f26351-2698-4e91-b4f9-4e924727e39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218692, "uuid": "75db2b94-3e7c-47ea-bd7a-23fb1b8054ec", "value": "johen.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ce772e-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182278, "uuid": "a096b0f3-a063-42dc-8c13-bd397f7779e4", "comment": "Malware payload (Mirai)", "value": "ae658937e6503f8c4f29522161e9d57e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182278, "uuid": "9acd2662-8288-46a1-996a-39cf9a5a78a3", "comment": "Malware payload (Mirai)", "value": "1c69b69d87bad1d43c32d2f139f96676e3a7d863ba6ed0d0e26e843c7dbc45ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182278, "uuid": "c87fb019-9a6f-4be2-864b-f0dee1605568", "comment": "Malware payload (Mirai)", "value": "27df7206560949ac4ab6d4571db80668cd14878a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182278, "uuid": "219c31f2-b423-423a-a944-87d89e31a4fa", "comment": "Malware payload (Mirai)", "value": "322c91265460afbf4c5e74cdb2fb76189233ed2045fa8ff2f6bde403506434cb193c981f4afa58b491282361cbc6d4a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182278, "uuid": "420cda65-324a-42a3-8b0d-81f77d9cc104", "value": "T1ECD312D5FCF11685F60928B4EE46AE8A779C9E66F5DD11E00493C3AD7868F32289430F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182278, "uuid": "c50bc706-d75f-4ee3-a457-3748a3268e46", "value": "3072:ArhTQZCCse17KXPuPMBNJVHS2wYh/66t2clNY/jDfIS+dO:AVQBIfuI/S2wYh5t2clyDAS+dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182278, "uuid": "21b4ee68-98a2-42af-b575-677860c1636c", "value": 137736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182278, "uuid": "11e712e7-e98e-4d74-adac-efafab3f68a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182278, "uuid": "bacb7fb4-b451-4f79-a955-5e7950e1c047", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f6ff5a-ef76-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768195216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768195216, "uuid": "860e5e15-bb88-4789-990c-84e28785f3d7", "comment": "Malware payload (ValleyRAT)", "value": "9228934fc24b4232197d2da4420b7f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768195216, "uuid": "a8c40c4c-645c-4df1-9dba-32518b212227", "comment": "Malware payload (ValleyRAT)", "value": "1cc412d5bbe1723ca2332e90eb6f557c4b5a68716cfc10114147dc4a7c847e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768195216, "uuid": "72e3bf7b-966f-44d0-ba7e-810778a49096", "comment": "Malware payload (ValleyRAT)", "value": "3fb3a877be695a7d0ae35fff818c687d0107ec1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768195216, "uuid": "e3bdd599-d24c-4921-adc3-c68736177843", "comment": "Malware payload (ValleyRAT)", "value": "4050086382c3d41af3992bf6f7c2a6b9043f14635c2d4ef25c2ded1b821a5a2af8921985d26f45b41ca85d3387216eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768195216, "uuid": "e162e065-5f88-4fd0-8804-36bf78bd300f", "value": "T146B36B2172A0C072C093253199F9EBB24E7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768195216, "uuid": "182a0f62-6baa-4dcc-a8fc-d428a9ea7e28", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768195216, "uuid": "e5034cf5-00da-4222-9563-1b3fc0625394", "value": "3072:qbWjdIPbcia0NFtwwnILn3py6D268XEPKA2:qbWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768195216, "uuid": "3675bbb3-05a1-4e79-9f81-77b2c64240b2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768195216, "uuid": "30ba5feb-e233-47f3-8d0b-044bd429aaee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768195216, "uuid": "1151e763-0f5c-4040-be83-a6e1d3d0f3e6", "value": "x1cc412d5bbe1723ca2332e90eb6f557c4b5a68716cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732fca02-ef55-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181073, "uuid": "a0d8b891-1373-437c-9122-a9d059f26f78", "comment": "Malware payload (Mirai)", "value": "7f5cfa04eb528309a3f6e6b10e815959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181073, "uuid": "3a692540-e5c9-4a21-812e-098405bc5ba2", "comment": "Malware payload (Mirai)", "value": "1ccb8cbf82c33555ef8cfcea04ac64d61aa2aabbb60cdba8009e1388b28bbb47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181073, "uuid": "b6b2a599-125b-4ded-9089-c241c7ee8170", "comment": "Malware payload (Mirai)", "value": "e84529c80a95808b933b8a25b619a65fb6a87e28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181073, "uuid": "1258c8a1-cb1c-40fd-ab50-26d8402c7623", "comment": "Malware payload (Mirai)", "value": "233165f92873e1d4cbdf94a845c413d48c12753676d5bb3aff7314f4d94eab287f2fa8c8a34a2290e50b3b939d5b5a1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181073, "uuid": "5bbe4932-eefc-4734-8b76-012ff9a4bd2e", "value": "T19653180133690057F3E74EB2282F6BF597EFD5A121E0A185995E9B4F8174E322486FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181073, "uuid": "610eb52e-26d9-4249-80e7-1be7c4a81957", "value": "1536:KcPqabQnCK6krLYIHiv2pzRCmnpkgS/FBTv3:KcPqogPRCUS/nTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181073, "uuid": "983b3e53-aabf-499b-b95e-480d47ef365c", "value": 63552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181073, "uuid": "98ad2cd7-f845-42d4-ae0e-6f500079fc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181073, "uuid": "44a9fceb-91e0-4fbe-ad09-723f7a39ed75", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6c450c-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226184, "uuid": "d77bf64d-e0c5-4a05-aeea-ad2ea037f23e", "comment": "Malware payload (Mirai)", "value": "6564765ac1dd2e35928cdec4e1ebfa1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226184, "uuid": "69e1e368-8470-44b0-b033-fd1b86213e14", "comment": "Malware payload (Mirai)", "value": "1cd3dc63e4cc532fb6e32f2a77fec3eec43fd8d63f4f4c3d7c9bd6ea5c835b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226184, "uuid": "7269f09c-10b0-4ff9-85cf-9b072d047e55", "comment": "Malware payload (Mirai)", "value": "1f3a5c9197367727b9eec50396da72cd742e5f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226184, "uuid": "5e14dd89-5e22-40d9-9de9-efa3094c1b08", "comment": "Malware payload (Mirai)", "value": "d75cc1cb1d85812ddc72a1030ea448fd872b0ceed86c9e7d1a263349865a1975a9b089b6d1fc27b5caca0382fc6df7ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226184, "uuid": "0f37b18c-9740-44af-80d1-c69aff964896", "value": "T1A543E885F991C616CAC4627BFF0E43ED771643A8D2EE73039919AB25379782B0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226184, "uuid": "af4c42bf-94c0-4e59-9abe-659689b779bc", "value": "768:t+BV+B2Lz25tQLuEjd82ztIIX4WpeIDgYxy1sC0LF+auPSc1jFT2bVR:u+B2LZq2ztItyxDgn6WSuFT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226184, "uuid": "4677675c-8f5b-42ef-b8c1-9d93f4960a5b", "value": 58580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226184, "uuid": "e1bb9bd0-9aa7-48f5-8c7d-fefec88a6fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226184, "uuid": "d6210983-8b0b-454a-9622-c80d01b7ca9f", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa6a841-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768219606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219606, "uuid": "f19770db-7a28-47e7-b87c-cab50dbf54ca", "comment": "Malware payload (AsyncRAT)", "value": "867703b3792be3dc03dbd1e2db81bdbc", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219606, "uuid": "7a2841a4-78f2-4350-8bf8-f0749bdbaec2", "comment": "Malware payload (AsyncRAT)", "value": "1dbda668c852a6992af32a9f16f53c2b5af3930f1c71d7d1608d32360dcc65d5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219606, "uuid": "b9f29a22-c9b6-4c9a-a444-08f80f2e0a81", "comment": "Malware payload (AsyncRAT)", "value": "c1cfd55b43721b26d1a2f2274628f0f014c5a6d9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219606, "uuid": "888b63f7-0677-421e-99cd-3cf4ccc50a48", "comment": "Malware payload (AsyncRAT)", "value": "4de2d3af2a75a4710b7cba9caffa94cb699a1582432de286caf543270ea70596912962cc702e5092ddefd06197158bfa", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219606, "uuid": "3185575e-6c80-4572-affe-0c0ddf5ab421", "value": "T17C636B003B98C965E6AD4AB4BCF3550106B5C1772102DA1E3CC850DBABAFFC64A527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219606, "uuid": "1dba9fd8-77c7-4194-9355-dbe206e8ea71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219606, "uuid": "5008a65a-d7bc-4858-964f-bcd81bb2cef7", "value": "768:Gm0vnfEXf78awC8A+XUPvKJ1o8c3SSPD1+T4tSBGHmDbDMph0oXADzFAa6SuAdph:OEXiFa80/DCYUbCh92zOGuAdpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219606, "uuid": "d261d902-5af0-4397-831c-ab789546231b", "value": 70952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219606, "uuid": "eb65d289-5474-43b8-91d6-4abeb4ecfdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219606, "uuid": "11b4d199-4692-43f3-9f28-1356004f49d8", "value": "mod_ap_decrypted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08013c22-ef92-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768207092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207092, "uuid": "3658212a-dbe1-440c-8a25-5022cee12412", "comment": "Malware payload", "value": "34f1cbb71862f462fd26a774e97fa27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207092, "uuid": "83c4744d-2258-4449-829b-4e5f08f748f8", "comment": "Malware payload", "value": "1dc76cd2c0c2d125b65e20a7d579e9f6098f4622588a53849251f0a36651ef8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207092, "uuid": "9c636581-ff6b-4a78-a078-4c8d3ec33c23", "comment": "Malware payload", "value": "63fd9922ab8f47cd59afc810de48300bd537a581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207092, "uuid": "aa608b57-c3c0-411e-a354-cab718a8fa8b", "comment": "Malware payload", "value": "d9ed2686fe5a1256a2f876a93a10bd3f6de89d4b68f580ed2be47efd894355f5e77fa1d7e8ae4ffc78019a5b239abd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207092, "uuid": "56efa1f2-01b2-434f-9312-0473f92fce1a", "value": "T1C9373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012327F1C6D28B213D4542EE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207092, "uuid": "9370b573-68af-45f5-9b2e-c976b7d415d7", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207092, "uuid": "b81a54fd-6877-4e09-bcc9-f9e9b9c17d61", "value": "393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3y:+tobo/qEVooAZNKYeJPeTe9B5JWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207092, "uuid": "1fe18349-f22d-4a00-9eb6-b50d4a3638a6", "value": 22855344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207092, "uuid": "d84342ba-9581-4874-af2b-c1cfc44a6f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207092, "uuid": "6d5d6ea8-5ce6-42b7-84f5-6203ccf0a35f", "value": "S_eStatement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad7e0d-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768211212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211212, "uuid": "aecc8118-b067-42b7-8d45-885765a6305e", "comment": "Malware payload (Formbook)", "value": "57e7d661a5bfb1d2e9a148ddc61cd57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211212, "uuid": "e2cc364b-533d-4bcb-adfa-25d9445137c9", "comment": "Malware payload (Formbook)", "value": "1ecdcb7d912233649d499b7ea4d5056ee5b23dab8a5cbd74f3ad0a62370c3b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211212, "uuid": "8d740ccc-11d2-426a-bf82-95b4cbfbfe12", "comment": "Malware payload (Formbook)", "value": "50ec7ac454a63d5af4b841baec9ca2ded0ad7106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211212, "uuid": "96761131-f452-4471-9c76-d9292d920157", "comment": "Malware payload (Formbook)", "value": "eb4cbb53de904b0fc90c9e2e0a7667271bd83f8c004b9e0415d05b1b3a1d0c4ba924cfe51b33e4cdc5c8efc609f4963c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211212, "uuid": "e805b899-df5c-4f52-8469-f8528f8d48da", "value": "T16E35CF1373DD8361C3B25273BA26B701BEBF782506A5F96B2FD4093DA920121525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211212, "uuid": "0f1cf78e-1208-42c6-b903-3d4b26a07b20", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211212, "uuid": "5d338ade-652d-41d6-ba6e-9d28489917c7", "value": "24576:dtb20pkaCqT5TBWgNQ7aO9wp6/t8IZGL712HhD6A:OVg5tQ7aOQUbZm7G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211212, "uuid": "1c43169a-63c7-4d68-ab68-3e39ed853a45", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211212, "uuid": "aed8d331-f1b5-4fc9-8a8b-5897dc06107a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211212, "uuid": "371a06d4-d46e-4dba-98d2-d9976a94d6f5", "value": "New Order LC229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0b59e9-efcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231634, "uuid": "75bf5d34-d4df-4776-a18b-0fff7432b1f2", "comment": "Malware payload", "value": "10b032a231a61667fd8f74b54ad1efe5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231634, "uuid": "3def882a-31b6-4d95-88be-7bbfe2213db7", "comment": "Malware payload", "value": "1f0df34152288c03f9383240f01bb0f2883bc4f2fcfd2f472a99225a025fa790", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231634, "uuid": "3bc4b02a-a694-47cd-ad2a-466f59e0d8df", "comment": "Malware payload", "value": "58cc9b73df33af6a242754834dc2fa91fb3fb029", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231634, "uuid": "fa1996bd-9119-4c1e-9db1-c15c0312d1a4", "comment": "Malware payload", "value": "f38e2dbb8ea9c6e3fe4c2fb70357eb5bf0e3a260877c564a6e42d30d5da3b76764a0191d0e5c8343a9b99ea02d48df62", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231634, "uuid": "3a57a287-bec2-43d8-b66a-530dc55e2f47", "value": "T10A3126094BC91621E6F74E36B47EB300CA283892ED468E6D4181A5C820A6152F9B6E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231634, "uuid": "25b8f866-352c-44d1-b1bb-f89dbc33d96c", "value": "12:8N0m/3BVSXzvKXA4Dnr1+fIlVlDmo0I6iN8ecf/iB3YFM3wy:8NJ/BOKn+fk4o0a8LcgMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231634, "uuid": "c81a7118-55fd-4f1c-aabe-c808e7108188", "value": 1591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231634, "uuid": "e7393660-4ade-46ee-ba43-03115f38d08e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231634, "uuid": "2007a025-0b7d-448d-8ac4-dd227c78207e", "value": "live.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13aa4e6e-ef87-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768202387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202387, "uuid": "6e7fc9dc-8b70-44b4-bbeb-6f4475c32689", "comment": "Malware payload (Joker)", "value": "ed5947aa99f2740a88eae0941cb45e6b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202387, "uuid": "f5347221-0b8c-4064-946c-8db49efd5a7b", "comment": "Malware payload (Joker)", "value": "1f1bc4b95b6d01c86fd4fd266ee44b71f1a95e063892796178ddb383b93e6606", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202387, "uuid": "ced8656d-e6c2-4b9a-a829-3e4cc706fc73", "comment": "Malware payload (Joker)", "value": "0b40364f42f0f62a94479a92a3a6130f8d30adc8", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202387, "uuid": "8a6e15b2-cd40-4a58-99d8-87effad1b3f2", "comment": "Malware payload (Joker)", "value": "c5b69b3cca72418b90f26f799cf66911d6af16557d9b2c3e25c272497ded5571609deb49a5d3a5e7f17f281049789a98", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202387, "uuid": "5f97fd42-ccd2-42f5-a208-b88005f64075", "value": "T1DB771206FB0CDD1AD8BA71769CD7431331121C8A458AAB67790DF928BFB35E64E06BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202387, "uuid": "66072977-e724-40ca-a352-a249ed8390e3", "value": "393216:0aDo0DI9psgp5H1szAPLgXmt+cHDe/lmXJj+VVF5OJ9v95s/fPCYs2IW7gMV0f0a:0a9T6VTL1tJHMlm5jAVkFCXPCndMVJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768202387, "uuid": "4ef483d9-6691-4bb2-83df-49e0cf4904dc", "value": 34179650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768202387, "uuid": "aa2569e4-27dc-4c0c-9c9b-6b0afadfbcb0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202387, "uuid": "bbed5f38-5551-41c4-b691-0da6bae2c7e3", "value": "Joke+Sound+Prank_1.2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f4b848-ef9c-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1768211701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211701, "uuid": "53967de4-a523-485b-9fba-0132e30db850", "comment": "Malware payload (NetSupport)", "value": "e51beb39edbff9b232886be51d471732", "object_relation": "md5", "Tag": [ { "name": "91-202-233-154", "colour": "#FDA446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211701, "uuid": "88f82f43-830c-4156-a2f0-6e8f37bd5882", "comment": "Malware payload (NetSupport)", "value": "1f6a3bdb2c06f6062e058483dc26c485c11b8043b3778ca41cfc4ec80675fbb4", "object_relation": "sha256", "Tag": [ { "name": "91-202-233-154", "colour": "#FDA446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211701, "uuid": "02264c19-5e1a-4d38-bf6c-0a92c770a77a", "comment": "Malware payload (NetSupport)", "value": "f6d23f3f3844ebf7ae389c54422525f603b2687a", "object_relation": "sha1", "Tag": [ { "name": "91-202-233-154", "colour": "#FDA446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211701, "uuid": "a09e9c14-3ea5-4caf-b4bc-d84f7e6ca3cb", "comment": "Malware payload (NetSupport)", "value": "ae39f6d68b2c0dddbc77e45c68b7f70c06f89a70f4a8a5614c1f7467ac3d5cb42722f7c0a079903081c11f34c4023e4f", "object_relation": "sha3-384", "Tag": [ { "name": "91-202-233-154", "colour": "#FDA446", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211701, "uuid": "c6fa6f02-ee23-47f3-bf2a-6b9a3ce0a9f2", "value": "T18BA533CD08C43EFCD1AD7E74048BDD6E819ABF54E9E5F2A185B594213AD70E891DE02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211701, "uuid": "0fb4d886-ccab-4483-9e2a-a16586c53530", "value": "49152:vOsL3HYZuc7b4vR7B4ezGJZBORR7ZH1FkOMb+HFZsa:/oocgvxBiSlZH1eOmwFZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211701, "uuid": "4ff66225-622e-437a-9cd5-b70fde604304", "value": 2243117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211701, "uuid": "f321eda4-cbb7-4600-b3cc-d05f64896e98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211701, "uuid": "a1fdec9c-3310-4041-b90a-3cada7c4d3b9", "value": "zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c428ee-efeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768245580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245580, "uuid": "d5c63cbd-13f4-4348-aa91-4c429bb94ac9", "comment": "Malware payload", "value": "af93f62920fd0190e37e3caf5622555b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245580, "uuid": "43a56366-b6f9-492e-8707-99cbd0a31349", "comment": "Malware payload", "value": "1fa39c9491e60fcf0405b3eec8f9b8309b8cdf777a88970bca37cab7a2104bd1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245580, "uuid": "72c7945c-abf3-4dd9-961e-647fb05b4696", "comment": "Malware payload", "value": "d9d5a383ab8882530813ff0549451b89ed09312d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245580, "uuid": "389f7ecc-999d-4665-909c-1e540959d7d6", "comment": "Malware payload", "value": "39c56d2a6f236281fb172871d8c1cc5a1ed6878e1bccd4c111b0ec75dbf1f83a81f01c9024f10c4a33740be6a33f96aa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245580, "uuid": "ebd656c7-2442-4d16-a7cc-1bd152c0e8c6", "value": "T198E5330337EE897AE0473D328251A3231BBAF6560B3945DB5A905FAD4E297C4DD382C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245580, "uuid": "a173c608-0787-419b-b91a-1d060bc8e787", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245580, "uuid": "6a57e7c9-811d-46f3-9d91-6c5e9aa42c3a", "value": "49152:YP5unNQEASnUK5jthgrfUfVHumKX9oBI/sBuJK1w9UwhTmkL+ykBxO+a370:YP5G6vU5YsHRKX9oBG61F/yEF80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768245580, "uuid": "20ceab44-16ef-4d48-ad3b-29ac86c607cd", "value": 3159320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768245580, "uuid": "f91c2bc7-05ce-4cbe-8c76-8b5c63c0f310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245580, "uuid": "3b500dd4-20a5-495c-af5a-3a998094f757", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74591f1-ef5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768185509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185509, "uuid": "c1ac36ef-b639-48ac-a7c4-6f1f8f69a716", "comment": "Malware payload", "value": "afc72c8808ed3a1a039fe5654ac7b5d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185509, "uuid": "a4ab72b0-9ba3-414c-85e3-a17fedf55c93", "comment": "Malware payload", "value": "200c3fe53bcf48ac25dcf0c4fe111180b3849049a1f8f15b0269f2beb8ad49d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185509, "uuid": "7dd0c339-69eb-401f-9a95-b16af70e94e0", "comment": "Malware payload", "value": "1c826fbd0e33a0a3685cdd783a18d5c4d863718e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185509, "uuid": "f8bf0458-3dfc-4e0e-ba93-55653bd5af25", "comment": "Malware payload", "value": "457b6e0e7fa176e2ffd9653c7c98619bae80e38a85c4114e45780cc8c4156f89fd62614ffbed93b3134e33228c1cd5c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185509, "uuid": "daa4f241-789c-439b-828a-d21367b9dd18", "value": "T1D11633CD942564C17BE55F3CBF74E81B0EA5890449A8CD146FCAA03398FE4E6B6E3760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185509, "uuid": "fd7ac955-6682-4e90-a07a-bf6a89ea1e67", "value": "98304:CFgEn2qekXWpC2cnBkDr7zevAnt4Asv7tBj0+IBFrMvkBRa:CFgfDQnnBkO4t4AYL1OFrMvkBRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185509, "uuid": "4859f8a5-0bae-4798-9a72-99c014ade54b", "value": 4288096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185509, "uuid": "a9e4cae0-6f94-4458-bfe4-e9ca2fe879c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185509, "uuid": "8ad61a58-1c99-43b0-a9af-964f8b891af7", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13eedea-ef62-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768186814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768186814, "uuid": "81a8ac73-8777-4039-8e28-17fc6eb4c450", "comment": "Malware payload", "value": "8a66374382defff9c8b64fd040cdb7cc", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768186814, "uuid": "36488ac2-bbcf-4e30-88dd-183a9f071b83", "comment": "Malware payload", "value": "205bd91fe0c2e36846949c6693fd0d9bda074f2df475843b74d9a28d248a400c", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768186814, "uuid": "794886dc-a5fa-478e-9725-fdcc87ef232a", "comment": "Malware payload", "value": "58e61d29e3db691f43320c89840778b975c980b1", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768186814, "uuid": "817cb30b-ffbe-4568-af1f-2230e041d4c9", "comment": "Malware payload", "value": "6fc12b8cc6fd0a8a1a0298348e921b1f6209539ac225ac50c915289d4fef7ca57a44b48177ef032b221579dd4f4f1e3c", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768186814, "uuid": "38ed84eb-4708-4f9c-a732-e13f909eeaad", "value": "T1B4D42384D119890DB6F4816BEF3CB2BA850BB42907B479B27DA76BCDB3201735D681CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768186814, "uuid": "0e4f807d-fe42-4599-aa92-42b0dc84b68e", "value": "12288:gkcLycguJrQ2fBQ+5Ac2B6V4nzjSP+Qv8ShGJtZMZq8+qmoC+Z:gkLc7NTfBQ/AUf1m80utZM7+qmoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768186814, "uuid": "2a45c86c-f0f7-41dd-845b-130f12880ac0", "value": 617866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768186814, "uuid": "edd68ffc-893a-4fc1-970b-ecf6511b2a15", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768186814, "uuid": "fcbbe6d4-9f4a-4ca8-b90c-795488d0ea0b", "value": "nREVISED_EPDA_f.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb44f8a-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768229889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229889, "uuid": "c27ba0b9-423f-4c93-a200-e38b9d8ba657", "comment": "Malware payload (SalatStealer)", "value": "0ae38e165ce11b7e6805f8f26850b307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229889, "uuid": "be879765-bd05-43bd-bfee-996410943933", "comment": "Malware payload (SalatStealer)", "value": "20a64b7b18933e9d5a8c73528758aa533d8b3ff1b8499b187fb52d3a22735e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229889, "uuid": "b20476e3-607d-4939-afbe-fe4a0ec1278b", "comment": "Malware payload (SalatStealer)", "value": "7a71372dc18864abf1dc36f351edf65eb788b74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229889, "uuid": "a95b85a2-7bd0-4cbd-b2d9-30f616273053", "comment": "Malware payload (SalatStealer)", "value": "5d53eb884b39e25a5bb356d4c29c9309b61da7e9053ee2b2c4f6c563a89dbef778caee0878a8b1f4ce0371b65ac483e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229889, "uuid": "7550838c-b6b7-49a4-9970-e9b16fca2763", "value": "T1BFE533A5A935D60ECF36B2327FCDA1AB29CCB816C0F65C2178623965D02161F9E573C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229889, "uuid": "41420b6e-badf-4edc-a6df-b9dee0f63744", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229889, "uuid": "00999931-b3c0-48bb-b5de-384a0c31053f", "value": "49152:NWVkn0u7gc5+5dRxQYzA43r0dD2lEdx/k/vmga6ELlBhqIXH/OvzgC3rAf:eC7gc0nSYzA434YaRp6ELkIvOvzt3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229889, "uuid": "15d77feb-984a-433e-93fb-b23263957021", "value": 3241984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229889, "uuid": "021664b1-a58d-4f23-8942-da0cc2c1f9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229889, "uuid": "2882825c-e76c-4406-9ee1-2383829244c9", "value": "0ae38e165ce11b7e6805f8f26850b307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5a1b56-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211257, "uuid": "75d42b7f-f9dd-4dd0-beda-c4fd1c0bce1f", "comment": "Malware payload (Mirai)", "value": "72cb63e865f514da9e518050eaf0f427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211257, "uuid": "2ac0ffe9-aaab-4b6b-a964-7e1dc7b6dc5a", "comment": "Malware payload (Mirai)", "value": "211209bfaf5917eee2a1cceb6dfd9f5d34ed5b8f12d2978ed3f2a3b804537a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211257, "uuid": "8ee09d0c-0bc2-4374-bc23-580c360a55df", "comment": "Malware payload (Mirai)", "value": "3be047a86126696a734ac3a0ce38433c22c0e085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211257, "uuid": "f798ea5a-f0b5-4a10-a8b6-cda34a31f9e0", "comment": "Malware payload (Mirai)", "value": "3e9307f2d43ae78d9e0a736b3082c3bc3520427b9316de013ee8e6dc77f4276f633728d508a6bf89f1150ca68930cc0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211257, "uuid": "e9aaf97b-a439-41d7-bd3e-d48496829cda", "value": "T197C35A73CC6A6FA8D568D1B0F1B08B795F93A91491475FBA19A7C2B44043D8CF60A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211257, "uuid": "68161247-951e-4704-8c43-9dbba613ca16", "value": "1536:RzV/33679hLPwvVFOTcx5b4JZZCOKU0KCJABeShDWMpsknnvZfnzF:RzV/of2KAxpIDUUBBnDW2skhvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211257, "uuid": "ecf77487-9502-4e1f-bca1-105a8e5efa21", "value": 121424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211257, "uuid": "5cf24155-3002-4453-96e9-8091efa21e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211257, "uuid": "abe97d7a-88a3-403d-84a1-f8b33ba1e931", "value": "bot_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb3e230-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229949, "uuid": "d7178167-04a5-44c8-a961-3dd11e6e710c", "comment": "Malware payload (Mirai)", "value": "4086a600334b0f0b5dba0cbafa5de2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229949, "uuid": "85936c62-3955-4c6c-abf0-f445d0126268", "comment": "Malware payload (Mirai)", "value": "2134e305ef5138fbf6a839bf1aa47e9a96aaaeb380608632381b229c8ae201e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229949, "uuid": "1050691a-c86b-4f44-9e7a-eee2cc06f7e6", "comment": "Malware payload (Mirai)", "value": "de073d3cf4ea4ee221f20058a6f275b6db0a32ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229949, "uuid": "2f1d4f7a-9ff8-4cc9-bbbe-e90ccf530ba7", "comment": "Malware payload (Mirai)", "value": "57ed46d16cd2c891cc0ff659a6923bf3acae544f80aa4a29ea47b9dde15b113fd97cf0544c52b7a6ec910d4f65b2c274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229949, "uuid": "7a6c917e-1a91-44d1-9517-ff5c6bd474e9", "value": "T1D7B3124C84B420A6EBFA7539531B54A4EA92F44FA5B047FEB2F133C9C766202F643B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229949, "uuid": "a864744a-1c82-4e5f-9754-7857bf7d0d64", "value": "3072:3Oz9Ja5NSr4x5IQgcI3T3wDV11zI0u9H2j:e3+c1QQwTGnNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229949, "uuid": "223906a4-615c-4535-ae10-7a5b6de53aa7", "value": 110664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229949, "uuid": "1e5c7f7b-7ee0-425b-a3d6-eca3887b4f9d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229949, "uuid": "34651ef1-e59e-417e-92f6-d1aaae0f4d91", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0678cdca-efc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768228994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228994, "uuid": "7bc99af4-6282-480a-a1f5-1260fca38c84", "comment": "Malware payload (Mirai)", "value": "91868847bee8714627be4b00c1d5383c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228994, "uuid": "89553d83-35df-4760-9004-77c2635179bc", "comment": "Malware payload (Mirai)", "value": "218d51ba37c9e5c339c29dc3301ae15976fbbc76334ab68572c8d9bf967a7aac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228994, "uuid": "aef7c773-fb9a-4597-9798-18521c6bd769", "comment": "Malware payload (Mirai)", "value": "d0aeeff37cc1f34f8803b2aa1482d79d877a097b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228994, "uuid": "b59a18e7-4c8a-498e-b1d3-d28fbc8fdeed", "comment": "Malware payload (Mirai)", "value": "d81f31d77825a83b383308420ef942b8c728118744029e38d317a1cf350ade1ce2fd0e1db33143f65ec160e5f2ea50d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228994, "uuid": "333db6a6-ad08-4bbe-bb25-79b96c1ea3f1", "value": "T1EA838E12CDA59C98F03E7D3010B9CBBB4717A505991B6DFB3C46C225501BA88F5EABF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228994, "uuid": "78fbca31-d6b7-4c46-9e92-bdd4934f8451", "value": "1536:bVR4S54NdET+SEr7X25uT7opAkJYjkdNvzmMpdXCSQKk9yIQrTAbVR:bVRd50k+SEr7m5unY3Y1ydX5QrUI4TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768228994, "uuid": "59bc4c2e-5256-453c-8b5c-9d263e0757f4", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768228994, "uuid": "1a0ed812-fe6b-4e4d-8b04-7f2daccf7638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228994, "uuid": "e94542b7-eee8-4e4a-bbd9-1c98656235ff", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59ffe47-efb6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768222819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222819, "uuid": "d96448a7-b09c-46a5-b1b1-21113b6c71b6", "comment": "Malware payload (Mirai)", "value": "08dad0817ab17396f79a2ca3b763984c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222819, "uuid": "18a0a16f-24fa-4157-bdf0-5225287ea566", "comment": "Malware payload (Mirai)", "value": "2297f09be7d1411dfeb0affba7ecd71bb085b03ecfeb7b49df4a68d317b071f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222819, "uuid": "edb53424-76cc-417f-995d-f0e275744055", "comment": "Malware payload (Mirai)", "value": "fe1c75a8d35d0b7f9337042c725d661d302df094", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222819, "uuid": "3892a1d5-f03c-40de-b9ed-5fda501a1767", "comment": "Malware payload (Mirai)", "value": "0bcd5f7cbf4feab6583051eb2cc0aa16d6eb4b6cb81abf19617333f61c531c3b46271a25655838c32e2f22e2899eb70a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222819, "uuid": "137b001c-0fc3-4caf-9929-dda310cfa261", "value": "T193A3198ABCC5C612C6E0A1B6FB0F51CE371643B8D3E6B107CD19AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222819, "uuid": "3b8a8471-e1c0-4055-8162-0dac82c47db2", "value": "3072:4GLceSkvsd/OgyE9ctUQ+eOzBOs9VsT2:zL/vsdGHEGt+zBOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222819, "uuid": "9d274f35-05b2-4387-adc5-ac307d28e12e", "value": 100448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222819, "uuid": "c663b76a-74d9-4409-91c0-216a92d9b84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222819, "uuid": "f28fa689-36de-43ec-9773-c2eaadc428f5", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fc3c18-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193540, "uuid": "f07a420a-eaef-498b-962a-9bb0d6b6d4f1", "comment": "Malware payload (Mirai)", "value": "3a8b73756abace57417d49dc57e8d2ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193540, "uuid": "663d96b0-5e00-4086-98f7-09031a78b5e2", "comment": "Malware payload (Mirai)", "value": "2432b1ed6f662c99c036f4a68e9db0628b54fe9d7dd99391e4f137ee29960d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193540, "uuid": "04553f1a-1aa1-427c-b4e2-1c6bb6f70121", "comment": "Malware payload (Mirai)", "value": "dff62cdaaaffed19bc64992206f5be934a9714cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193540, "uuid": "b74983c1-935b-4c25-ab7e-128012b140ad", "comment": "Malware payload (Mirai)", "value": "5efbd1b9fb1de0edf169cd626c455664eb691d5ef6380e621257c98264abf77adb34fa1572da157ebc14745c86332343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193540, "uuid": "7d479bc3-5e6d-4468-a601-e1932954f482", "value": "T111936C58F90EAC01E3D6D3BDED4A8BA1712B3CD0D35281B27D01A35DD4F6AC5CAA1927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193540, "uuid": "b6063511-dbb1-41c2-8489-caf7d25cb0e4", "value": "1536:HRlkbiKc+asaOBh5c+E/5zi/jGQ9zEe6DxXooy9Kauh3IrQk8VxM:HRlkZc+sn/ILGe56VXo99KGQk8V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193540, "uuid": "7527e778-0e25-4983-a1e3-66598bbe624e", "value": 91848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193540, "uuid": "65a0f788-3f77-41e5-a983-1a64a1c34021", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193540, "uuid": "b0912e1b-6bdf-4ec7-9926-24e15ab7397a", "value": "catgirl.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102609a6-efc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229010, "uuid": "646d15d1-4375-489c-b6b8-8d1e79d936ba", "comment": "Malware payload (Mirai)", "value": "0ee607fa24a64808be4727afea16c86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229010, "uuid": "49da5d5d-5e4f-464a-9d68-0bfb3b18fef2", "comment": "Malware payload (Mirai)", "value": "243a684647f85d33fa138109ee5ed7782d7754f095ee78f244e2059fba5eaa10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229010, "uuid": "61d5d60b-dce8-483d-ab64-cf6a56204782", "comment": "Malware payload (Mirai)", "value": "613e75e35cf4486bfdbcf2f7c31837e45c51af64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229010, "uuid": "ff677c5a-1b74-4130-a251-35199638727c", "comment": "Malware payload (Mirai)", "value": "b8a008fa1f5b9c7fcecf80dc1425cf6d470f1782eaf9f9eb485504eed4c2892a59c15e78daf37063674ecf5c963b4d6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229010, "uuid": "918a0f8d-c631-48b7-9eb0-32c3b0138ff4", "value": "T13C646C88BB4CFF42C29093BAED6B0613B33934607B4A86637D15123DEDD37989C6B156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229010, "uuid": "f6419990-033b-4e35-9937-859233a6264f", "value": "6144:mLfXMgHViMjznIW3/Eg/DUcwh2qQKCqzQW0LLohjE0ihwrtyEe:ifXMgHViMjznSEU1IMQW0vohVrtle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229010, "uuid": "712ccb62-47ae-4e0c-badb-05fed32da5a5", "value": 332368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229010, "uuid": "8b2e8fe2-493a-4b74-b7df-f6cd47bb430b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229010, "uuid": "72b9e4d8-d375-4fca-84d1-7e8e841776df", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332dbd0c-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768224345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224345, "uuid": "8fc71020-0b61-4597-9fc7-2daed4b8d565", "comment": "Malware payload (Vidar)", "value": "d467c925c2347b4fd0bf722d63980d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224345, "uuid": "0c5f6c5f-69c0-4d36-aeba-30bb29149df2", "comment": "Malware payload (Vidar)", "value": "24ade7fdfa0108f3f9bfa63c27aad7651a3ca9cfbda9504c79f9c51ddb65ccfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224345, "uuid": "0677e9fa-d635-4a05-afde-7f0081a7af69", "comment": "Malware payload (Vidar)", "value": "287f92bd6af2ab48d837b593204a7a2de5225394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224345, "uuid": "81fe6b57-2ba6-4eed-9abf-fd2a7c8d9aa1", "comment": "Malware payload (Vidar)", "value": "3f1e7046a77001cec5339ab1376ce8f9d6a716186b428e188ff07177e2180b618a5aa6324409e65133e77e6db7289421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224345, "uuid": "dbc41199-3261-482e-ac1a-5f06aa87c679", "value": "T1AD766CD1FA808665C6DBF234D962615A7230B448173511D76F7A0BA88C7FBC8173BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224345, "uuid": "95aca054-c7e6-4cc6-bc70-acb1c7f165a3", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224345, "uuid": "085c7f25-0938-4b14-adb5-5436b5525685", "value": "49152:i90H0RptYrb/TDvO90d7HjmAFd4A64nsfJ3IQvUvovE8dIKJyG2+MWTiK1mZQ+jP:ot715UZJHz0BLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224345, "uuid": "f467bbff-98d4-49c3-a38f-86b8fbb3f41e", "value": 7208576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224345, "uuid": "47f895de-4a58-418d-80f3-0da8f85597cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224345, "uuid": "e69f2cae-4dc7-4cd3-9866-9ac19edc3fa2", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be204f4-ef5e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768185006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185006, "uuid": "01de04d4-a5a5-4505-b9e4-a82c4ac60a25", "comment": "Malware payload", "value": "1ef84563cd9f50994e0a8e3b026e2ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185006, "uuid": "1f5d0c30-5d51-4d92-ba4c-1cddabac2cfd", "comment": "Malware payload", "value": "24d264c5b777a6a199916aa7afa32e92358aa9d13e695035a2b18285facdab0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185006, "uuid": "c3230336-dfa7-467e-a34d-04c409784069", "comment": "Malware payload", "value": "6c94321b802e00388b9863acd8c72005ca4d7e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185006, "uuid": "4fcc6366-cec5-4b5f-afef-1de84bea5bdb", "comment": "Malware payload", "value": "bde7d948ad6a3199594d0101f235f28df33bf2f4d2fbe6db862b91aa975382d4af3ead24e0849c1c1a9747eb73406b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185006, "uuid": "85b81c74-7067-416d-93b5-262181e3680d", "value": "T113E40158220EDD02C8511FB40972E3B86B788EEDE951D347DFF97EDFF92AA545840282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185006, "uuid": "e1a82a63-4af3-46c7-987f-b33551ee2615", "value": "12288:Y6ITnLIPgi75s6TZ8kYS1BCPQpmxvgpIFTTEnusaLUHxfNV:6MIM5bCS/CZg8TEj/HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185006, "uuid": "abb00346-d036-4c0d-a3ab-2a1e4a1d552f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185006, "uuid": "fe134e5c-c8e1-451f-8007-4191d5e83d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185006, "uuid": "cc1966c7-77d5-4e5d-9007-876e0994d07d", "value": "rREVISEDEPDAforNOVEMBER28-UPDATED_STATEMENT_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d4c40a-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212026, "uuid": "8951f546-5a9a-4cd8-a9a9-ea9a2e115683", "comment": "Malware payload", "value": "ea9b5223833608889f4c778c6d156c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212026, "uuid": "c4a5227f-9666-4743-85d8-65794086ace0", "comment": "Malware payload", "value": "24e5d079d6bf37df6c962e8d3392ed1cec29f0edb1bf48811fcea8ae1886059c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212026, "uuid": "d982d0e6-5338-4a1f-8869-433618c19a57", "comment": "Malware payload", "value": "efc3437cc0a64cc42b7d65598a31098f06e8fc1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212026, "uuid": "33d44a68-19ae-4aaf-aadb-6aecdfe0ecfa", "comment": "Malware payload", "value": "b5f1266b9dd1e0b459f21cbc5c2a0ad7c66fa22a52faac37ec2fc18cfb7269c177e5fccb50add5527fb91d966b01f247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212026, "uuid": "07f6e20d-b894-4fb5-9491-388bee6e8d0a", "value": "T1B80523D86751EB8EC3506FF18ED58B0A2DCA434A3773529007132601DB66B289FD9E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212026, "uuid": "a0c6a043-5314-4a8b-b132-c70f6267af3c", "value": "24576:E1Izh8Fei3e1Qzi8d1642FBdu83CF+OotMETHystmih4:EahmeMei+c3IBdDSFMGCS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212026, "uuid": "fa635a00-e463-4f7f-a792-cfeb98828e13", "value": 840240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212026, "uuid": "2e83d0ae-052e-439d-b468-56a1ab8e57fd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212026, "uuid": "a8f57120-3a85-408e-8d8d-77ca6520a0ce", "value": "client.ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccc59c3-efd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768235930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235930, "uuid": "3cf40946-84e7-4afd-9b8e-5b79b8640a58", "comment": "Malware payload", "value": "bafe0fb388cf9a33411449b08ad8fe72", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235930, "uuid": "19c1a712-6efd-4029-b6af-1c80e630e3e0", "comment": "Malware payload", "value": "24ef77b150ff7ebc30d8cb7234fd2cec8a15a58128e8e2441e259b7d3de1e66c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235930, "uuid": "532f16c1-7389-4270-8714-8f0250f7c817", "comment": "Malware payload", "value": "b374343d3670f77eb0b163ed43ea17b44338306e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235930, "uuid": "9bf37590-8a10-4100-8869-3e0fb0bc1fc1", "comment": "Malware payload", "value": "fb3b768d0908c5d36996b35752b453139e96d2a40cb58bad9c66f9f0d5a27eb6018baca8286856cc7bedc84071c4e49a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235930, "uuid": "07eab45d-b433-498e-b3db-811b5d0bb21f", "value": "T14AF1B7AB5CF3101A9983A0AE67FBA3447151B007DA4ADCD97D8C5354DF8CAC858B27EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235930, "uuid": "7256baee-8673-4810-9e1a-91333c6698d4", "value": "192:Ti3QyJsVY7IyySFgFUyJ8MoxoOp6nb0KL80/piDng4:Ti35FgFgMksb0KL8YpiT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768235930, "uuid": "fda872b6-d647-416d-b899-3782c20efc37", "value": 7485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768235930, "uuid": "ee356472-860c-425c-aac5-dc89bbf1b186", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235930, "uuid": "5f565774-13ce-4e23-8883-36977cd4f4bb", "value": "PDF_Reader_update.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210fd059-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179646, "uuid": "0c902a05-85fd-486d-a559-e235bd346325", "comment": "Malware payload (Mirai)", "value": "92371a4f4246461c760bd02a63f9f5d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179646, "uuid": "364f07c9-e07c-492a-877d-50c3aabb7ff4", "comment": "Malware payload (Mirai)", "value": "269e812a76c4f062388fa53b2d7bada085f443ccab2f799036f8c512a4d1f076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179646, "uuid": "b514ad2b-8af0-46f4-b198-5fd986fb7bd6", "comment": "Malware payload (Mirai)", "value": "b16ff5ae7a632cf4cbf572f6a2d99d0a9d4cc8b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179646, "uuid": "047595d5-5625-4425-9dc4-298e4433312f", "comment": "Malware payload (Mirai)", "value": "53493815a8f215a0c9fef8f94d8dc306ba10f5b6401709d07bfc743bc35e506c861d99dc817011ad51e92833b44ca24b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179646, "uuid": "5afb1fd3-7f2a-4520-bb2d-161098854f29", "value": "T1B7634A11ED796D27C5D0727A55E38530F176439D2ABC8A4E7EB32D9CDE04320307EAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179646, "uuid": "181976dc-9026-4f86-a33e-da1fa2601db2", "value": "768:Fuo+9h/eayz4FayOzMQDVHDZf1zV+iJPN7H0Lju8WO+EatkazKfEd:FuL/ehz4MypQxHDZf1z0ab0Lju80BzQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179646, "uuid": "a010df3a-a20a-4f98-bf41-ab4ca7501661", "value": 66772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179646, "uuid": "918f65cb-56b3-4230-a503-59cec1c502a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179646, "uuid": "ed6f0f2f-024e-473d-a8ee-3f8bd5fe0a17", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1a880a-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193545, "uuid": "fbb6b5f8-1fbb-4b2c-8044-41a8fac9bf5d", "comment": "Malware payload (Mirai)", "value": "721bebeb88bd7905d0c929fdf18636aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193545, "uuid": "a95ce449-8470-424f-8db1-befae113662c", "comment": "Malware payload (Mirai)", "value": "26ccfa55b429c083590b3131f93e5444f4b738b6d45a4767d6a3dd28ec583c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193545, "uuid": "697e77c5-6e10-4cfa-b6ec-a4cab84272bd", "comment": "Malware payload (Mirai)", "value": "430eac8539a90d306f186118473a28531e7557b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193545, "uuid": "77b09460-b0d1-4905-8ce9-f29986786dfb", "comment": "Malware payload (Mirai)", "value": "6f4a412282e63371d3e6b9d57bbf926d69f988ce7dff13a639c17e364a1db480cd88cdf66a056ddd3374af4598f96796", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193545, "uuid": "eed78c53-80a9-486d-8842-0b2f55281749", "value": "T15E935A44FA83E0F9F29345B1422BE7FB5A709D255016EAE5FB093B79BC713124E0A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193545, "uuid": "91f106e5-45e5-4b4d-83dd-604d8b5ef46e", "value": "1536:H/7YFsiWPj7N9qwkujh00QLrZLcK+/a8h4rLSJGorsV:VnjqMt00QLrdcKIa8OrUsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193545, "uuid": "c69328b0-a9fe-44fb-bff3-aa7dad5e014d", "value": 91404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193545, "uuid": "cf1f96ef-0d7c-4c34-8482-a1d21b1e26de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193545, "uuid": "d63ee97e-658f-45c8-b377-823d8dcf9b0a", "value": "catgirl.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e223b7b6-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226786, "uuid": "47a5cc2d-0863-4f6d-885a-302a99208f4c", "comment": "Malware payload (Mirai)", "value": "ae091f93fb2cd759c6b9bd906971b564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226786, "uuid": "172968c5-0b57-42be-bf47-25ad9ab8f23e", "comment": "Malware payload (Mirai)", "value": "26f461c74441901ff75178d3560845f792352aaf117e69af6723186d161c06e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226786, "uuid": "afaa047b-005c-4836-af07-8f547a6f66fd", "comment": "Malware payload (Mirai)", "value": "ee825c368e69c3acf7ddc39f48f787e18d6dbb31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226786, "uuid": "9c8df052-56ff-4126-a438-9a09a8d9d607", "comment": "Malware payload (Mirai)", "value": "5213733053be2a7479de8161f9806589a461e170ff418209f57007c6e178d2014ec467afe26f2cf3cef384df6dd0e1a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226786, "uuid": "9262b528-b632-4527-b04d-f1986ead6229", "value": "T14B933A0173654547F7E70DB1283FBBF167AED5A121A0A2C5694EEB0F8136E32144AFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226786, "uuid": "4dbe10c6-6e73-4144-9ce0-a5a472722698", "value": "1536:lXO9l2uHcO8pXg2O6GkrLYIHiv2xXOE76mKJOruzGCFS9S3teENY3teTAbVRc:lvO4Xg+7OE7672uzGKS9mLfTA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226786, "uuid": "4881cb42-757d-456b-bfb6-bd7d41ecf0a2", "value": 91560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226786, "uuid": "3c1f1d73-d958-416e-9646-221b9a43c122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226786, "uuid": "73ec7cdb-d8ea-4284-93f3-d3003a7b757a", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f15ba1a-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218754, "uuid": "d2490f2a-acfa-45cc-aefe-bdbddb5a4c36", "comment": "Malware payload (Mirai)", "value": "4c1bcb975d350c7c5d347f4824391881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218754, "uuid": "1ed459e6-7344-42ee-97b1-be1015715781", "comment": "Malware payload (Mirai)", "value": "28249ea3f6cf3f3e8e062c2c9cf7625cebab0841ef444c898efc022a18ac58f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218754, "uuid": "03c2e2ac-74cd-4ec6-a439-cfa8e91ad4d9", "comment": "Malware payload (Mirai)", "value": "a507a1796e62f8b71312ef873441c27385b12052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218754, "uuid": "177ab540-9345-4bce-a59d-b69e67fd9efb", "comment": "Malware payload (Mirai)", "value": "6776aed27a6b87a9ef1a36072d9cb099bc809c20c4d3612055ae9117a3605daf27ed18c7151685e4c947bd1bbc4e0eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218754, "uuid": "69d91dae-60d3-4892-ab8c-0b2b306df87c", "value": "T1B48329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218754, "uuid": "0201eb15-ba93-4103-985c-7615adac1a89", "value": "1536:iXDwDhVtcU4xiUWaqH3Fgl3IeEMWximKjfTsv4gz9F7v0:kDWKzQLH3FljwmKjfTc4g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218754, "uuid": "e34c7c93-fdc1-477e-aa9c-027c5bb8a83e", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218754, "uuid": "825c1cfb-fd9d-4299-bc8d-730c8c841ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218754, "uuid": "9547f895-51ca-42e1-bad8-3381c8bf763c", "value": "johen.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9acb136-ef74-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768194613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194613, "uuid": "ad2375a8-0e87-4006-8649-e0d83a716f04", "comment": "Malware payload (RemcosRAT)", "value": "696168a29f8a7959d9f0df632e0eb21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194613, "uuid": "a336d405-5fdd-4b7a-812c-19ec6b846e16", "comment": "Malware payload (RemcosRAT)", "value": "287006ee317c0da2837cfa820380f1df4befaed7321bffa3f772b1101140c9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194613, "uuid": "89f8e70d-7c15-4711-b013-a306517886f0", "comment": "Malware payload (RemcosRAT)", "value": "e78dcb01f2ac9ec77f7623a88f709aa410657a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194613, "uuid": "528e49f9-b378-47c4-896a-d195189784df", "comment": "Malware payload (RemcosRAT)", "value": "db681525f32dc5e04fc8a5f0d3b19aadbb335e58a3602c1c92006c482a8ee3d5862e70ecaec5919c27653688a17083d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194613, "uuid": "439c2531-66fd-4321-ba62-7f33f9d89ee7", "value": "T1B155D01373DD8361C7725273BA26BB41BEBB782506B5F56B2FD8093DB820122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194613, "uuid": "21756b2d-59e5-49f7-aa5c-795d3329c2ae", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194613, "uuid": "fc412eed-6e60-4e85-8cbb-bda93e5f1974", "value": "24576:Btb20pkaCqT5TBWgNQ7a6wTHxnhlaC97Uh+ar8STknlp+w6A:SVg5tQ7a6wTtPj97Uh+1STYzf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768194613, "uuid": "4cef0363-3ffb-42e5-876b-440df8e3f341", "value": 1289216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768194613, "uuid": "97f1c0af-31e4-4932-85a1-f97848044a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194613, "uuid": "4b08af54-4398-4a73-99d4-6cc9b14066f7", "value": "New Order - SR 400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ef4fcc-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216727, "uuid": "2deb78cf-6d68-4e8b-bdd0-8f41ea2c83e9", "comment": "Malware payload (Gafgyt)", "value": "24fa9a83aeb7c214bc061b855f641210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216727, "uuid": "a44b1b1c-d315-4188-95be-b679fe11d03f", "comment": "Malware payload (Gafgyt)", "value": "299d7b24d3433aced87e8637667b4280997d9a10a8ed194cc5f5819832ca69ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216727, "uuid": "4fae1a46-4333-4a86-a8a3-ff3ebc5736f7", "comment": "Malware payload (Gafgyt)", "value": "873905bac8c5300bf3c6df5948b8972985addc92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216727, "uuid": "27c3ce45-3abb-4b02-83a1-70236d099fa3", "comment": "Malware payload (Gafgyt)", "value": "6bcceee5b791a1ff302f59835ee42bccedd7aed1e05a335005c4e18f442c9374dca3453986c0f166aaad879d24eb958f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216727, "uuid": "1f9a077c-b278-4c36-9c24-b99e57c60201", "value": "T1FAE3A55AA7719EB7D81FCE3306A6861114CCE95252D83FBFB2A8C618E74B84F44E3D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216727, "uuid": "2409649a-7bcb-45bf-b68d-00767ba7e150", "value": "1536:gcuej0iv6CiFpYo/rVd24hUoOsVsPnhxiuOKLf5Klpx5tQK/nm6Cnb65HIfE:gcgiv6niboOOpx5tl/nmbnbUHIfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216727, "uuid": "11f7316a-05c3-4d53-b6e4-936a4247a742", "value": 153902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216727, "uuid": "fd9896ca-e393-49b1-8b36-abc600a22608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216727, "uuid": "42817dd2-684a-4861-b833-403f4d5265b9", "value": "m-p.s-l.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc837c8-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179107, "uuid": "2f5a3097-e6bf-447d-aec6-c7f2092afc9e", "comment": "Malware payload (Mirai)", "value": "df2991333ad08f1cfe242ade37f1e869", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179107, "uuid": "940d94be-d994-40b5-b4d2-c8f09d9305cf", "comment": "Malware payload (Mirai)", "value": "2a9aa13cdd4138933f3c0adb4c987185a2917d7888b4a95020f1592379d6981c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179107, "uuid": "128e41cc-9017-40e4-83ce-29b817adbb7e", "comment": "Malware payload (Mirai)", "value": "e709c0f3cc0b22443821dc92ed3bc2f24ea120dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179107, "uuid": "5289ed72-9400-4720-8762-81145457a1e8", "comment": "Malware payload (Mirai)", "value": "2986e5f46b7ff3b195e891942dab27e599d1a13dfda4f052b04312628d76f47b42ba6df5fcd4a2eec12c1a147aa30033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179107, "uuid": "8238a0ad-7fc6-45d8-820d-67e1a498a35a", "value": "T1B7B3D74B6E629F7DF32C82354BB78B36AB55239133E0C585E26CED401D6038E586FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179107, "uuid": "6e4357e8-2550-4e5a-9b20-e86ebcc416c8", "value": "1536:ghMnILXzfJzfnLfgFrR9pHfxSr3/MMFtmOWAkCL0DWp1VFzQT2bVReb:WEIeV//xK3/MMFtmOWJ7DWfzQT24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179107, "uuid": "c3a7cdef-a3d2-4a05-ac3b-975498664024", "value": 117544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179107, "uuid": "cd1cee73-72d5-4941-9561-ed40a6bf562a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179107, "uuid": "e2982499-2221-4c59-8e09-3efb2db36326", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75ddea7-effc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768252913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768252913, "uuid": "0d35b7d5-2f61-4ae5-9f22-dc4d9a430871", "comment": "Malware payload", "value": "0b6f7356919b9632c1158681ee0462f3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768252913, "uuid": "19e7e6b7-2299-4a6d-8c88-66314436f220", "comment": "Malware payload", "value": "2a9b971c835e2ee5f190d068c602601fdaf718d8bfe085c2032d59a6f25ed082", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768252913, "uuid": "a9d40507-fda6-429c-8a1f-03e25d3c850b", "comment": "Malware payload", "value": "7b50320a005cf68e5c17d51a8fd8422ceef1611a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768252913, "uuid": "2784aa2e-36f5-43fe-b5f5-55066a572305", "comment": "Malware payload", "value": "b891c6c46cec60f3b07e2938d020e468220f2f66342934a63ce3f5ccdd80dc914ab3d0143715cb625807420241e47e46", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768252913, "uuid": "8bb12493-1925-4e3b-803f-7821c52a8c40", "value": "T179C633C82C71CCD936CAAF261B4A6AF4F76041613FD6614784532B44AB379EDCFDA04A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768252913, "uuid": "9d4d8202-a550-470f-b076-f532889a5fa2", "value": "196608:j0kbfrkMDJePO6TnNLe5n38ey4NsSE4l0IbW+eeuXRCbs3fXvDLkWoXEpXcewU+j:jgm65SpqNSJWrRos3fX7UUtcewcnWjfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768252913, "uuid": "cc2830fb-8db3-4619-b9f8-cb2aeb6473d5", "value": 12524776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768252913, "uuid": "ece2c3ee-2acb-4a6e-acfb-452801f23652", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768252913, "uuid": "6fb5a384-f953-49da-a810-759ff29bbd8a", "value": "Scan_Media_1757_dsp_Prikaz_na_perepodgotovku.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e6b2ef-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182579, "uuid": "3f3c3d37-f537-4fca-ae6c-8c0ae740900d", "comment": "Malware payload (Mirai)", "value": "804e6908d8272fff7a955fc64640429c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182579, "uuid": "2aecaa22-495d-4ec7-83c1-5e404d7be4e9", "comment": "Malware payload (Mirai)", "value": "2b463920a1aea05d801d1dc504f5cf385ad8a9b305a25c4ae1fc3f6846346f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182579, "uuid": "b4d0b2ee-36d0-4422-b849-a592684b1ce9", "comment": "Malware payload (Mirai)", "value": "01e49f8a6e4e872005ba500a20ab3d816ba83f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182579, "uuid": "98a5a478-d98c-4842-8bd7-6f6d485cc9d7", "comment": "Malware payload (Mirai)", "value": "8c5b1c4510c89494b39211318b3364325963b3fc96424b4fd701e8eb29ed76e4e59c2b8202d65cc9a10e1bb90f80eec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182579, "uuid": "d5184757-53eb-4970-bb0c-e60b6a54e0b5", "value": "T190833ADBF800EDBDF80ED77B44530A0AB231E39149931B366757B967ED321E54826E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182579, "uuid": "3a149407-7cef-4108-9c03-7641df0be8fb", "value": "1536:LWOLMPybZLA8GIZW2d+Pw81y1jFRt5FZah2szX6NLLMdgKVgLskbXyn:LWOLIybZfc2d+Pjy1jFRGhrzXKIVgL/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182579, "uuid": "ec5f642d-660a-423f-b752-d9c028bde67c", "value": 81476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182579, "uuid": "efe87f2b-a270-48cd-be90-4cb6ab892ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182579, "uuid": "48a38006-2730-4ee0-9a73-809fdc91312f", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23eb8aa-ef5f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768185527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185527, "uuid": "fe6762fe-6276-4e92-bc46-312853fd9239", "comment": "Malware payload", "value": "9f38b226fa1f598b2c6e4c2d0a2b931f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185527, "uuid": "fbf75fe1-2a36-4fca-9211-e5a47a60b26b", "comment": "Malware payload", "value": "2c2613de1e6db9d04c3739f11dacb0e0a7b9edb15edf57e6d2cad130893387bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185527, "uuid": "019cec14-ba9a-4048-b017-d2a52016c01c", "comment": "Malware payload", "value": "490c838bb43089f74f0781cde4cfbdb564992b44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185527, "uuid": "5cae9fa4-8c3c-4f46-9e4a-c944fb4ccd9c", "comment": "Malware payload", "value": "cc30f4f774f6f1480772c3605dc4549dc4e305d78f1f2eb75455e346dc01ebbe6566ab700f409687c1d6a8ac9582a240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185527, "uuid": "5f92fa24-5099-4375-923d-dbe0f1e2fc80", "value": "T1D0C64BA8BC1DF097EE9C7DB86F3142943425BC959F83C21B6614BA6D8DF17A44F206B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185527, "uuid": "d3d996eb-cf97-450e-aae0-354de30858f4", "value": "98304:O5iA+PF9jA2JsUqFGXg2g+Gg6BPDREuThFPWlYufRpESjTEf6u:HVU2SGXg2gacDRvLWl/qgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185527, "uuid": "20ee47b1-58a9-43e9-bae7-4dfe5c3c7928", "value": 11862016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185527, "uuid": "f8407d54-019e-41b4-9175-b46bc6035f21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185527, "uuid": "322316a2-643f-4b09-9cc8-eee994ef2073", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c9b90d-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211254, "uuid": "c7f87f3c-8dac-473b-a0eb-a90d5e324897", "comment": "Malware payload (Mirai)", "value": "1aa40060bc84eb78ebc05862f9ababec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211254, "uuid": "07702306-f02a-4441-93b5-c2d302015c03", "comment": "Malware payload (Mirai)", "value": "2c685ee080b596bc0bdfeba52e27caccfeb1e91e430e014805c27a2b1a126c16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211254, "uuid": "1c46ae4a-44a0-4ae0-bc45-d2b128aed202", "comment": "Malware payload (Mirai)", "value": "946e1354af1042b45f3f9a580d0be9cfa7f293c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211254, "uuid": "01881c39-9fef-4572-ad49-6b006bbbc2e3", "comment": "Malware payload (Mirai)", "value": "6e1e92cf4f20e79e7fa84ed949bd374587ab4713884afe15f20f2354a32ea5915a4e5d0b99ecfe7b633c439257f57ded", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211254, "uuid": "c92e2843-c2a5-480c-a78e-cde9ae499005", "value": "T186936CC4EA83E4F5FC5705B12137E7379733E039202AEA97C3A9AD369C51641EA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211254, "uuid": "57ae35f8-3a2e-49ef-afaf-e628bff25da4", "value": "1536:cmW1AWo1wiIxj/oE9sxd18czyCrk7EJpJgFBe5jv6SSR0w1y:bWKWo1wi6j/Qd1ZyoXfirYjC7iw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211254, "uuid": "0afbe42a-55bf-4442-98de-9e271bdfc387", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211254, "uuid": "d902ba56-db3a-4836-be64-a596056778af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211254, "uuid": "6e3d723f-10b8-4ac6-ab89-dc08abbef139", "value": "bot_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b26dd8b-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217513, "uuid": "75253b84-3b27-4cd6-a9de-394a744ddc0d", "comment": "Malware payload (Mirai)", "value": "8688fc148663da8bc60aa54366b3ee13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217513, "uuid": "9dd33e02-a9b8-4986-8bba-596b9dc02260", "comment": "Malware payload (Mirai)", "value": "2cdf57db893a7ffde95dc5e4a22cef4949f4bbca0db8d23f4c96588bd67ab24b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217513, "uuid": "33628cbc-73a4-4e6b-95b3-1723c5a7cb04", "comment": "Malware payload (Mirai)", "value": "159fde23b548e062969e73c2054c04ceca974159", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217513, "uuid": "839de5bb-2a92-4379-8477-3a486368e29f", "comment": "Malware payload (Mirai)", "value": "ad35266a087cce6d1dd5af80c91d308785b5f88d22867f06244f39447165350fa7c75026c8b4b2324e77b2480eb36af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217513, "uuid": "76cecdbe-8c2d-4855-aa6a-d44f90c0a644", "value": "T11193E551BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B117B8551F0D63F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217513, "uuid": "6521d03e-0c15-48cf-b6a3-bf54f2af39e8", "value": "1536:6d+d2CaP1//9Lb8b4G4WOduLadBS0Mbrz9685cJOwe7Y4th:k+dIP1ub6o0mcJOddt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217513, "uuid": "72f7b065-e0da-43d4-a9f1-061510877f65", "value": 93808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217513, "uuid": "374e5352-654d-44bd-b874-33526c3981ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217513, "uuid": "7c54bc87-5e0a-4582-90d6-7746539b8a4c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff249512-efda-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1768238431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238431, "uuid": "50e39842-d5e1-447a-bdd3-9aa4f0472180", "comment": "Malware payload (PureLogsStealer)", "value": "20462eefb5bcf3a01125ac198a1abb3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238431, "uuid": "c51f6a8a-b8c4-4397-8952-f88d7c983b59", "comment": "Malware payload (PureLogsStealer)", "value": "2d24a2fec7608b56092be4c9120c991e029322ade4e28569c486048464251efa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238431, "uuid": "cb56bbbd-5164-4977-a172-22d51b411a04", "comment": "Malware payload (PureLogsStealer)", "value": "d2b3c6b51d385a085ba4dfed9c767b07a2c94dad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238431, "uuid": "8c209fd1-8218-4f90-a31a-63b15e75cbd8", "comment": "Malware payload (PureLogsStealer)", "value": "52e2e6571b48cd8be2942f2a82bf4aa82cdb4c0dafe2b7f5ce28599ff6c9270918bcf1d4c97db7e4fcf55e8e27471f36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238431, "uuid": "44c61916-4880-476a-aebe-aec0f88482d0", "value": "T1AE1606312315A879FE370BDB5D605605F4A9086648A9168FB601F9FCE73607AF4B0FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238431, "uuid": "f77494b4-e5d0-408c-852b-9fdeab290acb", "value": "192:3GJtKPYT7Zi21VSyiNPTKnjpfPY814kUqCVnGSSJr2R2b0IdlTP1nJuyANFVjfFx:WVRwPTVknjrn3zyNrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768238431, "uuid": "7b7a996b-9bb5-4646-8acc-0a94d42da723", "value": 4340353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768238431, "uuid": "9a84280a-c250-4290-9f40-3425fd477a88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238431, "uuid": "277c2d9a-3e7b-4b3a-a7e6-55361e3021a2", "value": "Orden de procesamiento de entrega JES- 826226.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395e002e-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218771, "uuid": "94d1bb78-4e96-42bb-a038-a05bce06b4b0", "comment": "Malware payload (Mirai)", "value": "3595997d6e83b0bb6e45c2bb70246512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218771, "uuid": "993e6a08-ec64-44c0-8f51-aa9f89c00f4a", "comment": "Malware payload (Mirai)", "value": "2d7e1aacad2ae7c4ed156b4b369bfac3c64c711bb5d0cca1f89b1ca31b5a5f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218771, "uuid": "a8b35c60-54ee-4f83-bf4d-5d7a4303163f", "comment": "Malware payload (Mirai)", "value": "72e1eecdfbacb89937ef095dad2977835f2828f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218771, "uuid": "951dd1ff-4c0c-4098-84b9-47e80a3fbb45", "comment": "Malware payload (Mirai)", "value": "5772f6aee441879e0263eef0e68454bd31465d792ca10b44f7263a01855cba9202758ffad554cc3dfb4bcfd0e18efbde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218771, "uuid": "875bbca8-ce7d-4923-b97b-f8a441fb0e06", "value": "T1D8833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218771, "uuid": "eeaa262f-9fc0-449a-a9e4-d5e3f4302db5", "value": "1536:MqbF7IdAcsgpY+HqqWEVkCkj6Rv3U8GbdGrAyvQHol:TF74AcsgphqaVkCdRvAbdGrXQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218771, "uuid": "f5e53c47-de8f-4fab-9d61-6b5d19f19d8c", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218771, "uuid": "0a1a304c-81c8-4ad9-b111-07dec92f8b79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218771, "uuid": "aa803659-9085-4b67-96d8-ddfc42488dce", "value": "johen.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8afeb61-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205322, "uuid": "a8559b57-a264-4ed0-8c69-e3c202bc677f", "comment": "Malware payload (Mirai)", "value": "49c78a05ab7728dbec912a2a2c3a4592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205322, "uuid": "f90a9e55-acb0-458a-8cf6-883a4ac4ef87", "comment": "Malware payload (Mirai)", "value": "2e7597ef7c50d25dec61bc4497bf9af88fb89e1fd973b802c460044c12cdd9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205322, "uuid": "ebd78d6b-9930-454f-bf1c-65121dd14049", "comment": "Malware payload (Mirai)", "value": "514c5c4605e9992b5aca527caf3ac45d5b561fff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205322, "uuid": "83aa1e97-26f3-42f9-9370-990bb5cfa64c", "comment": "Malware payload (Mirai)", "value": "6cba23a84a80fa0c4e49f96aed7bcb9ed1d3ff850b5a303e6a71abc74f0612ad1593b221ffc5453d61fa1d13964f6cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205322, "uuid": "90967aba-f4db-4072-944e-af43be52f0f1", "value": "T1C363E896B991DB12C6D592BAFE0E51CD331307B8E3EE73139D146B242B8B46B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205322, "uuid": "01e38a3a-a0bd-4c80-b5af-3326f5b82d11", "value": "1536:/9ndVzxHKUsgNgQlcB3TRzdfv6eqjA1t3ZMqipTlDum7ps7yuY8T2bVR:xzxHKUlSTjHYZTlDum7psOuDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205322, "uuid": "88a2306e-b428-47c7-b58c-6441c6c2cbd3", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205322, "uuid": "4960b98c-fa35-4ccc-89f9-8d460c69bc5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205322, "uuid": "aedbaf84-8b48-4a9f-9c1f-8f5fe50f2a48", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2ed30-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768223267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223267, "uuid": "0c171284-14f6-4ff2-8a34-c84bcc8e1a85", "comment": "Malware payload (Formbook)", "value": "0541ebc19de5475fc4cf27d355135542", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223267, "uuid": "9ec76de0-5be7-450e-91d1-120e03871ca8", "comment": "Malware payload (Formbook)", "value": "2e804142e8ed272881c71afde47fe827887e0948f813c8c1436bfa2321cc9858", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223267, "uuid": "2fcaf923-f4d5-49db-ab09-efa70d436278", "comment": "Malware payload (Formbook)", "value": "52651e06e6a1694854d5399df9ab12b3d2ec200d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223267, "uuid": "a48a3e70-9d38-4f45-8d62-018b5acc167f", "comment": "Malware payload (Formbook)", "value": "79a2f7bfa23f815d222f8a2bc0aa1e8da2080fd425c61f1f322a5aa836deb359c90b995061fbf481835bc82bb148b2fd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223267, "uuid": "3d97dcf6-f620-4751-8117-42fb79ff72b9", "value": "T1AED231AA3BD2FC75035230637A3FB19BB23E5C887D8D8185E75558C8F638B08D57A918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223267, "uuid": "fd86297d-bf6e-4b07-b5b2-fd21bdb635b8", "value": "384:hOWIzagcgSQhzz7yKSTW/MpKLMs9rdHtlKqamMa9QR2tePY1uoSUbpTY3//sMpWm:hOWlgcaC8MsfHCSQ2tlBtY3HsM4cqag0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223267, "uuid": "517b3dc6-6ce2-47f1-9ded-65b0024581b8", "value": 30652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223267, "uuid": "2e07cc4c-7b98-4773-9b58-e31c7694fd74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223267, "uuid": "c8690daf-9901-402f-b0e6-d91ef6e0e5d2", "value": "MV GOLDEN VESSEL INFORMATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f382b087-efea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768245283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245283, "uuid": "1686e90d-0b83-415b-b137-5b7b623d32cd", "comment": "Malware payload (Mirai)", "value": "f4658ddbe4079dc333ce02eeb1d8bf21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245283, "uuid": "d94ccfa7-9774-417c-b52d-04057566e4fc", "comment": "Malware payload (Mirai)", "value": "302ec7130c37581b0c5f59c7ddceec53ef2169cb9d66711f7670c4ecf40a118b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245283, "uuid": "5277de47-7a2a-4cea-986f-f6aefdface4f", "comment": "Malware payload (Mirai)", "value": "8b6c2a908c165655570255389722306f0f9b26fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245283, "uuid": "ac6afe91-6a9f-4d0f-b91c-1d15f2499f13", "comment": "Malware payload (Mirai)", "value": "8fb8e28f392e11db42896bfb00318757aa527601dadd1a8675f9271465f4cd690d85c1018d1950b2a2a88c84e4f09c53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245283, "uuid": "58e92357-7e1e-4cbb-9cba-e0e5a73f42f9", "value": "T107A37C42BAC098FDC46AC339525FA2B6D861F81D1235365B57C0FE16BD9ED103B2E292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245283, "uuid": "36320cab-73b1-4177-9893-490d9c50d42b", "value": "1536:OosPERIKbPfTRQH1q56VyQ3jRAqOVa1vbHtPuDWxP25RjFSRQuNM:fDfFQVq5ad3dAqp1vj5jp25RpsTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768245283, "uuid": "7854de48-426c-4399-be5a-984b10e53642", "value": 97968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768245283, "uuid": "03acb539-4f60-4be2-9fdf-d41d521077c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245283, "uuid": "e1231427-f40d-424f-b12f-a3aa52438e7c", "value": "x86_64.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed280e1f-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181707, "uuid": "f07049bd-bafa-4de3-b663-5093d74e14cd", "comment": "Malware payload (Mirai)", "value": "a161175169c7c86d1d90c06bd30d8793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181707, "uuid": "b6a776d6-9fae-497b-8726-2d8946143ae8", "comment": "Malware payload (Mirai)", "value": "31e79e4194f7ce0748e0fc2d62e809076c3f543dabf5749f5a508f7559fc246f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181707, "uuid": "526b8d39-d7c3-46cc-953d-c07503cf6031", "comment": "Malware payload (Mirai)", "value": "861131fd2705e0671ba6988de4f73b8d5c875914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181707, "uuid": "7aea2061-f9d2-4345-99d3-cf5989762ecd", "comment": "Malware payload (Mirai)", "value": "bdabed6800a63d099286849507a0845a634cc03aa864b748cd7db670745ef02f16bf4ea0cadde50a324f614846099ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181707, "uuid": "cc6f8dd8-5a56-43ff-a913-8353bf55c8d7", "value": "T18573C64A6E539FECF22C82744FB39B3A6B55238633F0C184D26CDA511D6024E596FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181707, "uuid": "90f75d21-8e23-4d10-915b-a5bd33112b01", "value": "1536:IV/M3aNLC1xC1/A1mW9unmXdVzezzevIUxVNJfT+WM:IV/0aeUnmXdVzezzPUxV7fTnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181707, "uuid": "1b444fce-bad7-416d-9050-cae26a449521", "value": 80468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181707, "uuid": "4e5db5b1-193d-483b-982d-3347a0278d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181707, "uuid": "ced1323a-2856-4684-ac03-4d3271c7c607", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea555c94-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205324, "uuid": "dcff2199-4375-4fd4-92f3-8356dbf72095", "comment": "Malware payload (Mirai)", "value": "04c3d662b0b4fdc029aef1bab0044bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205324, "uuid": "e2977c81-b964-462e-8762-8514204e304e", "comment": "Malware payload (Mirai)", "value": "32071b58c5cb1255d15387a675daa3a972bd9c3470587498b3eee450fb640061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205324, "uuid": "a42cb401-9e89-4a71-8991-cf297e8c9ba7", "comment": "Malware payload (Mirai)", "value": "c8ffebdecc6f55703775636a485906acbd0cd8d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205324, "uuid": "26a09c3e-506e-4147-916b-bd2e59913b7c", "comment": "Malware payload (Mirai)", "value": "d6c7b076052286ef6c4af59c3cf1f7d87be5c95d1ac9c71d865a8d26e72c1ad325a03beea2b82f3e1a196d33df28c481", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205324, "uuid": "d7ea9943-d2d4-4fe4-8168-bcfc56cc9468", "value": "T177430761B800AC3EE86BE6B390030646B22267E54912BF377627FD53CE7D1B42C67D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205324, "uuid": "9d0f8e84-2479-4df9-9014-373c729bfdbd", "value": "1536:KEfeA/ffmtLJQZqZ8lykK02TrRmfoDkHcYQXDhWVo8o3d:KEWofOtLJQkZMykK/kAWgDYVad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205324, "uuid": "0c5cdc98-49f6-40e1-8db9-311a5178b1c0", "value": 60640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205324, "uuid": "a3357533-3be0-4a4e-ab6c-880ca0f227ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205324, "uuid": "b06f9855-6866-468b-92f0-be61dffe8d5b", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd03eb9-ef75-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768194833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194833, "uuid": "7fc2e67d-7329-4fe0-8403-6258555386ad", "comment": "Malware payload (AsyncRAT)", "value": "636a5e4e0df43d421ef5838947b6b276", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194833, "uuid": "6a34def3-8643-4313-abff-2d36368c6d6c", "comment": "Malware payload (AsyncRAT)", "value": "3269d8aef47a9ad3199de9d18b59d7c817287ec0c4a30962e9d8989b813bdf9d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194833, "uuid": "1770b28d-c2f6-4820-8a13-dcc04196ca99", "comment": "Malware payload (AsyncRAT)", "value": "df9cc0765d49e0f747308439df571cacd952121f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768194833, "uuid": "1dda6515-b709-4961-8139-31d7950e47d2", "comment": "Malware payload (AsyncRAT)", "value": "ddaa46298c6dbd25b02ce2fce5b8513c73cfcdd1a7884c8ca861fe44dad22e8d0835e88d21f62069d2f7b262096ba3ed", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194833, "uuid": "10007305-9070-470c-aff9-e20d782b48da", "value": "T17FA4F058225ACA02C8A21FF41972E3B847659FDDEA01D317CFE97DEBB53ABA44C40345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194833, "uuid": "0dc8f850-9112-49ab-bef4-e102934a59c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194833, "uuid": "03269682-3157-4506-b11f-638814dcb380", "value": "6144:YkvBWSDkRO90iQD88bzwLSQnLSPBjziRCueor/fGmHDp9gsL1UMxPrs18PZe:znITnD8ezOSQnWPJ2G0l9gsp+8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768194833, "uuid": "f01ef200-1fd1-4ba3-aa33-1a361ad64749", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768194833, "uuid": "3791e43b-a661-453b-9d71-1181a4a19cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768194833, "uuid": "4d548c91-75f6-40c8-a1af-4f8e88ad46b8", "value": "VGM - ETC 0115 _ SO#0588...................................................................................................................................................................................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772b878b-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180220, "uuid": "a3fc6259-7530-486b-8c4b-6bfe8b29abc8", "comment": "Malware payload (Mirai)", "value": "9ea5a289c2fbdd0670badb204c60c001", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180220, "uuid": "08fe2f0f-e128-4ef3-a356-e5782d9a8239", "comment": "Malware payload (Mirai)", "value": "32d686c59c7c219d2a5e5fba266d5ece3e8cb57a9de8980a77bafb61050744ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180220, "uuid": "7a126792-c075-4f54-b185-6fac32c4cbb3", "comment": "Malware payload (Mirai)", "value": "a9a07cffed409662df8b8e0e46af581a5eeab975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180220, "uuid": "1abdf10c-d8d3-4cc8-8fb5-fc2bdfd5260a", "comment": "Malware payload (Mirai)", "value": "195bf77c1f7b8837f5684d156f6bde2cf132203b0c8b15cb9ec10112c87591fb2cff6b1a837393d0b2bb34006beaf48c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180220, "uuid": "d556da1e-3ae7-4a3a-aab4-b8cf19428e2b", "value": "T1F163F68ABCC4C602C5E061B2BB0F668E372743B8E3E2B157DD1D6B59674F8670A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180220, "uuid": "a8366f88-6ebd-4cbb-b257-95b2cbd8dfe8", "value": "768:pw35X1/DaZUu/F7Jlwm+EmJVVNGNci1Wl24lFJ5TUwnvOvfVDGf9BiiHvy+TOZnK:oFWyRnXn2AvyfauYCxrw33T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180220, "uuid": "7a6b54d6-8599-4d3d-8971-17af1dbc7ff0", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180220, "uuid": "1f8a6764-f298-4fbe-ab3a-b46fd6cc2b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180220, "uuid": "ef4ff338-80cd-4c92-b4ce-773cae01a5b0", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc617cc0-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216844, "uuid": "d70ac9ea-f48d-42e9-88ab-a07f26f1f3e8", "comment": "Malware payload (Mirai)", "value": "a892dd396ea581c93ad54340a28349d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216844, "uuid": "0bcf76bd-3dda-4d0e-b97f-a39c028a3fb8", "comment": "Malware payload (Mirai)", "value": "32df0305637139bba1fb11663dcf66ef8d3fecb6bb8725b5794d5e4ab904dd7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216844, "uuid": "94356db2-da3a-4b7b-bdcc-9151cb8e5727", "comment": "Malware payload (Mirai)", "value": "378bbded8b733f4a8c52a46d2e1048cb96c87204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216844, "uuid": "ac113484-60ee-4790-b894-2f4971578c10", "comment": "Malware payload (Mirai)", "value": "05e95aab200dd43a34013eb2baac26fca00a954040299b444a2ba489499f79c46c4c0f43bd07a1c02a7f318113db6346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216844, "uuid": "411fe075-d492-47bf-815d-6883fb73165f", "value": "T1AA431681F8D2996EC6D4137AA73E358E33A1B3E0D1CB3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216844, "uuid": "eb0ce5a9-3a6f-4922-805a-3fe6fff4245d", "value": "768:vcyaknuYHAf/StW3QQoyLEFMApBV5kTCS8kTIsYcLHKIoNxitRMfgrBNNTWnD3KL:vJnbHA36AzrEFMOkZcsrLHKatR7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216844, "uuid": "a929e039-88e6-4f63-98c8-602a69a9dec8", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216844, "uuid": "37a99483-9d87-46b5-9f2e-4b0d41089101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216844, "uuid": "a890e4d3-fd3a-43d8-8464-8ace23a1f0f9", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a37874e-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768212035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212035, "uuid": "848d5f85-27c4-422f-be63-d7160130b7c2", "comment": "Malware payload (Mirai)", "value": "eb3f5628667bfee4f8fea56032853447", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212035, "uuid": "e6bc4797-0be2-49cf-9114-26217bfb36cd", "comment": "Malware payload (Mirai)", "value": "34a754f126df1607af13324f66290731d83a4e0431ff17b61ba151f2feb18f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212035, "uuid": "b436d2c1-a0ad-47b8-bedd-8a924047b78f", "comment": "Malware payload (Mirai)", "value": "37837827df75dab00a62f304a7d14400d0596887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212035, "uuid": "893a0ba4-c358-4792-988c-c093cb0e43b6", "comment": "Malware payload (Mirai)", "value": "8a03913ef2f546805c2b92a1da54a5e5a24af45a297698640abd3a7ad69a7ffc69f85afc6c5a918a899cb16d61606938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212035, "uuid": "07298a66-fb04-4729-a302-db2c9930073c", "value": "T1FF36E6317FCA4F96C2AE8E7244FF279A0B6D0901B265860787947C895E1AFEC5E0DDC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212035, "uuid": "075afabd-b4c2-41b7-9654-d8e9bba5631a", "value": "98304:hCazZxFrzPD7ToRrsjq6ZzfzzaCElzzCc1WliI:YR0AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212035, "uuid": "3c2ba3ab-b5c2-497b-bba8-30e20b64410e", "value": 4902760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212035, "uuid": "30c70efd-2cf1-473f-acad-0eb5528d3077", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212035, "uuid": "3ee33a24-72f3-412f-a315-715bc81e0e97", "value": "client.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d802616-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218778, "uuid": "3439abbd-ddc7-488b-ac22-30bd91ff9378", "comment": "Malware payload (Mirai)", "value": "de7780e6d4c76183357954c74c042352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218778, "uuid": "a6f70639-631c-4757-9733-d921a32e45cc", "comment": "Malware payload (Mirai)", "value": "34c27c1347e2910972c8c46df2717f8b03fe1b1cbd819b9b4119a6f5c71e248e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218778, "uuid": "7e8b9e80-0e78-4305-ad5e-63c196166663", "comment": "Malware payload (Mirai)", "value": "e6a2a5347e6bdadbfacc2f328e74d6a8c7375384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218778, "uuid": "52ca0037-af1b-4306-9c95-3bd532ec5373", "comment": "Malware payload (Mirai)", "value": "bb072ef202d435d3fc4def59fd34319710518ded98845922479f506e98cf7b3fb6a796952028c3ddd97dfe9af999caf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218778, "uuid": "ebcc148d-53b3-45d0-96df-13d97ec57e7a", "value": "T12EA31946F8814A21C5D512BEFA1E318E331357BCE2DE73229E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218778, "uuid": "509c6d3c-5a88-4041-95c8-d6f5284d7f85", "value": "1536:wAnOCdbU/Amks5gIQLqCqOjmKzXkGE++fNLuaoyekXpDiARi2cHHwS0Q7jt5pYWh:rbMPOjmdKcNLuaoucHHwSr3tTLy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218778, "uuid": "aa429b30-9b34-4d59-bf14-35a664bc4ca9", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218778, "uuid": "353af7b6-6b6a-4af8-bc0d-79b3b08bab41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218778, "uuid": "5a175f6d-ee2e-462d-ac8c-ed30e52ca2eb", "value": "johen.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b469375-efa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217083, "uuid": "1d3d4e39-2bfa-433d-bbbe-acb7b77e3066", "comment": "Malware payload (Mirai)", "value": "4776986f3f9b26aa92ba20d6d7605f90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217083, "uuid": "e273bd67-d13f-4ae5-83b5-60e965891a7d", "comment": "Malware payload (Mirai)", "value": "34d442d3182016ab9b0a2213d7ff21aa1294fb340a771574202995bbbba03fd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217083, "uuid": "c4b346cb-06bd-442b-8db3-1c2bff792549", "comment": "Malware payload (Mirai)", "value": "9c68077f417bbc527196b693bfc59b8b6764c1ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217083, "uuid": "92184da5-1b01-47bb-920b-9211ecea8a01", "comment": "Malware payload (Mirai)", "value": "16992efc6b8546f202ad6b806bcb776dda424f8bd3fc59ebc571161a4130bc3c5f2471a89132f1ff4c1f637215f12b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217083, "uuid": "e153b646-1c1e-4d99-9e25-f84600307d20", "value": "T12E436E41B3084A43E56B1CB0393F7BF5D3AFD99015A4B386750EEB4A8273E32154AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217083, "uuid": "dd66f8f0-ec05-4af7-846e-4bdab8585a4d", "value": "1536:QXUAodk+WuIdxan6eC5wrHz/N/l9nsT2bVRO:QXUAiNefx5EZkT2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217083, "uuid": "ddc41f1b-1e34-4be5-8ffc-c00df81f2be0", "value": 59936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217083, "uuid": "d35b6a10-4e4f-49db-b57d-b5913d08856c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217083, "uuid": "94aefd04-fb76-4299-8e58-9ebe6e889910", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba04162c-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246475, "uuid": "a6d93f51-ef92-4d4b-b79d-9a6d75c8a2c3", "comment": "Malware payload (GLOBAL)", "value": "3ef5dbd89f22afa1e37b6cedf7379223", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246475, "uuid": "dad049e7-4c28-4348-9211-16f1973a5cb5", "comment": "Malware payload (GLOBAL)", "value": "359c1e71740dd3ee3556e1c392a72b943960c4f46cf003cd4671775e71788287", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246475, "uuid": "ae71db22-fa28-49cc-94ef-3d17db09a351", "comment": "Malware payload (GLOBAL)", "value": "961dc4091f18e08a1fd1118ebded1dc809c2591c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246475, "uuid": "d9de1710-e524-417e-ab1b-51baf7de9c7d", "comment": "Malware payload (GLOBAL)", "value": "dab8aa0b35b466ca4ae00b520123cb056a0fc0800ec8799cf165b30739617f592b04326cd85e8dbcfa45e02182e6660e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246475, "uuid": "79b35f89-1577-47ee-92d9-d60522b94714", "value": "T167347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246475, "uuid": "e19643fb-173b-4b62-b956-9119fe64b6e8", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246475, "uuid": "4b7358fe-84b0-4041-ae3a-6d3adb90090b", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246475, "uuid": "454b3d1b-5d21-4ad3-8b77-af1e06330bf5", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246475, "uuid": "0f13c1dc-469a-445e-b0c7-d018f8b2b05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246475, "uuid": "75a9098e-7c28-46b0-8489-3d26c16c02b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296c0bc8-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181378, "uuid": "fedcbde6-38b9-4561-8a06-d7d6c82f42e9", "comment": "Malware payload (Mirai)", "value": "875b36e80a7ea972c80189e3ecf49d78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181378, "uuid": "4710a921-cba4-44b6-8aca-4a9709530166", "comment": "Malware payload (Mirai)", "value": "35ce82f7b6ec7af31b60bfec54daf7307fe963b36dc26e3c349cd4b6eb60bc18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181378, "uuid": "2d86bd28-d28d-40ec-a443-f3b92612f2de", "comment": "Malware payload (Mirai)", "value": "ef8c5dbcadbfd39e6c3620a3f0843d19095cf6e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181378, "uuid": "dd210730-8dfe-4184-9c53-081d8c294024", "comment": "Malware payload (Mirai)", "value": "356363332c55ea2e91177ad4499e4108047dc45e85bd641a35a97abfc2387b507e67670d2dbb2434ce59e39542c8aeb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181378, "uuid": "4ca5225b-0d6a-44d6-ba77-f36ef20f5afa", "value": "T15C833A52B000DC7EF85BE3B390570B05B62477E55F522B27BA22FD6BDA2C0A85C1AD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181378, "uuid": "7d481060-6d47-4eff-910e-b2b77872e788", "value": "1536:PgaDAsGft4kuNJjOTZxXZDm2XhrV1J7Aa1FDIyCMRflthkPZg+J+Jyk8Gt48jDS3:PgMfG14pJjIZhZDmyb0mFjfXob+sk8Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181378, "uuid": "77ca09fe-1add-4f9d-a0c0-e3fe0dc1ddae", "value": 86340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181378, "uuid": "fad492f8-5da1-4a5d-a11e-a21f80b4f271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181378, "uuid": "f7fcfa59-4231-4ffe-b8df-e4c4a7caad27", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5acb99-efc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768229242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229242, "uuid": "c05e2871-ddaf-4bb2-966f-c73ec0e8b271", "comment": "Malware payload", "value": "c94c99e5c804ef86c933002b438e4d10", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229242, "uuid": "bbc1c3cb-af8b-4657-b11f-231ad8d5fee1", "comment": "Malware payload", "value": "35dac56b3e8db51d5e08ed37ab76117abcd7ecd02a8e021a55ff96192caf021e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229242, "uuid": "ba948fe2-7d14-4134-997e-91195b612232", "comment": "Malware payload", "value": "a913101e661f6e96b799e78be460119e9f9533cf", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229242, "uuid": "7b8b8f76-5d5c-486a-bed1-73e380299bfb", "comment": "Malware payload", "value": "3359fce262e9f2a0225b18c093edd09f5ce87d3e4f63afd1e94671eeaff27f6f8c1bee6b2bda098e55c9e10e887bc417", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229242, "uuid": "6760aeae-b83b-4228-b6c6-2e3555e4d854", "value": "T130E633D7B4C862E4D0C78A70E38F63CDA5F1B1264AA7A61D37CB1D026630D974686E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229242, "uuid": "d70ca53c-550c-49bd-a799-9de45887c7a1", "value": "c6e890f2bf1c766e673a9f6fba99f26a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229242, "uuid": "81e39f11-97a9-4a4e-a84a-ab90a64f5f4b", "value": "196608:w8ezmn4YDno26kViHu6dNB2fgetVF47YtyZQmlQ5CtTyDRJhDq:SQ6ksNB85elvebh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229242, "uuid": "def9995e-5b37-4fd8-9587-2a8a26d26620", "value": 14162944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229242, "uuid": "39325b4a-3204-4662-a302-d15a31ced67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229242, "uuid": "bca094d2-4e48-40a9-9309-358687d5b62a", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b612aad2-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223276, "uuid": "58f3b80c-d7c9-435f-8820-afc3ebb2df79", "comment": "Malware payload (Mirai)", "value": "3a7a8bd21d3821c3bd7e38cc1460764c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223276, "uuid": "ac5e9bef-8445-4992-9bfd-a76dd2c96ed0", "comment": "Malware payload (Mirai)", "value": "3741eb9ad250cb5c79325ccb0742381a4bd499dea51cc6a1ef256c68a338b60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223276, "uuid": "bbe1cb72-716b-4514-8b43-074abc25bbf7", "comment": "Malware payload (Mirai)", "value": "0fcbcca08968e345de2a34fd8699d42606fecce5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223276, "uuid": "a109b5ae-7621-4b00-8a5d-17707ff4c689", "comment": "Malware payload (Mirai)", "value": "2eda98ee671c0937736b4b818d267002a38bbf3fe84e4f3f521715675581fa9b10d6a4d15636537f53b2ae941966e250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223276, "uuid": "d7d4f305-1101-4221-ab52-1574ca66cbf8", "value": "T1C2634A11ED392927C4D0727A55E34530F9B6439D1ABCAA4F7EA32D5CDE14220313EAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223276, "uuid": "5534867b-5c43-4cac-aa1e-fe6eebfea7f8", "value": "768:Feo4pqEBFXEG1fMjbLbF+AeoNn/0leT4P2bH05e8vO+4NNzKW:FehBXEcfqZ+AeoNn/0l9W05e8TQz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223276, "uuid": "ceebec19-2646-4569-8254-d3fcad40f7e6", "value": 68692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223276, "uuid": "4577ea3e-e1fb-4091-8ede-6d26ee6c749a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223276, "uuid": "e3203785-776a-4b04-96b0-b086ee752da7", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff44322e-ef4e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768178301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178301, "uuid": "ed308c84-fb18-4b92-b13d-6a875f755b3a", "comment": "Malware payload (Mirai)", "value": "2c77a56a1b14137e8946ea22d86a1bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178301, "uuid": "1fc76f4a-88a7-4552-9cab-90937fae56ac", "comment": "Malware payload (Mirai)", "value": "3798a995921ff89ef02c826411a19b54fdaaee42d03a55ea399a0347170a9da8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178301, "uuid": "c1b6abab-a120-4587-948d-ccb38a285bf0", "comment": "Malware payload (Mirai)", "value": "8a010cb9fc34069caeea3a2b5e4bd3e2333c8e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178301, "uuid": "fc32c2c2-3139-4a31-b5ab-a191583cf0f0", "comment": "Malware payload (Mirai)", "value": "71bd3b270b1c48678efbe310dae46a47557e98e54d1ef351f42680c59e19ede116d4a54ed73547e84fcda65fd34aa1c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178301, "uuid": "facdaf9d-c6b2-40f1-9c03-340295da3244", "value": "T1958302F71B4128C1E9FCAFB98A5CDA07BE7E365F0358961795416E4F05184F43A00ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178301, "uuid": "7fe9171b-874b-4858-8cac-8699877b8548", "value": "1536:oTw62pb1oalO6MHDUbxFnP2K6E55ABDTrPV4QnB+suQAVdLJJFrq3jv6zULO1cQw:aw6ooaQ6QDUDVaXPWQnB+suQaJJY3eYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768178301, "uuid": "8a910fee-5db7-4bb2-9c08-7f43c0bad33e", "value": 84804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768178301, "uuid": "510d1d92-7f9a-4439-9be8-759235cf125e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178301, "uuid": "719ce585-6c65-4bd2-a21c-95b12cc130e3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f4b581-efef-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1768247331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247331, "uuid": "056dbf43-1ec1-4750-9344-a10de5e75b3c", "comment": "Malware payload (Phorpiex)", "value": "aa4d80d7be6252f4d9bb8aa979c51f09", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247331, "uuid": "450bb16a-b35a-4722-ab0b-9202446f00ee", "comment": "Malware payload (Phorpiex)", "value": "37b08b5131a17565009d980f1b3c2a6879383040528d73d34e149f8078282ab9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247331, "uuid": "19858085-0d9a-4906-9c4b-034707ca0306", "comment": "Malware payload (Phorpiex)", "value": "f61657df664517a918b7e53a94b842e2631478c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247331, "uuid": "33b48f1d-3075-4d09-8b2f-51495b950180", "comment": "Malware payload (Phorpiex)", "value": "ce18c2702b3feb1fcb9dc59e8e64ff498bf96b46f60dcc34bf957eb4225f1422fd22fa59ccf9ef13b05d0914de6eedfe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247331, "uuid": "3450179d-ea5a-4c8a-bb42-08ee765d6ce1", "value": "T1ABB37D2034C1C432F567117988AAC7B58A2DF8310F75A6DBBFC416AE4F266D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247331, "uuid": "a72786be-83c0-428f-a349-27f86fd1d00b", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247331, "uuid": "5ffc8172-045b-4190-ad35-db9b65ed217e", "value": "1536:E28yYMm4dgVCUyGzmDGl/Qe0LsulMkSpEYdvSeE15XKp:X8yZmX7kGlIVLrl4hSeE15XKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768247331, "uuid": "4f1d36d0-692e-4227-91df-9dc819d00400", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768247331, "uuid": "2aaa4ab5-2b00-4440-b7fe-831f4a775e08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247331, "uuid": "0a12758e-2870-44f4-a303-6f2f2dc689bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec51d6-efcb-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1768231642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231642, "uuid": "788d8f88-b3bd-453e-91bc-28081e2fa717", "comment": "Malware payload (SVCStealer)", "value": "356c2b9cf962121414026d2b789e1d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231642, "uuid": "c06e0b80-7c0c-4867-a8a3-3c8f7cddb5a9", "comment": "Malware payload (SVCStealer)", "value": "37c4bb2cb69ad8eb8242b748763dac36e5eba7d4140e53c795e3232932c5350d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231642, "uuid": "f1e602c8-7e18-4c02-9342-6a7f9e42f120", "comment": "Malware payload (SVCStealer)", "value": "cc3df3bca4177e6cd5721bb282dd3ee27eadb766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231642, "uuid": "d4d0dba8-b3c9-40bd-9a33-b38526897dc9", "comment": "Malware payload (SVCStealer)", "value": "3540936af5d71466e9e444cd8501dfe6397b9c15ff364de5e766cfa079b68dd407fe13b40f2940ff9258b30ea6feb66f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231642, "uuid": "62fbabcc-7aa4-46cb-85b0-7fe490b7b3d0", "value": "T1C996339953F40CEAE877693F19A56153D3B1F4250B91C4CF0BA4832A2F9B2FA2C39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231642, "uuid": "6c0dfe82-ef3e-4999-a897-dc8e9893a7e9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231642, "uuid": "fc42a2b4-60e5-42ef-8e63-de164981db04", "value": "196608:9oActbW897GXPHMe81SF2RPUewq97BtKZ2sHsMRqubRgFtDU:9Vc1wPsZg2KezxK4sHsMRqubYtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231642, "uuid": "86c72d0f-5ff3-4993-b487-93f37c5ed4fe", "value": 9384197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231642, "uuid": "ad5be6df-d883-4090-981b-21bade17fbe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231642, "uuid": "2a72ba91-62b6-4901-8aea-d6baffa6f71f", "value": "zx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74122d5-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230579, "uuid": "9824d97e-b1d2-4b2b-81b8-cf5d77119be8", "comment": "Malware payload (Mirai)", "value": "6c5f160afdd9fd7fd30998ac51f5fe77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230579, "uuid": "45601ac2-0f8c-4bd8-a8e2-1b77e050af86", "comment": "Malware payload (Mirai)", "value": "38116574eb4cb6dd1c1e82bf8100544a11b96b8f9ac33478ff36339b6abb0dca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230579, "uuid": "e1f6b935-c849-48ca-ac90-af1cf9ada95a", "comment": "Malware payload (Mirai)", "value": "42a526ad8dcbc39c3ebc0d54ecac0a18ad645056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230579, "uuid": "d6ca25d2-d772-42d0-b7db-99db2ba266a5", "comment": "Malware payload (Mirai)", "value": "79d080b2fef7605cf024b8ebf16617b63b8dfc890d45863f06d28e2411aaa77fc1c6f25c9b9ef478165f7bed13c63a7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230579, "uuid": "f90d2dfd-8ae1-44d2-9e63-b1ab1dffa22b", "value": "T181143A26EDA0C0AAD097D17867EBC1B2F730F8F40321765F33A56A352E75E509B19386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230579, "uuid": "9320b667-ded7-43f7-a6b2-bf86869b398b", "value": "3072:yLTqvVlJUZubmhqsG4UiSQluJwj0u21bOuPTNq38wlnoAw7bJ:CTcVLUtWi7ee21bb/8y7bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230579, "uuid": "01e856c0-9a0e-4945-9d6c-92e77623efc2", "value": 196280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230579, "uuid": "3aacf462-48d5-451f-8216-8a0ad11d5921", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230579, "uuid": "4830b4ef-d3f6-470a-a7dc-af4451d61c1f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06d9c23-efea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768245278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245278, "uuid": "c52c9910-cffd-40de-a623-33448023d415", "comment": "Malware payload (Mirai)", "value": "dc47e38fcba05e7beac383e20ac2a68e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245278, "uuid": "2d9fe8a8-a44b-46e6-b257-d3f9de95d684", "comment": "Malware payload (Mirai)", "value": "3940dd50459f1e8de7bb110523773440370ced69ce45c5c8dc72171cfea013d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245278, "uuid": "3b4e30bf-e27c-473c-bb30-033458234105", "comment": "Malware payload (Mirai)", "value": "4bd303ce93abe4af4787b30d6bb6ba821fe9abfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245278, "uuid": "1c03078b-6a0c-46a7-9287-5f5f755e03f6", "comment": "Malware payload (Mirai)", "value": "4416a04d894aa8ff6acdba4967992af48731b874f789b2388b5702c38e74d4beebf1fe9c45e7e7dd47c86745a553a901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245278, "uuid": "dc8bd566-cc15-4e4d-8da0-7bf5728a230f", "value": "T1E4C44A55F8809F62CAC42975F79D869C33174B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245278, "uuid": "f447a973-6c9a-4175-806d-cb425c93caa5", "value": "12288:TQMWwOkyS0XFQAO85OUS1QCk/Z7EgpZ/m6C:tIkgQPUKyXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768245278, "uuid": "914bd4ea-485f-450b-aaa2-e63488ff952f", "value": 570648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768245278, "uuid": "edccfe87-d595-4835-9a2a-82878369d523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245278, "uuid": "c7e20ff3-5693-4c44-b1a9-9c46bb1a96e5", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508c7b3d-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217522, "uuid": "8d37c663-1cd5-4950-871f-50019051f2f2", "comment": "Malware payload (Mirai)", "value": "816c3418a355e2a6e511ba6b303d293f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217522, "uuid": "33ae2345-2d80-417f-aa4f-59f4e8e81aec", "comment": "Malware payload (Mirai)", "value": "3a75e8195cdc005ab6dac03d4c8b99ab6fe1b2c94cb2f93af248e957117e6349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217522, "uuid": "901cee91-238d-4a29-a3ec-e2bfeac6c58b", "comment": "Malware payload (Mirai)", "value": "3d345774bc84b30997b7e79954d87e1c8d3dd121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217522, "uuid": "f4900a06-772d-4854-a6b7-651dd440f15a", "comment": "Malware payload (Mirai)", "value": "346e8052cc5233f36407387505b2da8c4c68c3b6193154f9d9826edd1dbf65e9e28e4923eeb9e004f57904e86185b9fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217522, "uuid": "02e14e69-ea81-4e6d-851c-cbf7d8a90482", "value": "T1534302F38182B2539D204837D7FF9A4F73690F6EE3276952691063C4FEB7046AD82469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217522, "uuid": "3321f5a0-d6b4-469b-99b5-20f07ce8f8cd", "value": "1536:wM6sydIX2EHSs15IpGsW0eJUA/1zzkufHki/Hd:7/yds26BsHe6m1zzvv/Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217522, "uuid": "9d623a4d-55fa-4a78-9af7-3b3697c876e0", "value": 59528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217522, "uuid": "dd11f52f-93d3-4588-944c-b476ad38fd7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217522, "uuid": "38fcf283-b821-4331-8355-0417efc54019", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a801946-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226182, "uuid": "c8a52076-d001-451b-a4f7-5d399718bf46", "comment": "Malware payload (Mirai)", "value": "77db342673cf83e821b8664429ed5985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226182, "uuid": "b2df08d1-fae1-478d-9f86-d895c76bd39b", "comment": "Malware payload (Mirai)", "value": "3afebd82b9db2502696ef58094e2119f31b07a8faf76d501d803dcb61e3c467d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226182, "uuid": "07adc249-f56f-4d29-845f-41061c562df3", "comment": "Malware payload (Mirai)", "value": "903d12f85d93874885ad0ac4b6cc0004ad5eda10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226182, "uuid": "7cb6b166-bc76-489c-a20c-1a11016f4ccd", "comment": "Malware payload (Mirai)", "value": "2937aee20ec8b37b3f16c9cfeb468cf896c89ed8bfe92447cecf94c74a3e97fbbd258ec9ca8c0f76b1512d5d75b79f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226182, "uuid": "1e6fe316-338e-4513-8f39-11199c8a5133", "value": "T13E631902336A4047F3E71EB2282FBBF157EED5A131A0A185595EDB4F8174E321586FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226182, "uuid": "6bb1b074-bf95-41e9-a139-554d919f4952", "value": "1536:/MdRpHJObF6hdaYGkrLYIHiv2tHjmFoOi1S/TECTW:yOB6hpfjmFiS/5TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226182, "uuid": "954d23ad-776a-4a04-ba00-537af87042d8", "value": 67344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226182, "uuid": "3ae364f9-7af0-45a2-9560-a6ed434c1ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226182, "uuid": "a06b15eb-ab0c-4235-bf2b-b203b0bd2a87", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6806b6-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179723, "uuid": "44e43be5-8444-4d68-b853-caa09c2f64b2", "comment": "Malware payload (Mirai)", "value": "a71247a3657f6364c73d63ab81bcaec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179723, "uuid": "0b56c143-374b-455a-8110-43a37120ba51", "comment": "Malware payload (Mirai)", "value": "3b178a908aa0ca51aaea4e3ed75e3867f74ac1661638db37d89cd21112c15ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179723, "uuid": "dcda5f86-da06-4b56-a5ac-6e785dc1875b", "comment": "Malware payload (Mirai)", "value": "fd2efcbf7ae21360a8e116bdd75731fc1f089950", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179723, "uuid": "fd00f543-2df1-4e12-a2dd-37e57885be76", "comment": "Malware payload (Mirai)", "value": "ba2e97bec3623055a969ea34baa89b0895c8f1b174ba2086a93c920533480593a60aef8657f7fcd2c4c8b2685942568f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179723, "uuid": "50835cca-a2f4-44fb-a359-5faa0969f60e", "value": "T1D534095DF880D77ACBC0217AFA5602CD33735F64EBEE320589356B383BD6A15993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179723, "uuid": "56b23b37-10f7-4e16-b881-b04ee93b8c67", "value": "6144:3j5AMybHx+kNjFQ6N0etDmzh3A9VHWcp+B9TuwIXy40BLDW+KfS37+k5dik:lAy3A9VHiu9+LDj46dik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179723, "uuid": "4aea92bf-5479-4354-b8fc-8cba313fd348", "value": 248600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179723, "uuid": "7d9ac512-3791-4061-98c1-8f9ef363aae8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179723, "uuid": "19550a45-f07d-4ed0-af53-63a4c353d843", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb79831-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246458, "uuid": "9be8cbcb-c986-433c-960c-7d1727094898", "comment": "Malware payload (GLOBAL)", "value": "726c74c33b1cc20110540dc9cb88189d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246458, "uuid": "ac16418f-5cae-4b92-8390-167c7cfd121a", "comment": "Malware payload (GLOBAL)", "value": "3be21ac37d8c817b71ea520d2f4354f0c606fca4cc6a48742b2de87f358af79c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246458, "uuid": "d0c5ef2b-3828-47f1-befd-d028481b6ad8", "comment": "Malware payload (GLOBAL)", "value": "b396989d743a580b85d6900de97aa35728d6651f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246458, "uuid": "b0019064-89f9-44e4-b591-85f92e00f72c", "comment": "Malware payload (GLOBAL)", "value": "aecb609fedbb79f051b1b9ca2d2e26256010e9196a29c0ccce09f6d696b070e0c888cb63df3da3868911318494dfbdf5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246458, "uuid": "ddda9735-9338-4ee3-ac0c-8e3ee289c7e6", "value": "T1A6347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246458, "uuid": "7e49c848-1ee4-4e9c-9fe4-944593f2bcf1", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246458, "uuid": "c3dec602-004c-4f7d-85d0-f548d791d8a9", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246458, "uuid": "e329cc05-143e-4d1a-8e43-f7b6c21430a1", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246458, "uuid": "10bb0aba-3413-4220-88ee-9e0d86683ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246458, "uuid": "17d684ec-2ff8-4238-9b31-28d5862a2e71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4069e6bf-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182276, "uuid": "e712bc11-6182-42d5-a486-a51a43d447eb", "comment": "Malware payload (Mirai)", "value": "d954f3ec0087dd779f10ed0c47fdaa1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182276, "uuid": "1d2fe265-5178-431e-9b2b-88a52cc5cff2", "comment": "Malware payload (Mirai)", "value": "3beed3b5cf886e76d36458311c19e69f56f50830eb48f57e0b0282eb6f47bff7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182276, "uuid": "44415aad-b1e7-4f77-ac1d-0db1c4a0268f", "comment": "Malware payload (Mirai)", "value": "cfc6afab59d6d78a6fc5cc0ec5b35b835fa14b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182276, "uuid": "76fa547d-dc0d-42a2-bd59-48db4de41062", "comment": "Malware payload (Mirai)", "value": "b180b85ff457ff31a4e68ab58ffaf968e5799d361ad3a15e97766f2995bd3f738a9c4d2e4eb11b1872afa0e4afc58cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182276, "uuid": "3c189503-b510-4a98-9ef7-89c9b1327a66", "value": "T138531A85B991C617CAC4627BFF4E42DD371643A8D2EE73039918AF25378B82B0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182276, "uuid": "ac8f3ec6-09c5-4848-9908-2e34c706efc9", "value": "768:R08LRngsmWjewucHcJX1pyjUftF6z+dxfOaaT3SEXAGEhlctr1AvvlT2bVR:t2TW6JX1pyAFFu+TOa8i7GOvvlT2bVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182276, "uuid": "0b49491b-ba3e-4d8c-b16a-0567880ddb49", "value": 62676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182276, "uuid": "6817e2a5-d669-4ff7-b4b1-08431049841b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182276, "uuid": "cd8b7411-0d88-4993-9fbf-14414acc3ab8", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecfc45f-ef5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184850, "uuid": "fb317b72-31a6-44e6-9902-757488a63b37", "comment": "Malware payload (Mirai)", "value": "6afe59ca9594d1189b537ff009ba649c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184850, "uuid": "887187da-66e1-4e35-8826-fd6cc2efac20", "comment": "Malware payload (Mirai)", "value": "3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184850, "uuid": "51344734-e905-4c63-9627-de0224413274", "comment": "Malware payload (Mirai)", "value": "5f39f577b5561a7a489734f7960ec462bafd3b96", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184850, "uuid": "35f21bc6-49dd-4e4f-9366-dedb9a3427c6", "comment": "Malware payload (Mirai)", "value": "235f76edf661687f7faa0804823f1a864e0a5874ff882774e066902df73c36e7845ebe159604cfb256548636c25b25b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184850, "uuid": "1cba52fd-a63c-40d7-b457-ce6fa8d58bde", "value": "T1F231C7CF063F39154EC7CF1B73E107CA5189A3E1E097DBF59808192668C5888749CEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184850, "uuid": "c8c1d07b-4448-4ced-884b-7ab5d9f97ae7", "value": "24:A5Xf+h+NhJWd5Xf+w+o1jJQpr5rta8Y/TiTCrjTdzTdtz8PSAAAiGOWsDxeG5GcE:AVThJWdVjNJOyrNjAiGOWy48Tk78GQn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184850, "uuid": "cd42af49-a719-4664-b2da-eb77905d36fe", "value": 1602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184850, "uuid": "02be9f68-7388-40cb-89ac-43bf879ae203", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184850, "uuid": "1556f24f-16b5-4c77-a9c0-d581a595334e", "value": "nigger.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468c6280-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224807, "uuid": "b34fc00b-2ce6-46b7-9630-f831fc2dd25c", "comment": "Malware payload (Mirai)", "value": "8f5b2f4d28a46fa8d17d991a70c5b756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224807, "uuid": "c6675ad2-02b3-47f7-94cd-a51c0782551d", "comment": "Malware payload (Mirai)", "value": "3c61f2536826f8eaa27895cbb59f9ce238e623add809897f9cae948d235a7a25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224807, "uuid": "e79d0fd6-212a-4c0a-bfeb-962459e40fd3", "comment": "Malware payload (Mirai)", "value": "0b8ae52e0ddeb35abcf90dfc720a08c63a178b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224807, "uuid": "83274b4f-c0e8-4367-907d-28b32e3814dd", "comment": "Malware payload (Mirai)", "value": "9108da2e1ce69ab9d2f55b52fffa83a2996e1bfdf057ee9939290f14a3fb9bc446dd29cc26701e0ab9006d9fbbabaf60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224807, "uuid": "4e2a5b70-683c-4682-8a76-402753b553f2", "value": "T15EC3C64A6E529F6DF32C82354FB38B3AA745239633E0C586E26CED011D6034E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224807, "uuid": "b3978695-10d9-478e-972b-0d5937d97909", "value": "1536:EJz+b+wzfFzf0EfTbp6eCMEu05hkufpqrMRcSeTauI97nKdcI1T2bVRJU:E8blplVEH5hkufpEMRcS9uI9Id1T2hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224807, "uuid": "20f0888b-48ab-4c65-b631-aa6c57d35de4", "value": 121652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224807, "uuid": "7cacc7ef-9e56-4266-bfbc-8c25b107eec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224807, "uuid": "4760428a-ba92-4b66-baab-b39275804b2b", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc89f53-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216739, "uuid": "c8c7b981-c7ad-4976-9d4c-a977047b20bd", "comment": "Malware payload (Mirai)", "value": "33eb8c9f0a232d70c8eedcdac5d932b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216739, "uuid": "89244c85-c58e-45d3-9e47-1d43d8d5a6b0", "comment": "Malware payload (Mirai)", "value": "3cf072e8e36a2a49b1bc3dcf6fc1564fb72792af672906010282a19d3e118af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216739, "uuid": "7e1915b4-ccb1-4933-a970-66cee26ab485", "comment": "Malware payload (Mirai)", "value": "c4679859a9b853559695156bc07357593061ea5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216739, "uuid": "8a871b87-8283-40f4-a37d-5150e3b88e10", "comment": "Malware payload (Mirai)", "value": "bf83e00ccafd3c190e97cb5f44ade8e901c0abfaa82e05c9f0ee9c70c6bd58cccdaaf546c1c2da1291632ada3c3e52f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216739, "uuid": "ca47f982-a9a2-49d3-8b74-1feff7a64592", "value": "T1DC03F179F0D8FEE6CFC799962884CBD157F097921779EE68CE65EB0309766062400E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216739, "uuid": "eeb5d886-ac2a-449a-a7ab-15a94c613fc8", "value": "768:qRJZXpTEE6aunvaILVc6RTfGJMezfdtd2ck4W74uVcqgw09n:q7XpIEMnvaiVc6LAvfdn2ck4W74u+qgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216739, "uuid": "dca6fa29-7093-4e7d-b7a6-e39a2cfd6417", "value": 40116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216739, "uuid": "11e51928-b1d6-4940-92fc-968699f4cbe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216739, "uuid": "b3f67aa4-d940-4082-bfeb-b113d9247d7d", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dee919-efe2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768241717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241717, "uuid": "2967d57f-8303-4f68-bfb2-f6422eb4d06f", "comment": "Malware payload (Mirai)", "value": "a94b86d70ff8561f22045ffa4844634e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241717, "uuid": "c2e6ec41-b4fc-4bdf-a25e-5e1f4a47c3fb", "comment": "Malware payload (Mirai)", "value": "3d4593590fbef78f4c431a8e1fb2b51e85bda3ae3352f221a3b9de3472e74fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241717, "uuid": "ebbce852-9c75-4841-a59a-dc9744fc49eb", "comment": "Malware payload (Mirai)", "value": "09f00944f40a99b01218865626ae99ce945a11af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241717, "uuid": "c44171ee-4c44-438a-9637-c38d8f403482", "comment": "Malware payload (Mirai)", "value": "be66e983bf80c0256b0ff77ead1346c5214dfae7354fd60f9bac8a2f8903071639d7df74faa9c9a5bbce4efaaee05829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241717, "uuid": "9ac43840-f6fc-4c37-8bf8-4c61b53bdab8", "value": "T1C4D33A56FD819F11D5C721BAFA9E414933136FB8D3FA7112CD206F61238A99B0F7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241717, "uuid": "1613e635-2798-4032-90f6-504e0bed2bcf", "value": "3072:7ZyezWeKKtcbW7jLbCDuaigpZhbfWNBVS1r/z5/BZB+:7ZyC/KKtcAbGuaigpZhbfiBVqzhBZB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768241717, "uuid": "38057edc-281b-4843-ac72-48dfebd02065", "value": 136448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768241717, "uuid": "6c6ea9c0-c5a3-42ac-b89a-41023c07afe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241717, "uuid": "2cb07f1b-e3b4-4449-832f-b75a93f60ded", "value": "arm7.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025881f2-ef92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768207083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207083, "uuid": "4b5a834d-7682-45ef-8c93-d50d38ff301d", "comment": "Malware payload (Mirai)", "value": "76c7679284d500f486ef41ec6a16130f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207083, "uuid": "5acaab0e-a573-4330-b12a-a6ed4dfe5548", "comment": "Malware payload (Mirai)", "value": "3db888a78eb8e5a0dc06486a2a042f92f20e996337e500c6d80f70445a9b95f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207083, "uuid": "8ed71e32-5fb8-44af-8a6a-9c857cb9a9be", "comment": "Malware payload (Mirai)", "value": "774a1258143d1c65d2b4564cf6463e79d976bd69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207083, "uuid": "2850bb57-e1b2-4e52-8ad2-8adc6c2908f3", "comment": "Malware payload (Mirai)", "value": "f0b8772cf9d7721b19defb0b188e72d6f3b37e9cbbc96cafd96dd382318d13910363bb9c78659211cc5fd75964aa5528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207083, "uuid": "ccf6d3ec-4f16-404d-bb66-e384aabb1b34", "value": "T136932A537400DD7EF85FE2B382570A05B124B7E54F026F27BA26FE63EA6D0A41C1AD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207083, "uuid": "2814dcf2-f663-4203-9bcf-9b985d8c8f4e", "value": "1536:3Fw2rA+Di8H2fiaCab4IcZc1JmPwZM9n5C7xXAv3eYD+GHrgTiSEwyR+GRE2NfOr:3FVrLDi8WaaCab4IcZc1JmoZkn5C7mYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207083, "uuid": "10127717-c0ef-49d9-b5a3-bfcfc93dc5d5", "value": 91384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207083, "uuid": "ae383304-2650-4890-894f-98cacf12713d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207083, "uuid": "a63c1adc-654e-4fa7-be93-cfa7bbe13072", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f903dd59-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1768237561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237561, "uuid": "7ab09792-7cc5-451b-984f-4d7caf970c36", "comment": "Malware payload (GenesisStealer)", "value": "dfd74818d0ece0e51ba8194853ed61e6", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237561, "uuid": "1b620d5c-b377-4951-9f89-eef35b2d329e", "comment": "Malware payload (GenesisStealer)", "value": "3e16b2e37f2b9ef39315cffb5ee2b9ffe077e8b00f87fa3d715d4ca11331a009", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237561, "uuid": "0b9d75b4-b0eb-427b-889f-7a0e54acc7b8", "comment": "Malware payload (GenesisStealer)", "value": "a71f6d3cbd429aabdf648d934c4f2bbb655ab772", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237561, "uuid": "8c48733f-34da-45e6-819e-7f5c69bf8f57", "comment": "Malware payload (GenesisStealer)", "value": "91f30acd6e4cb8bf472f250b70a4c10ae714c34ec1760e41f9bc6f72c616e5839658017e2aba4027a1c19576f62a9d74", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237561, "uuid": "2dd003c4-5051-43d1-b41c-aed2014411ad", "value": "T177E4D0713A55091AA4B6F329642ECDCBEAF13FC0D04424B25D62EB0706EE6E86DC375D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237561, "uuid": "38fc5888-b7c0-471b-861e-b7916c0cdcd3", "value": "12288:tc0Ru/y05BzNmMKTF2WPn4/X7npA0fMihuC54TJVTVrx2QSdwTZ:qbHTYMKTF2X7niWMih2JVhwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237561, "uuid": "337fa8b3-faa9-4c90-9f8a-da26c0083b74", "value": 673858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237561, "uuid": "db2bee8f-86e6-45e8-aa16-64415b31daf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237561, "uuid": "dc83a8ab-5389-4070-b0ad-15f121eaad44", "value": "f5d11f125ac19567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790e42ae-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226180, "uuid": "c133322f-6d5a-4ca7-828b-8c71404289c5", "comment": "Malware payload (Mirai)", "value": "7ebf9ad46e4000d2906f5e26bad60fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226180, "uuid": "ff65c3c8-bfda-476e-8d03-e428612f8638", "comment": "Malware payload (Mirai)", "value": "3e19e68b636d8a87d32733a92ed722897a1d829365a8f00fab80c056c6c25292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226180, "uuid": "15da04ad-1886-4d4d-a309-3d2594ee1227", "comment": "Malware payload (Mirai)", "value": "4d5df39a02c2bd3a43ff760772c6d075ba752b60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226180, "uuid": "faa0e341-c5f0-4b41-bb96-9890c053914d", "comment": "Malware payload (Mirai)", "value": "d0e88ea85dd05b1071bc9c3ea37f868644a1ee48367670e94473ca696038d21059c38d42946a59625eeed7f0a65dcaf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226180, "uuid": "4aed85e5-e737-4892-9c7f-d83404b628d0", "value": "T1EB931986BC85C612C6E061B6FB0F51DE375643B8E3E6B203DD18AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226180, "uuid": "649581be-d2ba-41b4-9159-4c8e6796e47b", "value": "1536:GQHd3YtOzX7qCpAxs432cM43Q+HUN4SZlSmvETAbVR:GQHlSYjpuGcnQ+44SacETA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226180, "uuid": "1f75c01a-5bd4-44ce-961d-e100634d71b1", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226180, "uuid": "ff1a4cf4-eeb1-44fa-8799-4b9c82ae2445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226180, "uuid": "9f1a58fb-7d6a-441a-ab9d-0dba1b080064", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2260fe4-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1768237523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237523, "uuid": "05c2f31d-b91b-4f3e-8e03-43d7fac59600", "comment": "Malware payload (GenesisStealer)", "value": "a256398d74edd1b9e548f1fca85ee70b", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237523, "uuid": "f77ff03a-0725-496f-b72c-2ed6a31c8042", "comment": "Malware payload (GenesisStealer)", "value": "3e4523bd0a03ed2788337bc7b715f9d3a1ad99a1f882f8c74d6699dc210751b9", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237523, "uuid": "8a86dab3-2eed-45ef-b7da-f17f2fc553a0", "comment": "Malware payload (GenesisStealer)", "value": "86b16453e66153e68bb37a0c5b30d0f80dd51b80", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237523, "uuid": "33d81c3c-2949-4d49-a1c7-6b34fd481128", "comment": "Malware payload (GenesisStealer)", "value": "270b717ad3615e3faccaca044911b62424df8567dce85b566de69366f32e9d9dd4c58969955070334cd7d80dfc7cab28", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237523, "uuid": "c2b9abae-952e-4756-ade4-0aa016e3066d", "value": "T169E4025A6B193DA365F9D27D32F601CF8BA84C91170F54B8FF21EEDA589E190901322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237523, "uuid": "6420eeb0-edce-46d3-b1e2-e6259603563d", "value": "12288:6F4F1/5KhRHtH86+rJIGNosyT15Ah7wYwYXqXwZk6ML6aQIZ14d7GBJ:7F1EhRZo2GKsyT15qQY6A/U6aQIZ1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237523, "uuid": "8d0e7679-2a84-4e59-928e-d57ddd057d77", "value": 681927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237523, "uuid": "290623d8-69f7-49f0-993b-42385d06370c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237523, "uuid": "8a9fee16-7bf3-456f-9400-5f36720b2e34", "value": "1aabdcc0c7ea6e97.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd22034-efd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768237704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237704, "uuid": "239edb34-0b9e-4191-bb87-8ce0bf06ee5d", "comment": "Malware payload (Mirai)", "value": "01b008ddd1165beb243cae5e764404a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237704, "uuid": "71090d8a-2b39-41db-b9a5-59597b685bb4", "comment": "Malware payload (Mirai)", "value": "3e6e4acb178ecef8b03ead9d1331e88a7ebde62e0382fe6b65a975acc9d9fe1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237704, "uuid": "c812b6bc-21c4-400f-a797-b733914b7aa0", "comment": "Malware payload (Mirai)", "value": "3f158a3df9745d4321ebf8b3e42903f713a12be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237704, "uuid": "d8d3b74f-0b04-4316-bce3-68c3730c2252", "comment": "Malware payload (Mirai)", "value": "9c0d62031b5230e9e93f6468c0832ec197286dd34a4d835006ad40fd3e2af689bdafc8fa814f046836f612af34454f76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237704, "uuid": "96e93fe7-30ad-4f4b-8f17-5bed21db831c", "value": "T18D936CC6E79BC4F4ED6605B46133B33A45B2E6350029EF4ACF25B9369C26501B32B39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237704, "uuid": "151beed3-63d9-40d8-8553-01178642dca4", "value": "1536:zZHybqlHhjn5TDjAYJ+wW0pajqAn8jJGNadO7vR8FYGbuRKRfcpBzRFTq5:UqlH1J+wW0pyq08jJ4aYwZMYkpI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237704, "uuid": "404ec1f0-1a09-4cc0-87e6-43a112279019", "value": 95220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237704, "uuid": "3c427a73-52f4-4edc-8c92-8d3b8953f136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237704, "uuid": "8cc9044a-29c5-438e-bb06-71f54a83303f", "value": "x86_32.kokz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7496f317-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216723, "uuid": "8e847d4b-0244-40e2-b48e-17ad7c8f81f5", "comment": "Malware payload (Gafgyt)", "value": "9d4178980b2740e2a13cc091be1128f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216723, "uuid": "9f30803f-554a-4739-a40b-0c1a0b63d445", "comment": "Malware payload (Gafgyt)", "value": "3e75cc8e83d6f5767823d8d6af243af3eff14885e86bc3edb7b130bafd1f80e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216723, "uuid": "575c3df9-ea06-4032-8877-d66fa977bd00", "comment": "Malware payload (Gafgyt)", "value": "6f98aa9c27c307b31f1338246cfffcaa9ae4ca96", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216723, "uuid": "437bf2a4-6b14-47e1-835e-bd8858f9d70e", "comment": "Malware payload (Gafgyt)", "value": "33eae06444bdbab34391fc533e0feeb13dd4d6f437617743a2e4e12d086f657b5e6bf15a34cb6bae8cab4130cb98c4b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216723, "uuid": "b9a60ef1-7cac-4c75-b53e-5c9b22df452a", "value": "T1DE41BE8E20920870BC66A4777275BE0070D5939FA4D9BF4F7ADC38E5098CEF5E425B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216723, "uuid": "743804c1-e12f-4820-a50a-9bd9d213fdd7", "value": "48:1uth4tlSaLaMalskHdHp4H/9zc9QtQfk0ja1pufQ/ylkdvA/FWpszbsylkdved+S:1uth4tlSaLaMalsCdpelzc9QtQfk0ja+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216723, "uuid": "e6bcceea-07c3-441f-bb3f-6f2eec1418b9", "value": 2062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216723, "uuid": "cdaab267-56ee-4a08-b7d9-384176d6be1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216723, "uuid": "04973279-5dda-494e-9d0e-80baef98a074", "value": "ISIS.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfb8d28-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218776, "uuid": "16801157-b3be-4f1f-bc71-9d122eb88e2e", "comment": "Malware payload (Mirai)", "value": "875c8bc49ad2e5340a8ff9f56295f124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218776, "uuid": "052c611b-12de-400b-85ca-5ab0d810af09", "comment": "Malware payload (Mirai)", "value": "3f8255a5171dd83c2f1d8deddb2184f730ee8e94e3eb6b7e665a6889f956fe1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218776, "uuid": "0fff9fc7-3b7a-4c6d-b505-8e0a12b9a481", "comment": "Malware payload (Mirai)", "value": "8e37a4f0ec77faf48760afe0b11195422656dce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218776, "uuid": "ac089fb2-4b6f-4d11-9874-a81bfe237778", "comment": "Malware payload (Mirai)", "value": "7ee295fbb2a24638fab5f761c794302207611b9dc41a7975af2a5d5eb11a48d9d7cf240c41ceb0fc3ad76010583a4b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218776, "uuid": "d40da1c2-3eca-4717-813b-37f9e779015a", "value": "T1FD934B45FC819612C6D5137BFB2E228E372663A8E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218776, "uuid": "bf4d7dc3-78ea-44be-ad87-3bae080ac3e3", "value": "1536:9ObuOZ1SDp7u1rGmF/fgcPrnyAsWkJ1/j4oYkv1M:9Obu0QpKhB7PryAkDd1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218776, "uuid": "eec8e507-7876-4419-9977-69919dea84db", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218776, "uuid": "f6049519-0304-454f-baa7-5b623360b34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218776, "uuid": "5a6e7ca0-ffb4-4189-b048-be9ff8012993", "value": "johen.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9356b4aa-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768205608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205608, "uuid": "931b6fc0-b70f-43bf-b735-bf0a549d3490", "comment": "Malware payload", "value": "318dfda74ea7bb87a1ac4b98ee842f6e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ladr\u00f3n de banco", "colour": "#87B44F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205608, "uuid": "8bdc2a70-a6ca-4b62-9486-fea62bde7730", "comment": "Malware payload", "value": "40796b58a415524facb8b1693c8622efafd3c2a3a35bbc74758721b83de0cd6f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ladr\u00f3n de banco", "colour": "#87B44F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205608, "uuid": "73ce7611-a02e-4aad-9835-a096288b9346", "comment": "Malware payload", "value": "d51ed1e43fa37cc220f74b1c5a08b8cfe1a35e4c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ladr\u00f3n de banco", "colour": "#87B44F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205608, "uuid": "27a5c90a-589a-4a1a-baf9-4836d4c205a4", "comment": "Malware payload", "value": "ba8728f17a0b78ccc6073400f69800b9a81dd952c11990fb7c35e67efb6cbe7033e6a7f6dee25e430452d7576bbf02f3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ladr\u00f3n de banco", "colour": "#87B44F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205608, "uuid": "c16a2486-c799-4504-9dc9-d2a6c1736e88", "value": "T16B67224AF794EE6AC4F7523241765620954B8C664B83A7C33A48733C5DF36D08F8AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205608, "uuid": "361459da-a4c1-4edf-b62e-4aed66294959", "value": "786432:nmfxWVlVhEfrHIVZw1NOTV0yQHjwFVjr+Z5Z:mfYVfhEfjILg4mwHf+Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205608, "uuid": "7ed76d80-913a-40cc-947c-34201caacc96", "value": 30267103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205608, "uuid": "31cc1033-fbbd-487e-b6a3-e29c1e36ba6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205608, "uuid": "f0d29824-6825-4b9d-87db-83fc3ab1c7af", "value": "SRI M\u00f3vil.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b107f6d-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246369, "uuid": "3c9eee3e-231a-402f-97e7-b49c1e6e6281", "comment": "Malware payload (GLOBAL)", "value": "2ae5f92e6b3282fc54ee8abb111b542b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246369, "uuid": "f465b9e1-4134-4480-b951-7bcf8a34883d", "comment": "Malware payload (GLOBAL)", "value": "40dbcc2249f5c32ff8aaa62dfa0b9e6df34c2bdd0fbc1348fca4a0f014995756", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246369, "uuid": "3a3ffb14-3119-438b-bda0-d3a9f87857a0", "comment": "Malware payload (GLOBAL)", "value": "5ff8494f769fb7f04dc6281728dbc5c4c14346db", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246369, "uuid": "0b8efb9b-dee6-457b-b705-cc0030928eeb", "comment": "Malware payload (GLOBAL)", "value": "f824135d0df25fb958eb36805effd55820788195db37c9c27d28489173644bad25dfdc544bf6d74c20b1941d102f5dad", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246369, "uuid": "7b2ef526-8276-4b72-8581-12b40de52bb4", "value": "T153347C30BBD28431F4B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246369, "uuid": "8002a5a2-0cbf-43b1-aa65-3de8a080c429", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246369, "uuid": "7bd71869-06db-4e7d-9742-9583f95d0b64", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246369, "uuid": "a8360806-14d2-474d-84a1-a561d5dd0d69", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246369, "uuid": "d56365d0-bbc4-4572-8026-6beca9b72a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246369, "uuid": "95889045-0ea2-42c7-bd3c-3ffc88a8c78b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81137ca8-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212020, "uuid": "869a6c10-ae88-407b-b56e-57a66ba71713", "comment": "Malware payload", "value": "1c834a1d75e7de94164b5aa0fa21566a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212020, "uuid": "0cc04ebb-8f60-44af-888c-c171e6059c67", "comment": "Malware payload", "value": "4102938ecd11e71a5aac76997deaf60a21df17dc3259c48d8d9ca5cdacc2cf03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212020, "uuid": "e7d108f2-938c-42c1-91c2-bf0fb6dad4dc", "comment": "Malware payload", "value": "e27c9cf436186999e1826cc7438533e1c5e51fd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212020, "uuid": "779b04ea-ef9c-47bf-a10f-ea40a8ad141c", "comment": "Malware payload", "value": "ab727e2d4bedc1d318d20ce9654ce0d97329ba71d8ee3835205465713eb84e2233b062d6ef59022aadb4ae46ffc95f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212020, "uuid": "e79bd339-bd2f-4e94-8fc6-e848dbef015b", "value": "T160F433D849B17C4AD26A2E94F749CB59E56D8F3832FE0E7112B6C1E73418D9E04F122E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212020, "uuid": "6659da45-bd90-4d17-9fd3-cf2ea988d9f7", "value": "12288:rE5zxbUuL76xcrj4o4TdAB4iP7VmV0XV2hMunNrgIqV6m4uRDL7JzjivsQ/IFyKy:rEPbTIcrjeAt40XV2hJNrgXV6m4uR7J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212020, "uuid": "ed1600fb-0755-4598-ae5a-4d1730555dd2", "value": 729656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212020, "uuid": "330f49c9-af61-4101-874f-058e0188291d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212020, "uuid": "86c1d043-4e71-42f3-a2ea-a1bf4afc510f", "value": "client.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888f2a5d-efcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768233507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233507, "uuid": "d94075b7-32d9-4c48-beb5-0007e58f0e88", "comment": "Malware payload (Mirai)", "value": "c7ddae715cad7218104624a97287ca09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233507, "uuid": "8500f314-ce50-46b2-aa73-af2c2f5a9ed2", "comment": "Malware payload (Mirai)", "value": "428dff02b6c136b40515aaca9ca6c5cfe0952e0d5447cc6b222420a2ee64cf0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233507, "uuid": "ae0f4518-6742-4c15-8480-739fdba17adb", "comment": "Malware payload (Mirai)", "value": "3cf6bf030fc5fa53a99e68c39cbc06d3c124e867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233507, "uuid": "73be43b5-5881-4e54-993a-cc1c581983a1", "comment": "Malware payload (Mirai)", "value": "52001e951f3ff2ac8eb2a5ecd5d1caf739bb0babadbdf8844211f0b11ea919cd029baa87638bf4ce07741ad063fb4073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233507, "uuid": "679bfa56-d576-4cca-8cfd-fd5e141c3e97", "value": "T1EBA3122927A1C52FF610D0F638880178FF76BB6CEB42726A5841DDE598C75F1B21EC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233507, "uuid": "be2d48eb-385a-47d1-bec6-807aced99c03", "value": "1536:Lk2JNDu7fTedhXdhwVMFvCKuRi/6MMNIheMpyrbosl+6Pw1xyhGknRLbmsF1:pu7fQikuRiSRu1py3wbyAkxVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768233507, "uuid": "d8d9473c-4e2d-4f09-9c15-78c1a93774db", "value": 100648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768233507, "uuid": "9a4e64f4-b159-4b94-b624-b87f605a1a61", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233507, "uuid": "d6a62dd5-b099-4a01-984d-4408b3b288a4", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9364e8-f010-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768261513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768261513, "uuid": "91d8c273-37a4-4166-a5c5-91306cc8d80e", "comment": "Malware payload (ValleyRAT)", "value": "2ffcfbafcf5927eb2dab8a3477857a49", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768261513, "uuid": "ab43f9e7-71af-4cc1-87c0-f80328bebe58", "comment": "Malware payload (ValleyRAT)", "value": "42995fa81feadc79122434bc07a9516598986ac58140f143e5b1c968a0b11694", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768261513, "uuid": "6ac1e392-520c-4122-b8de-519457d347dc", "comment": "Malware payload (ValleyRAT)", "value": "bd403609fc0f9f2e6aa390f43ec11fd3fecbdb47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768261513, "uuid": "e2d4061b-ed76-44d1-9588-ae2f9b8d7005", "comment": "Malware payload (ValleyRAT)", "value": "c101c77ba2cf96148d76de5529c67ce8b415c835688e5d8086033bd3c3f91c502dcb5ad551eed9d4eba4dd1827d32af4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768261513, "uuid": "8c0fb7bd-1467-4414-847c-34ddeba28643", "value": "T183058D09AF21CD20DD2DA7315EB0629166BFCFA04B91A09F9FE1B96F0D711D1CF18992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768261513, "uuid": "66c2456d-8eee-44f1-8263-e64e82c3a537", "value": "0a4c89c2b7825eb5be087d30227b8429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768261513, "uuid": "ad89515c-f1c0-4a82-a3d5-edb57f88dc8d", "value": "12288:L5UzQzE0lni9qu7wT0NClu7eIKUCH3buu7W:5E0lngDNCULgLTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768261513, "uuid": "ac430246-07ed-4858-ac9a-e64546444f2c", "value": 856112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768261513, "uuid": "679c9ad4-0f1d-4368-bfbb-59fbe65b399a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768261513, "uuid": "d51488b0-dd52-473e-a364-7fdead5a22a2", "value": "2FFCFBAFCF5927EB2DAB8A3477857A49.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715be3e3-f012-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768262245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768262245, "uuid": "33b8b59e-9d6c-4702-aacd-28f22848565b", "comment": "Malware payload", "value": "7aacff4679245e08b8e3faad59737b28", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768262245, "uuid": "cd066ee6-e5d4-42ef-a3b4-6d3c5820506b", "comment": "Malware payload", "value": "42b9ec9a225710020107a6b5ab17af7ca832f46631835ca937e84f2529f0a3f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768262245, "uuid": "38ded8b3-7830-4566-9cc5-f9af995b0f2c", "comment": "Malware payload", "value": "a86001382b7908efcabb7799b2672c50f4a9a82b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768262245, "uuid": "a0f0c846-0d52-45b0-b07e-52ab8dd85c74", "comment": "Malware payload", "value": "902e3b4c1dd8d3254812ab2a87881ea174becff3997f3b6e3f2d05e62a5ac10e5cfeea64edbb9333656f52b7573f7623", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768262245, "uuid": "0d2f868d-3e5c-408a-b8e8-5d7fe07fab86", "value": "T12E31EEA2BB21AD7B30CDA8B4F11D92501EA3B6A735A2671468C53C71E74F904D339E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768262245, "uuid": "fc68b9f8-612f-42df-a320-58f8abb9ce8a", "value": "48:J+xol4m3KTg85WZKTIRKTI2oKT5jKTe3MhiW7zKTImLKTLKTIL:J+WDZ85WZ/dEjx3M5uSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768262245, "uuid": "81b37f45-f1f3-4eb5-9a78-c255f236a82c", "value": 1812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768262245, "uuid": "3a66b9dc-839e-4db6-a33e-60481f98c1a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768262245, "uuid": "904962aa-9f75-4b06-afed-28b71ea21dcc", "value": "wow.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d46e089-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217597, "uuid": "813da19e-2d0f-400b-9ec8-9ba06cda714f", "comment": "Malware payload (Mirai)", "value": "c84498232e85a2dbbbc993a87d9cbfd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217597, "uuid": "8ce3dcd1-6402-425d-888b-677dff4b7f76", "comment": "Malware payload (Mirai)", "value": "43180464ced891154a5c5ad8d7c4e9348ea1a5397eb23aa8c39aa4560074ac0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217597, "uuid": "60ec94f3-77f2-4fb5-8678-f235feb86db7", "comment": "Malware payload (Mirai)", "value": "cab1ffae5ef21788ee27ff58ae460450e77a733b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217597, "uuid": "6b8cc48e-3ab0-4df5-8ccd-5c88810f76f3", "comment": "Malware payload (Mirai)", "value": "6f219eedc58df0c2e7288c81fd1467c8f96fa885988ab6fea2956ec2b740bf8fefc780df3da4f326f7d4005ca2d3e2dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217597, "uuid": "3a627978-902c-429e-af44-c63f53607105", "value": "T1DE734A0277580E43D5A21EB4293F17E093EEFE9121F4B689294FDB1A4631E73254AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217597, "uuid": "9c458008-a69d-4528-8d49-b42d9acfedc4", "value": "1536:+pbQnad85D6fhNMssa1Y1vfmtG9R/lD8xcIwemK:ubQbcWsN60KexcI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217597, "uuid": "4ac852e7-54ad-4d6f-972f-d9976c1166cc", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217597, "uuid": "913dacc9-34f7-4eab-a30d-1e27f114e7cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217597, "uuid": "b392c4b6-c816-4cb2-929e-0c20c5cf9a87", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e95933-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214543, "uuid": "fea011c1-38cf-4e53-94ff-b3f6d1994021", "comment": "Malware payload (Mirai)", "value": "d54972e1d0dbf35e5e7ba1c7cbe5d014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214543, "uuid": "d0ae9d3c-6c4a-4553-841d-ce1fcf91c879", "comment": "Malware payload (Mirai)", "value": "43213e39aaf9122eefac6fe6f76a143379f779765e3dcc37f42571664e120545", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214543, "uuid": "8bbc239a-7444-468f-986b-5319f9f62d78", "comment": "Malware payload (Mirai)", "value": "bb6d4d19f3a823507c58a96298a619fb5d42d0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214543, "uuid": "379c3dfb-3b5f-4222-8dc7-da394d6c2738", "comment": "Malware payload (Mirai)", "value": "7f63c5e21a88273b5b28fac0298dc4feaa7b9b35bd01418a5fbac61c64757ff437c6b1f54a69d8cc7edf0a1f29fe11a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214543, "uuid": "75485134-a928-4984-a49c-54b74def8086", "value": "T188E46C98FD1E3D42D2C7E27CDF8A47E1222BB1E4D72681F23941524DE9C6AED87E1211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214543, "uuid": "59fbf38d-fd6d-44d6-b34e-500adf53b61e", "value": "12288:yomfBhgKw2P6HNYYvWle8XHkxdlVSw5VYAR:jMBE2MNY73k/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214543, "uuid": "de0ee07b-e7c6-4866-aece-e9f2aa0a9894", "value": 663120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214543, "uuid": "1c26691e-66a2-40c5-8921-e126bd543e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214543, "uuid": "11076a13-d921-46cc-bdab-4312353b3935", "value": "shadow.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d347fe7-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768219556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219556, "uuid": "3de0eba7-e1e1-444b-8f2a-07840d252314", "comment": "Malware payload (Mirai)", "value": "07dc63c755d649cf3c6f9847265e53ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219556, "uuid": "0be16f24-499a-43c2-8b63-2195ccccc4bb", "comment": "Malware payload (Mirai)", "value": "44148927bfd4351f8a35a016679fe287a6cc295fb5320f5ebaa9ce83636df8d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219556, "uuid": "82aa6545-7f77-4b3e-9465-66addaf78043", "comment": "Malware payload (Mirai)", "value": "40a3479591122e5c28fb5ef973c5ccd90bf15b96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219556, "uuid": "9f21f7f2-b93f-48f5-985b-3e9067801725", "comment": "Malware payload (Mirai)", "value": "662be651a28b6c23b088f84b95d14360830ce9434bf54edcbaebbb44bb51e74dcc11324c646cda8a7fd6d832de3c778d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219556, "uuid": "cd06bcac-93ca-4749-bf76-4d0b8074b235", "value": "T1F5B3F90ABFB11EFBE4AFDD3345694749289D450621B93B7A3A74D80CF24A68F46D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219556, "uuid": "9378a884-e37d-4503-b1eb-c8a464c83d44", "value": "1536:cLGq75t+EuIgKP5/WuoQsBlVyG7N8A5Mb78+nbFM81CkH5mLcW2kHZfqFX39wu7N:cKm5vsBlg1kQ9UTFWm39LTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219556, "uuid": "aa7e6f5d-b095-4864-bccb-577cc515cf9a", "value": 117492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219556, "uuid": "6f28bf29-52f7-438f-b181-dd7cfad1d0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219556, "uuid": "27ace1b8-0245-4ce5-914c-d631c233b5a1", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fbcc13-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768217751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217751, "uuid": "b9db59ba-1d55-4287-aa39-ca73fc53dbd1", "comment": "Malware payload (Vidar)", "value": "fad85052ca429a973b534e3617d3219d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217751, "uuid": "f67d0d1b-0439-4318-858d-f5e04fc8b549", "comment": "Malware payload (Vidar)", "value": "44a105dba95f0f0970513cdadf4bb799464f442104da7f7ea7c57ed0b29ed1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217751, "uuid": "e0c42880-9a7c-40c0-ba4a-cac3495ba697", "comment": "Malware payload (Vidar)", "value": "827ed26e2e5d9ede56f5400492e385eb303d7221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217751, "uuid": "b2976011-8cf3-4e74-890f-d76e7a4dafce", "comment": "Malware payload (Vidar)", "value": "0a81f1fe547c448d6ae966b57999511d0175a062f72ea681e881381556234cb2b572f4ad6675060091dcbe6cca1d947a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217751, "uuid": "441ea5b9-70b5-4b0f-ac3d-89bcdec16f3f", "value": "T1BA865AE2FB408635D6DBF239D86121566230B848133515D7BF760AA49C6FBC8173BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217751, "uuid": "cbc70c4a-2fd8-49ec-8ab1-a46eeb454fe3", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217751, "uuid": "76bca98b-0f78-463e-ac7e-58653cafa3d6", "value": "49152:ge3OeXaIwdrb/T1vO90d7HjmAFd4A64nsfJVcJh1aKAwDSgymJfBg3drhwiskK1/:dDwIoqiBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217751, "uuid": "b8eab49e-e024-4d0c-a3ed-338a43accf51", "value": 8357504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217751, "uuid": "5f78d413-6b50-4be9-be79-6b7d32f1d492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217751, "uuid": "7366b346-b0aa-49e6-9952-7017b05c0341", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac2c564-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193541, "uuid": "d6ebcd69-8028-447d-99af-1efb3a2c381c", "comment": "Malware payload (Mirai)", "value": "bfe50209a63052827ecfb4395aee76a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193541, "uuid": "9e68e0e5-207b-4e17-80a7-4fee40951719", "comment": "Malware payload (Mirai)", "value": "4568ea09be71f23447db3ec2a89fd4085f8d060723335bb6e4909b6b47114ae5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193541, "uuid": "be85f47b-d140-401d-b34b-a3a301c83002", "comment": "Malware payload (Mirai)", "value": "afde8941f1a5e2d938b8c53476e0ff25eb03bae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193541, "uuid": "5dbff0bd-94f3-43a5-a3a7-a80c37fdaa84", "comment": "Malware payload (Mirai)", "value": "9dcc06ca8706a2bcf8b090a602d9837d00cead28ae1f3d58c3f1dc44dbb8dab3f827773d1a1fe002fe0cc89647c34d10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193541, "uuid": "6323d257-5097-40c3-8ca2-aaf935ad9607", "value": "T1E183F655F890DA62C6E0267AFA5D538C33130B74C2DD7102DE25BB3466FB95A4F3B882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193541, "uuid": "10b84ca9-2aba-491b-aa95-72496cf9b848", "value": "1536:TaKu/aotDap3CWdnbe32vsGtBUV0HqoWOYFxf7jDIMH5chIQGjvWUb9e7Qres:GveZ5EGtiVEYbf7fnBZUoes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193541, "uuid": "2521c7ec-00ed-48ed-ac4f-68c6811bc804", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193541, "uuid": "2595f9aa-baef-4ce8-8a07-000c0cd442a9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193541, "uuid": "9af57318-dd93-4a8c-bd52-61692ab8a68a", "value": "catgirl.armv7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809d0f25-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216743, "uuid": "0bcf94d7-84ad-4cc1-bf5e-641694baec5d", "comment": "Malware payload (Mirai)", "value": "5c70feb0df376044419a7fea8fccdb1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216743, "uuid": "3c96340e-95d1-4212-baad-16690c2f8c5a", "comment": "Malware payload (Mirai)", "value": "458a71e1d9feb07eeb09cb2cc4b8dcabd9aaa89774687ba9aad1e6f1bd518d8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216743, "uuid": "b8abaf97-48b5-42dd-9776-fe76d20a2ffa", "comment": "Malware payload (Mirai)", "value": "4121e64b4332b863c328eaa515ea974416dc1e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216743, "uuid": "1399a6e1-cb49-4c73-8b95-a6b97341dac8", "comment": "Malware payload (Mirai)", "value": "5453484c62c7cfd7fefedc9ade8379fd1e67b3d75b746f04e741ddc4d97ae77c409bbf2bc1181186c7db9e893443ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216743, "uuid": "ceee679b-d46c-4fa7-8cb2-e25240ed1fe2", "value": "T134935B22B539193BC4E4947722F35326F2F6438A14A88B1E7E720E8EBF156D036477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216743, "uuid": "0644ab7d-5b06-4770-af76-2860e90b78dc", "value": "1536:jCTL50JtdFu/EqR94iM3StnpYm5mwAtQIt285:WSCuxCRpYO3185", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216743, "uuid": "7ae82236-3ceb-4422-a59c-0c96c446afdd", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216743, "uuid": "c3279978-fff8-494a-bb9d-fc35512a1955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216743, "uuid": "7354a9bc-e797-438a-a8b1-a6ee91be8cde", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368b0f5c-efb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768220485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220485, "uuid": "e7c70196-c90f-4916-883c-57fcd5f30e27", "comment": "Malware payload (Gafgyt)", "value": "9aedad08376d799356bc8f778cb9dd2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220485, "uuid": "aa0b7c62-cbdb-481b-92da-ef411c3c2fe1", "comment": "Malware payload (Gafgyt)", "value": "45b01f2cc8b4aee6a3f4a1862558101ceaf66b7e1ebfd7a39d6a042b776fd239", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220485, "uuid": "d442ab5d-22fd-4f3c-b3c5-13eb88c84ab9", "comment": "Malware payload (Gafgyt)", "value": "0dd6c4f2b8b78c8fb397858529c9d1fe967fe6b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220485, "uuid": "b3b102f6-54c5-4afa-a6ec-89e6a5a6e142", "comment": "Malware payload (Gafgyt)", "value": "477122405f6d1e08e44b9ae07fb4e96f4e773f6070a72921fc5a1536e60a322dbe862b95a6e2efc4c93ba11150217173", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220485, "uuid": "5b20e0ad-961a-4f9e-a239-9fe842971fa1", "value": "T12EC092D615A12D766E75D6573269040174B8A49A2CDA2F4CE8FC39E7488FF8C300AA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220485, "uuid": "5e344b3c-c3b7-40bf-9502-4603e2f6c88f", "value": "3:TKH/JOnQzanFCKl2f0FWoOKeFSOdmWNeF4MYFIKW9:IOnFflE0FcAWNfPFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768220485, "uuid": "a6629b1c-afd6-405c-a83e-4e6143d33f1b", "value": 134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768220485, "uuid": "1704e96d-dd21-447f-b6bc-cfea9ddd0489", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220485, "uuid": "f8a91fa8-6734-476a-8fbb-d4f70e4f7a32", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c8009e-ef7f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768199042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199042, "uuid": "8decf2ca-0776-4069-ad41-109ef02f4a3f", "comment": "Malware payload (Mirai)", "value": "38db0620b1b8a908381c364bb3185028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199042, "uuid": "058f6a7b-9156-4811-9cf5-b5ff8887862a", "comment": "Malware payload (Mirai)", "value": "46549247f24182ea2987aff1737c02d0bbe76603519cf3fffe92a1cca09ecd8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199042, "uuid": "0730d9f1-027f-498e-9d74-4fa9ce7d4cac", "comment": "Malware payload (Mirai)", "value": "414395c779c45717d17d58aee902921edc7d1b80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199042, "uuid": "7f124d98-498d-441b-ad94-5f8bf2e3a445", "comment": "Malware payload (Mirai)", "value": "481d95a41529722095d8e78ec6740216357324223b040cd86ddc04bb342aabe9ef87754d4bde5b6fa82f3a492731b23c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199042, "uuid": "86e244d6-9793-4bd5-b2ca-1d86365664a9", "value": "T1C8831955F890DA62C6E025BAFB5D528C33631B74D2DE71029D24BB3537FB95A0F3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199042, "uuid": "5dbaebf7-eb20-48a8-890c-5fc43dc2636b", "value": "1536:3EWYislozMX5oA5aiiyi544C/42nO2NZckisWM4AFpoelv89OOH9oBIr:3ECzMX5P5aL54OoZosaANvq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768199042, "uuid": "0ac9189f-a8da-4584-8c76-8a66ce1149b6", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768199042, "uuid": "ccabdb97-a919-44e1-9a53-1d5d93ff2553", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199042, "uuid": "97c1f5dc-9fc5-4282-a419-1403f5dfe5c1", "value": "SecuriteInfo.com.Linux.Mirai.9724.9167.17932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7f0a56-ef81-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768200016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200016, "uuid": "e0cb4fc1-0f74-4277-aab7-89ff2bd193d4", "comment": "Malware payload (Joker)", "value": "69a9c68b06e8d063ebecc8557ed6de51", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200016, "uuid": "fd781ed6-d3ae-403a-9917-f26aa3d73ca7", "comment": "Malware payload (Joker)", "value": "46b627d2084083fa089031758d22c211baba377c4018b95b493e7fd20f66f925", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200016, "uuid": "9d3f0b37-da97-46b3-bbf3-80f0e51cca30", "comment": "Malware payload (Joker)", "value": "a7f12171aa0b0111c4753787a7f14c9cd6cae1bd", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200016, "uuid": "b1168a83-a851-4bb6-ae99-3ed68bb75a85", "comment": "Malware payload (Joker)", "value": "80cc7b6dbf471690af032e409b06865e9c785fb5043b8dbd8d8e7c806eee6255e45abdd8867e69b2e002b0f87d54daf7", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200016, "uuid": "43ef36f3-ac06-48b4-9a60-7053b5d4aa36", "value": "T1FFE6129EEF0CF82BC5BE6073CB69D223327BE2450582977778098218A99718D4F15FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200016, "uuid": "621daa9f-5e19-4ab4-b977-5af0e005ff3c", "value": "393216:hVLSqXNVZcHAI4a8qMQalPQJnhjeNnrFCM9Kzrac:hVLSUUf4RQalPansTKPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768200016, "uuid": "6fda6d96-690f-4a49-b8bd-0f45bc359870", "value": 14553448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768200016, "uuid": "d1cb58d3-ac94-45a0-a0e4-a61298a7b16b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200016, "uuid": "a2e6aab3-41b0-450d-81f8-36d92c9e0437", "value": "Smart+Chat+Messages_1.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca9e63c-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768211261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211261, "uuid": "9b85af0d-07c8-4b59-b3ae-6d7327234ff9", "comment": "Malware payload", "value": "6f74f75f97917e736f90d34463949878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211261, "uuid": "c72fa966-0f44-4d25-a4e3-9b407ed2b840", "comment": "Malware payload", "value": "46c132c4d238538910dcf732e324efbd81e440555c7e695af21700376cc39b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211261, "uuid": "242e7c83-1b8b-41cd-93f2-9f019e609ff1", "comment": "Malware payload", "value": "1fb3fc8804e8fa67f2b4503530a8192ebd3622b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211261, "uuid": "ae81d507-a51b-4994-beb7-3b49a2f50335", "comment": "Malware payload", "value": "438f7a92175e3d5d1f8909fba9b39138fabc9b10c53b42790b59ec57cbaddcb3c73b71629bbb3091286ef55f6d834ff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211261, "uuid": "f2934fe3-f2a7-4538-8c07-c1e534293720", "value": "T15EE339CBF800DEFEF80AE73B48534909B130B7A155920B377257756BED3A1990927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211261, "uuid": "b9a4663a-abf7-4b0c-864f-1ac73f28322d", "value": "3072:QUjQLVFvq1oK5iMTe5HBmP5Y+SWVbjbi/L0N0PnyLOggguq:QUQFyXTe5hmm+SxL9yLJgFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211261, "uuid": "190865d5-c9a2-4884-b1c8-9a989af21db6", "value": 153580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211261, "uuid": "4aca306d-1b2c-4ecb-8650-e89a8fb232e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211261, "uuid": "4567d870-d807-4bc0-a591-a9c9f839efbf", "value": "bot_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2644798c-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768217451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217451, "uuid": "14b8761c-d1de-495f-a2f2-ed3e4c709629", "comment": "Malware payload (XWorm)", "value": "c0b73289893fe9d07b44cb57c0e4ee94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217451, "uuid": "262ea4e3-74fb-4381-ab71-ebb382568cf8", "comment": "Malware payload (XWorm)", "value": "46cd238bef400b0d02fad84d4dda8982e51a9752eec9025b92f7da4398caa785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217451, "uuid": "a919ebdf-206e-4834-b57d-8814c6920bdd", "comment": "Malware payload (XWorm)", "value": "b07cb83f2ee2140d9e0b276388c2963c6055ac5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217451, "uuid": "4aaf8e10-8159-4918-a377-54d52e3ed2cb", "comment": "Malware payload (XWorm)", "value": "acee2d810575e5b10ee44a46b7d6f42f90fd68625ea9303d037c84ab20c0fb49405058c6f6fc6702ad2bc48211f4512b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217451, "uuid": "34c7efc6-bf5a-4482-ad26-0c08bb3a6236", "value": "T19F273317E28D533EF0698A354672AA54953FBE20B00ACCA391EC7A4CCF394512D6EF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217451, "uuid": "a9c4f304-3ed3-46ef-aec1-eb213c2a16fb", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217451, "uuid": "fab3aba1-3a87-4d5c-925a-18ec2bd33099", "value": "393216:rDxyQjKGggpzufEoAUdsFT9pxvD8PA/gUrDySQZvjB7C/0Idp95:Evsw3ds/vDS9JZxC0cp95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217451, "uuid": "6d03e8b6-747c-41cb-b8f1-f3bdec1e0128", "value": 22295654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217451, "uuid": "51198ce8-0a7a-48c9-b664-106db569fb9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217451, "uuid": "15451962-46d7-4a27-9a01-e50c7904479a", "value": "WindTerm_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f451ea-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180217, "uuid": "c97bbab4-c5a3-4c81-8446-a13ab87fd06c", "comment": "Malware payload (Mirai)", "value": "1afa31425bccf25fa08300424a4c5af3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180217, "uuid": "8f209ff6-04c7-4ac6-ae2d-b96f980f11c3", "comment": "Malware payload (Mirai)", "value": "46cd28ef5a1d7242c29a67d52ff3473d83a2ac69b4d84decba3316b6141bcabd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180217, "uuid": "5b1aa85e-ac5b-4189-8161-949fb85b4d01", "comment": "Malware payload (Mirai)", "value": "dd51c44a4837b1fa26d094e4d0b4cd18147d35c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180217, "uuid": "d4a48562-5fc1-45a7-90ee-b51aef9a0b0a", "comment": "Malware payload (Mirai)", "value": "d98fb897ecc6abecc0cb5ae4641d1130a8b54967ac375d46e632bacd1167bbb9b0cc74ec69e8fc89a0f3e0e0b7ec05ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180217, "uuid": "17b6c97c-dede-4ba0-88b2-eabd1a29fe4a", "value": "T1E5B30ACABC819B11D6C565BAFE0E518D33134BB8E3FA7113CD145B2E678A86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180217, "uuid": "ec398362-04c3-4d58-b226-fa722f7b8c5e", "value": "3072:3s14K6M/jnXE++d9QkfMFRnSW+erIMC/3rV3fd49TA:3U/YWkiSW+erIM03rVvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180217, "uuid": "fe5e7506-3750-4ef3-b573-948a99ccf4e6", "value": 108084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180217, "uuid": "00c42aa2-cf1d-45cf-b8e0-5044a5f15966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180217, "uuid": "89191880-33bb-4613-9b80-db987a1dc222", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53917e63-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205071, "uuid": "fc3c8c61-fdcc-4a8e-9e0b-2d7dc1afd92b", "comment": "Malware payload (Mirai)", "value": "336b2820d50229517c336e7f1a3d1a03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205071, "uuid": "fc206bf2-73b7-4dd2-9ba9-a9b5662b2415", "comment": "Malware payload (Mirai)", "value": "4704f41258a6419dc9061022cf5d816c785f6f5b7bec085ab5e30db21d1866f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205071, "uuid": "a3d9ea6e-c4c6-4e70-9c86-2913361813bf", "comment": "Malware payload (Mirai)", "value": "69857e9860e3ca090e2b6be20f44f39b0e336a7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205071, "uuid": "37744167-1eea-4d42-acc5-27361f6cbcff", "comment": "Malware payload (Mirai)", "value": "b04650580fe7a0bc0bb6d5919fd89691898cb59ece8255890999741b0813c69e0907521bc7959cb43656e9a7588178d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205071, "uuid": "8db32106-60ac-40f6-9cb8-26e7a9067d2b", "value": "T15603E01897FC9AF8ECF02D71BB9D0E43B23D0BF4865B74922548890C2667C0D76B5AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205071, "uuid": "a90ff424-d19a-4d12-903f-d46014b258b3", "value": "768:cABBPtDKrnopMTgMtHyt1zU8b8CFqlT3iQRAubO2US7lbueZsj59q3UELOl:DP0ryMT3yJa3iQRvJUS7hueAsLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205071, "uuid": "c419c66e-f865-4540-951a-5d55c5750e56", "value": 37856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205071, "uuid": "38f9e77d-1043-4df6-b9fd-8a2ec68ca317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205071, "uuid": "25923ba4-9d69-4235-bd9a-44ff86a644b3", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9e5e64-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "cdc7ad05-678a-486f-99e6-f1ab35feaf30", "comment": "Malware payload (Mirai)", "value": "68bb8c13966e3d58190bb8f4d5cbe8cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "dd944b55-23f9-451c-8372-d6125677e1db", "comment": "Malware payload (Mirai)", "value": "4978f8be6b768d946064c4b20500ac40503f92329b3d40fb93b1eab7ce974ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "3355e03b-62cf-42f5-95da-5a8bc4c42452", "comment": "Malware payload (Mirai)", "value": "b5fc23922b9edfd18877fc41a932cd98e0a6b763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "14b6daf2-b15f-4fea-8a8e-91faf87714e3", "comment": "Malware payload (Mirai)", "value": "95000a1096a4e7c284f1176ab2e6eb253323e7b7b841fc7f86b12c29450e7c5a5333b2fb1627479f0267554ab8a86444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "19816a99-c555-433d-9237-5594e0b3dcfc", "value": "T1D4932A8ABC85C612C5E071B6BF1F56CE335643B8D3EA7243DD18AB28674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "1ac7e243-3f46-4037-af8d-0fd29df206f0", "value": "1536:40BZSaBbmKSPYjXsZ940L3TkTfi2HJbN6NhVBHTAbVR:40BZBBuwjBw3ITfDJbA/bHTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223283, "uuid": "b2c82b08-6676-4900-b765-8d0b672f3152", "value": 92312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223283, "uuid": "eead3f26-333f-4fdf-8427-67a69730a6da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "63f09478-8a2f-4ace-81bc-e7c4d587d16b", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9486c1-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217520, "uuid": "ed8a1067-6f2a-4abf-a181-8e6667c1ffd0", "comment": "Malware payload (Mirai)", "value": "e5440218f1462b99bd969b611b2ffe27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217520, "uuid": "bc549e0f-adf4-4a13-8655-6191a8d017a3", "comment": "Malware payload (Mirai)", "value": "497bd7363e0450d02f60553e200cd1a1fb9a68d219935f88e46cb41fea83b8fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217520, "uuid": "ed28a00f-2468-47f1-bd89-b09f8ba12cfd", "comment": "Malware payload (Mirai)", "value": "c0d85e92700d1a8bc2efcd3a9dc8ab27e7796352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217520, "uuid": "0ab5f34d-b101-410e-be09-08cd65dc0cd4", "comment": "Malware payload (Mirai)", "value": "81932ce8ea50af5dbc98fcc2f9f502ada2fc9179254a658f6f9ddb89bed7cbba2873ca1c537b58b947047b34155f510d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217520, "uuid": "7c319348-4b5e-4be0-960c-4c9b21f3570f", "value": "T12FF2E131823F558EC378903E1037FD0F4810FA2BF856857EEA643265E2767645F2A762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217520, "uuid": "b02057b2-4039-4654-8df9-a024591aecad", "value": "768:eraFgkBIQICCHFyovIIsbH2RUN5lmAPQwpdnbcuyD7UiyqD:9HBKHFyovIL0fAPnpdnouy8ZqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217520, "uuid": "0bf352f5-e137-40b9-879e-ca069b75e2e8", "value": 34316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217520, "uuid": "324ac87b-be7b-41bc-be06-1803c6ec6c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217520, "uuid": "14a7c7b0-bc00-40c2-94f6-45fba9f8fb08", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f351c1-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218705, "uuid": "4acbd9fa-fcde-4f9d-8376-d96e288b9bb9", "comment": "Malware payload (Mirai)", "value": "decfd0493ff2665bfe1eea894ad4bea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218705, "uuid": "e74567f8-e7bc-41c8-ab49-8888f461a262", "comment": "Malware payload (Mirai)", "value": "49d6e0777fea7282626bc493c39e7872a285511033edbe4cb6ccc2b5058ca73f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218705, "uuid": "62fe95a1-c226-4c7e-9c78-1c39a1a94d3b", "comment": "Malware payload (Mirai)", "value": "3d68b4bbdaba7a66d5b634097ae51fc27ad94f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218705, "uuid": "ab14eb36-51be-4495-a897-8a49be3599a9", "comment": "Malware payload (Mirai)", "value": "b8272bd086269da570040d3344fc108a8f9ae80a957da928b50c240ebc863aec7d2dd9e1317ccea31a948e1e959d98c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218705, "uuid": "5f2951c6-7586-430c-8506-0bd4f27a50dd", "value": "T12B739E23C876189CD26842B8B170FE3A53B3E51056572FFB069ACA7A9447EDCF5493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218705, "uuid": "da66b0f0-fb75-4e06-81da-16543b3f5674", "value": "1536:0/Zd1XEc589PGmE++KrpgE7YgJMiCYKkN3sk8:0hd10L9erIrbhJMiS68k8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218705, "uuid": "5be09a2f-8638-4b03-b215-9a2a949cab41", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218705, "uuid": "cbadf7dc-d05f-405a-8879-f32e9c2a3fcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218705, "uuid": "9688985a-f866-4d39-a584-b5bde909f549", "value": "johen.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff46a0f1-efb3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768221680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221680, "uuid": "a5e8b066-9904-44a0-97cc-b33e8d427d4f", "comment": "Malware payload", "value": "7792097bc3cad9a603a86ea690d12b69", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221680, "uuid": "e325e8b2-22a6-4d6f-87d4-8692fb566275", "comment": "Malware payload", "value": "4a1df7109d710df9e868feed9f3f2143e832ea0d1efbc48b8d0c8f2988c8b286", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221680, "uuid": "7e524e5b-3f7f-416c-ae90-72df7b3df697", "comment": "Malware payload", "value": "7a5e1c840021a52b0d84bc8aa7f4c4a17fa4455f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221680, "uuid": "791b2be0-f906-4278-9ee8-357ca0f586a3", "comment": "Malware payload", "value": "be0ca5b1402bfff7e307d5dffa00cb26ef07c7fcab1190b993fc01bd46d933f7ed40fe13101ac4315efd581b36373b8d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221680, "uuid": "1f4932c6-8adb-4d7f-905f-f7d5a32ed4aa", "value": "T154573380C861CE97F53B1239D576EAAAD89AFE590DA37A663670734832733D037F4052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221680, "uuid": "994089c4-8c1d-4a26-8ae2-72b43b824a91", "value": "786432:co1dH0AJtnVGF+nc9tSVdT/6PZH6j716SHLM:N1hRJ9VsZmn4oNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768221680, "uuid": "2c81e097-f1cc-46d6-8c99-058b5aa235a4", "value": 27377664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768221680, "uuid": "d3147da0-3c1e-4194-94fc-24c434dc7de5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221680, "uuid": "fc0133f4-4ba8-49db-82b8-48fbe49c428b", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbd0c89-ef96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768209142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209142, "uuid": "c9625f3a-e380-4aa5-b36d-86e33ac14899", "comment": "Malware payload (Mirai)", "value": "93f3dcee437495fe1a0838b9cbae33d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209142, "uuid": "472f2b6e-b59e-4fc9-8ea5-6e116e374bdf", "comment": "Malware payload (Mirai)", "value": "4a6398bb0f57ac13607de22418cb1580670e8c5918f8d44dcac6a91bf799981f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209142, "uuid": "47a861d0-2a24-49f6-8a9b-3418d59ee3de", "comment": "Malware payload (Mirai)", "value": "b2bc7144c3342b7c9893af3f1cb453f5b4e569f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768209142, "uuid": "734b18c0-41eb-4584-a63e-15d02cccb6be", "comment": "Malware payload (Mirai)", "value": "bd156db96f603c710fb68a0f73dec731c171bc25fc8dbdf498360e8141f68a506dcccae2d6897da81499b69ddd854aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209142, "uuid": "3d95c9ae-bdda-45a2-bc07-31a8c9418be5", "value": "T166337CB2DAAA9E55E60C56B078308F394B53561097872EF696A9C274C003D8DF18D3FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209142, "uuid": "190c137c-7bcc-4764-b0c1-3b2efeed6aa6", "value": "1536:7QY5R2uWnbBJ2jTwRh9SIOCFTRTCAT2bVR:7j/UX2yS7MVDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768209142, "uuid": "4ca571d9-7780-48e1-9397-97c925efc27e", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768209142, "uuid": "382f290e-03db-4945-877d-e2aa9b1d7730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768209142, "uuid": "841136b2-f0ec-4627-8609-4fcdf6d72acd", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2849d2-efb8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223635, "uuid": "9b3a9403-ab3d-4d51-a66a-cc0ad607cae4", "comment": "Malware payload (Mirai)", "value": "ab7bd2d6c5cfc610adb19654d70d7997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223635, "uuid": "fbc3d020-6fae-48b0-8ae4-eccf8089b7a1", "comment": "Malware payload (Mirai)", "value": "4a6cb1c36ea96c84a5fac06a58c8ef96f695172ca9489ea8b13bfb7244c25360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223635, "uuid": "366052d0-11ba-4162-a45b-bb1baaec10a1", "comment": "Malware payload (Mirai)", "value": "3eb8349ec3e51c45365738283cdbe51f3ee12fa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223635, "uuid": "e8300156-796c-473c-b024-a5b76343dd9a", "comment": "Malware payload (Mirai)", "value": "2222612b9875a5b88f6bdc1ae62e9acd528c369bcaedec6c8249156242886a8336bb4d6a783669827a592fbdd59084f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223635, "uuid": "9e3ea31b-ea7e-4a85-be1d-8e7a0d98248e", "value": "T13B934C96B000DC7EF91BE6B790070B15B130A7A59F426B67B62BFD63DE3D0685C1AC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223635, "uuid": "59cc6653-58bb-4471-b325-eb299cafbead", "value": "1536:aUQB36DoJLTKjio5ekb8oqEblXWabi2syshzsb/kPhsxrJH3XDqoLO8df1MWTPQ:/QB36DUO+o5efkRGab6z2ykHnDqoLnMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223635, "uuid": "b81134f5-730c-46a5-8642-5452eb049351", "value": 89928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223635, "uuid": "a533173d-ef50-46fc-b07d-59649ee08917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223635, "uuid": "bb0bb005-9021-43cc-b9a8-853cc873e0ca", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f313a5da-f000-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768254731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768254731, "uuid": "465a14ec-9360-4cd9-8697-3a5eff5d45d2", "comment": "Malware payload", "value": "5a8ec029c485721df0e5f3f3727b8b32", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768254731, "uuid": "9a92a215-129a-4030-8605-65bbd05985e9", "comment": "Malware payload", "value": "4b4ce454b9deec7951c24b339d0beaedad139bcc3b9a947037a207a8d915db5f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768254731, "uuid": "34fe075d-b07e-46b4-84a6-bdbadbca00ec", "comment": "Malware payload", "value": "f392da88710574af521b970e2f81f416ca8d0456", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768254731, "uuid": "8752a38f-23b5-42d3-99d1-b3b1c1501fa0", "comment": "Malware payload", "value": "b5acc02c710a2ce37bcc91b40224cdcdb4814b25549414d22468999911deca26a422764d50f0ccf6334b5f0e50ab53dd", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MythStealer", "colour": "#562656", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768254731, "uuid": "917ac5a1-023b-413a-bd97-04c0f4f80ba6", "value": "T11B083374D8B9E743573932AC4A22C758251723AACAC9ECA5F34FA057BF834C10E75B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768254731, "uuid": "d711284d-92b0-4b2b-a332-1ff55cc57d29", "value": "1572864:tO9do/iuuRRF/g3lpbnbDmhii7WfLySjh3yFtWNyysQDb11D8lxs6:tO9do/vccD2hV7WDySeWyPQnvD8E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768254731, "uuid": "17a22e1c-ca0c-4df4-98b9-cdcca627391b", "value": 78929684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768254731, "uuid": "9e019d93-dcb2-4a19-91cf-18135e524a6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768254731, "uuid": "027e3761-cf38-4a2e-a7d2-3317c6b3b74f", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b47b9c-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181377, "uuid": "5d8503b2-6fd2-4f9a-8eac-64f0c454224b", "comment": "Malware payload (Mirai)", "value": "6600bc87ec43460346baa48ea2ec95be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181377, "uuid": "40d61ef6-f521-4952-bbca-2c987877a61a", "comment": "Malware payload (Mirai)", "value": "4b8b81cc06f476cbce62fc9afadb4260891aaabcfe75308db3c0ce9cd36792e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181377, "uuid": "75e3039b-dd20-4d36-8a3d-db1c84b7e55f", "comment": "Malware payload (Mirai)", "value": "c52ebd4c4795f5ce0aa22cacb9408969c8ac8fb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181377, "uuid": "b1c3c121-3e08-4924-aada-2ef02a716989", "comment": "Malware payload (Mirai)", "value": "d0ad391103dab91a033945825cb78d8e789d42bc00bb3a8f6163414ee9c8a97ca273a479c7235c18d0affb26906462cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181377, "uuid": "522f4209-c31c-46e6-8a77-17394e8f6597", "value": "T1A8B3180ABFB11EFBE4AFDD3345B90749299C460621B97B793674D818F24A28F46D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181377, "uuid": "f56befd0-d225-4d25-bc29-cf81159c9cf7", "value": "1536:ApGIQ6S7FuCxXnIqZK30GzvxYCXDNRMcXivEHFG90rqj1MIY+Uj6UQM0RNQJsLpO:ApGf6fCxXIMVOJynx/HWNoBT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181377, "uuid": "5ddf6aa3-9411-433a-bef8-e1f6ef2c77d3", "value": 117800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181377, "uuid": "c511bb2c-2a44-469b-a402-50c2b6a72b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181377, "uuid": "d8c8c9d9-528a-46ba-bf72-cc5114bcf390", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3068ac63-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218756, "uuid": "2c412351-3323-41dc-8551-094de7a22054", "comment": "Malware payload (Mirai)", "value": "54b958fb5677e2bc059ece3cf4c61117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218756, "uuid": "2b95ff99-f816-43ea-ac70-bffbbfce8b16", "comment": "Malware payload (Mirai)", "value": "4d0f0490630f325f50724873b1f4aabfa13b60f7703e63f66e3bae77d5611046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218756, "uuid": "90c20d0a-d956-4223-8477-7e95dc5d5fd9", "comment": "Malware payload (Mirai)", "value": "579d4a2640176df8ff1f53e44d27a8289e4a4388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218756, "uuid": "d765d461-d42f-43b0-9dd3-dcfec0942980", "comment": "Malware payload (Mirai)", "value": "84db325ed63accb41385fb7c874d6ba970cf681c8b06df60a974adc3323b4bf9c5317074d7a1f2e324c97745bf31ac45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218756, "uuid": "53859194-e154-42b9-9406-c09cd8288a39", "value": "T1F3736CC9E983D4F6EC130A350136BB379AB3E53E2169DB83C3A9A525DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218756, "uuid": "c6e3bb6d-f510-4e96-9d90-5899a1038425", "value": "1536:Dbsv6XewvySsos1LNxVZW9Z3J8h3qaccSXj:DbsiJzsokLNx+9zs3mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218756, "uuid": "68c7d38e-6210-4414-a1f8-3cdfd68dc414", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218756, "uuid": "e679196d-9d7d-4c61-9d48-04ebd6b8194f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218756, "uuid": "962f8eb5-d905-43bd-836b-dc69ff75ff11", "value": "johen.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0517703f-efb8-11f0-a129-42010a9c0007", "comment": "Malware payload (KongTuke)", "timestamp": 1768223408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223408, "uuid": "dfbcb217-7373-42f1-b5e5-24f22efe9a88", "comment": "Malware payload (KongTuke)", "value": "8baf795aa1d9e4641cce8d6c76a0966e", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223408, "uuid": "d450a241-af8b-4852-b22e-4237753844cb", "comment": "Malware payload (KongTuke)", "value": "4d4973010dcdcde5727be619a32d4ef470924803dd22a8fc9de89331b8af6854", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223408, "uuid": "8756a4c9-72d9-4d57-80f4-c324fb72086a", "comment": "Malware payload (KongTuke)", "value": "c25b77bb178b21107cee0718c0669810e9188429", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223408, "uuid": "eb8fffeb-7738-4369-baf6-4f826654e270", "comment": "Malware payload (KongTuke)", "value": "3e785d859e30f3c001954e6295dd860f309a2407eeee06b63fc456133e24dd397d324b5bf49b14d42cff81f1f98e644f", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223408, "uuid": "7b4ef286-46b0-4b83-b1e0-22a2c7cea1a3", "value": "T1BE71DDE7E2E8CA5F646511E9952A310B20E0C6BE4CDF834465D2260FE62F810BF1B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223408, "uuid": "632363f5-0d39-4edf-b01f-e22b3fbba787", "value": "96:Be8xZqgFOIQqjkg4cj5pzelcj5pzeMptxMT1ov+pV:BJrq9ILjkHgilgiYteT1ov+pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223408, "uuid": "8e88c666-b224-44a5-b409-13281451a683", "value": 3729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223408, "uuid": "0600d759-72e4-4f14-b457-f50c9ebcace8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223408, "uuid": "c6fc0fa0-bac1-4f22-bf3a-c0f3f77569e6", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eae11aa-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217519, "uuid": "08d7c344-8382-4c7d-bc2f-974eafde3da9", "comment": "Malware payload (Mirai)", "value": "6373011eafc984e8d7bb4af2d5711114", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217519, "uuid": "6ab692f8-32e9-4cdc-bc09-5e693ab4b588", "comment": "Malware payload (Mirai)", "value": "4dbf9d792d78b726be3e718eeaf58d35fb3df533e64adb9bc832ac24d4db1322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217519, "uuid": "8b6f6fa5-5155-4e3c-b371-c203a0065f03", "comment": "Malware payload (Mirai)", "value": "0bed2d8012a34cad3e10a38113e01bf56f5b1568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217519, "uuid": "a47891b4-3c60-4fe7-9726-75ecc1c9cf71", "comment": "Malware payload (Mirai)", "value": "02561db0c6aa3eadc50251d31a7faca1b0170d8f431f2e73400ec3c00678327e2834da94b4572b938b01b74fe9162f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217519, "uuid": "64213778-544e-4432-aa21-268a5aad2c2b", "value": "T196E35E8AF402DE7EFC0BD57E44670E19F970A3653243072A529BFDA3AC311A64D17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217519, "uuid": "b3080f14-0d9a-4c30-957f-dce2923e2d3f", "value": "3072:Y2GyxF02S5gPoF3krbYFgEMfD/l95bDrKL1r:hS2S5ggMbAw/l9lKL1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217519, "uuid": "6fb01e7a-f6d0-437c-b7ac-a5eaa7d4fde9", "value": 146896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217519, "uuid": "742fa48c-31fc-4bad-bf5d-da598bb560b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217519, "uuid": "61ee167c-00a1-406a-9080-a9d05f3897f0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445fa4f5-ef5b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768183571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183571, "uuid": "e99b8e8d-b174-4f4c-9b57-cbab85bdc96d", "comment": "Malware payload (AsyncRAT)", "value": "028a8554ecac010f61460f61f39fe6a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183571, "uuid": "69a64655-3b6a-4c0e-978e-f2c57c6e6186", "comment": "Malware payload (AsyncRAT)", "value": "4e7aad5aae4727d9f052d1c18e70f8936c7345c00ed3ab74cc0d59c285137afe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183571, "uuid": "974b3160-913e-4ae9-bc4e-90eb0522dcb5", "comment": "Malware payload (AsyncRAT)", "value": "55eab30e11a8b13bcd994fcffe6053d573548102", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183571, "uuid": "41b65568-fd52-40a0-b456-30191790d7f9", "comment": "Malware payload (AsyncRAT)", "value": "86f2a063c12420a72b83c9c181d06f7bdcfc725e3626ed86bbde9f36baeba8e4927dc00639adb334f22c033705fc61ca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183571, "uuid": "20b371d1-9c19-4502-9575-9d6bc1ed4582", "value": "T101535B002798C962E6AE4AB4BDF2550046B5D5772102DA5E7CC404CB6BAFFC68A137FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183571, "uuid": "ed113ccb-f292-4305-b32a-7e2a69d8c744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183571, "uuid": "6111f594-05d4-4dd3-9e2f-e260f18f123f", "value": "1536:epejH81wTV/FNDDegHUbPbbbwj9JN6Gz4VclN:eh1I/FNDDeg0bPbbba9J3CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768183571, "uuid": "a62d6859-8c6e-47d2-99ec-1157a0c8d076", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768183571, "uuid": "411686e9-7751-4372-97e7-0ac3fda8ad87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183571, "uuid": "de0b0b8e-abe6-48bc-ae6d-4e1ac28a2309", "value": "SecureShieldAV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccbe34d-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768224817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224817, "uuid": "b0427b8a-dec7-4ecd-85cf-4867aff7aed1", "comment": "Malware payload", "value": "9aec093930a198c204b1e93d16822cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224817, "uuid": "e545d9aa-a271-4dbc-b324-da8436f10aa2", "comment": "Malware payload", "value": "4f19d80a986040cc716c921170748201fc5c4847c7e76c59fd5fb34a77d8873b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224817, "uuid": "0a874c79-ee9e-4fe1-bc95-126d8de29c92", "comment": "Malware payload", "value": "f61199d5573660e27b6f3393b2fc9c246d6fea6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224817, "uuid": "aab9618a-084c-4297-91f7-11c1b50c6bff", "comment": "Malware payload", "value": "f4d854e5d1287690586d26586dc332e27ea816bfa5700028cfadd3b9cb2d4be055631d6ebe0f0124c715636cad5741b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224817, "uuid": "c8f87d2f-71a3-4c9f-aa0d-d5c67b148abd", "value": "T172F733540E30B8C4FAAAC23685D14E0CBCA6768FD21F594B17F899722E1B3957CBF512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224817, "uuid": "d4f13d01-f3fd-4399-b2b1-e1a7a5ae245d", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224817, "uuid": "1d62ed66-2448-4a1f-b438-b192dc1cecc9", "value": "1572864:C/3QK22YgqTLX5WJoWbgWRSgkNOXWxtQSNvFhPyKK0C2ZxP:a3z18X5M3gZcKCghPlK0jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224817, "uuid": "e22fbc8a-cd93-4fcc-8b7a-e488822711a7", "value": 70728790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224817, "uuid": "25c6c4ac-1728-4226-99a3-4db87ac6c8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224817, "uuid": "1c74cc73-ff86-4940-a1eb-38edac6512ef", "value": "WindowsUpdateService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36cf2a0-ef4f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768178711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178711, "uuid": "ced78f22-5e69-4dcd-9801-824fde78e8fe", "comment": "Malware payload (RemcosRAT)", "value": "1614a8ab1ed65c8cb57c4a12238d924b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178711, "uuid": "bc66270e-6b4f-4980-8b86-2fd606ed5a5a", "comment": "Malware payload (RemcosRAT)", "value": "4f1d21c87c3ddf2dfc3bc4e42ce0f93d406637fce46aff5415eb85dfbe05c3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178711, "uuid": "102dcf97-7fd8-4bc2-b0e2-95abb3da2db5", "comment": "Malware payload (RemcosRAT)", "value": "68ce0c1a73916ffa2d839f05d420782d2c9943bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178711, "uuid": "cf68a8a4-c16c-4e5e-9c87-ce36a3f0e9f6", "comment": "Malware payload (RemcosRAT)", "value": "c71a3b1b654682ade420f8fa5f97fdbc8947b572693c50cf3af7ec94795f19f4fbae41d3a7dbc393c1285bf825e418be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178711, "uuid": "9e84dfae-111b-464b-a03c-dee5978c3884", "value": "T1AC45D01273DE8361C3B25273BA25B701BEBF782506B5F86B2FD4093DE920162525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178711, "uuid": "1fca14c0-4b91-4afd-ac9d-d8cd50cb7868", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178711, "uuid": "2748e872-fd48-4c55-986e-c383624d12d2", "value": "24576:Dtb20pkaCqT5TBWgNQ7adwLCRgVv1vPknUTogxhhT86A:AVg5tQ7ad1RgJ1vqUToehh45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768178711, "uuid": "c3919c8e-2138-400a-a4cc-6efb608ab328", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768178711, "uuid": "872df2d2-de0b-4b09-8d8d-d366207fdb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178711, "uuid": "1cc9c026-fc2f-4ff0-989f-07efd650cdcf", "value": "RFQ Q2D2471164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc30021-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218698, "uuid": "1a04fdee-af0d-4bfb-b2e0-29ce9fe3508d", "comment": "Malware payload (Mirai)", "value": "8c44b7facb82a22133fa782317ebcf0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218698, "uuid": "d13961da-1b87-4dd5-820e-052c23b87eae", "comment": "Malware payload (Mirai)", "value": "50bc3dd71f99c5dcbd6b9c4aa246e4f5ab108379416a5283cee28ee916236e6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218698, "uuid": "b02c4690-5d01-4bae-8399-d68d952b29e5", "comment": "Malware payload (Mirai)", "value": "2a2128972dc263dcf6f3e0037b47929b26ffe9d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218698, "uuid": "c9380601-2cc6-4c30-9ba6-f2e5e1e9d485", "comment": "Malware payload (Mirai)", "value": "60dbb54e31aa1d005eb0810516a1216efaeff4770ee6317627338839aa1def0b21af7ca531e57d4cfc3d0d517192fef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218698, "uuid": "c6f29a33-9863-4328-bf09-5d473ca8a6e4", "value": "T1139318C6B401DC7DF80FDABB4463290EB631E36156831B26675BBE53AD721E05923F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218698, "uuid": "30d8bfab-a306-40a6-9e02-dbe48cf53ca0", "value": "1536:6sdLEbXJld35is6pRA7O7X7LW0XM9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1kE:6DiPpAO7X7ww2ed1nqeTadgqGCm1Hq+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218698, "uuid": "9f573f16-45e5-4d77-8a3a-ad6e6264acb4", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218698, "uuid": "e2b03314-465f-418e-8321-040054608341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218698, "uuid": "ee7553a0-f271-4ad6-a6fd-fa41e0fd28db", "value": "johen.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0788e29-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179109, "uuid": "2728df52-ee8e-4427-8717-d86f7c09d73a", "comment": "Malware payload (Mirai)", "value": "b27ec5bbeeabeda6e7e2b5f7afabecc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179109, "uuid": "a72db2aa-1b52-418d-8fb1-eaadf5962857", "comment": "Malware payload (Mirai)", "value": "50bfe8203d5b152f38b7e39e4067e17359d38d63e82611c13a383992e5483500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179109, "uuid": "ce3ea80d-2b97-411c-ae56-d4759857ef08", "comment": "Malware payload (Mirai)", "value": "50fbbe232f24be250d0f033974113f2764465991", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179109, "uuid": "5d6d5f84-c984-422a-98c3-fb313b19639d", "comment": "Malware payload (Mirai)", "value": "b6ab6a3ebc1d2ae3b5418858d4129efec18e2744f540674811c2fe45c141dda259dd085a5d675f38952afe687763ca79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179109, "uuid": "42c69ca3-66b0-4a22-a6f0-5f27cc7a4171", "value": "T1DDB31ADABC819B11D6C566BAFE0E518D33134B78E3FA7103CD145B2E678A86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179109, "uuid": "77a9e7a0-cbd8-4bfb-afa3-c6eadd4592cb", "value": "3072:+PhTWETikB2ELXTgQAcnihx8Kyz6n6z1MAeBvEVX8+wcT2:EBFDgQAcnivy6n6z1MvBvEVM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179109, "uuid": "d3da428c-125c-45ff-96b6-578235a8747e", "value": 113432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179109, "uuid": "63929553-c06d-44a7-bd4f-53f449651e6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179109, "uuid": "532fcb01-5d36-4533-8aa3-fecf8d603626", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275b4a99-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181375, "uuid": "7beaccb5-7c01-42b0-a35b-0eba63c01ee1", "comment": "Malware payload (Mirai)", "value": "037fe5595988cf4735c6cdea7441fabd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181375, "uuid": "8b97fcb4-c526-42d2-8569-b1dd1ebddde7", "comment": "Malware payload (Mirai)", "value": "5144206994d9f645ae4fb20d602b8a41e9ec20ace5fd07df033fc4913e6bd5a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181375, "uuid": "d371bf8c-d27e-4c29-900d-12a92bb32f20", "comment": "Malware payload (Mirai)", "value": "26cf7eb5a916cda18c3a4c81d3912a22e2464a3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181375, "uuid": "eaf358ff-76a4-4d13-b115-62c149cd1ecb", "comment": "Malware payload (Mirai)", "value": "d4b0bc2451d46d529cb74d779cb50502ca2e779d8040a2d012a2ace6a735b982d7e72a381ae331c55af7b676f92abc9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181375, "uuid": "ab0f5896-6ff0-4bc6-9f4d-c8d2052fb688", "value": "T1DFB3D74B6E629F7DF32C82354BB78B36AB55239133E0C585E26CED401D6038E586FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181375, "uuid": "59003bcc-9b77-4f5c-934f-f28130a62dc4", "value": "1536:ghMnILXzfJzfnLfgFrR9pHfxSr3/MMFGwMg2kCL0DWp1VFzQT2bVReb:WEIeV//xK3/MMFGwMgj7DWfzQT24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181375, "uuid": "354371c5-dd67-4144-a2a2-b2c953669ea7", "value": 117544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181375, "uuid": "51f50b2e-dc46-4814-8539-0746bf46e64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181375, "uuid": "b13e2d85-5ba9-430e-9d58-5b321e83090e", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b992c76c-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211256, "uuid": "d9c8692a-8610-432b-80d2-b636e0283a98", "comment": "Malware payload (Mirai)", "value": "c393e6ef9baa02e032da1248e562bee7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211256, "uuid": "735d7a1e-47f6-4ab3-a42b-35d56059a91e", "comment": "Malware payload (Mirai)", "value": "518eb0939d4f2f2a51340766ce03e4eba87a0a506991a614b87b77f6d5db1327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211256, "uuid": "e0f61264-2b7c-4b5f-94f7-b020d012aaf7", "comment": "Malware payload (Mirai)", "value": "a797b404b86f78088936b99b45cfdbb04000138d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211256, "uuid": "b780bff6-61e0-4351-8071-d81acbedbda8", "comment": "Malware payload (Mirai)", "value": "294ba86f3ce4f726bce5ed5a40c963a78310951cd311c57b6a8f8a2e49b021cd60bd30c88e5e792df1264d609b4ac3bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211256, "uuid": "4be782cf-916a-4f30-a9a6-3446af972110", "value": "T1B604981E2E128F7EF668C73047B78A25976833D627E1D644E1ACC2145F2039E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211256, "uuid": "81ad5f59-43a2-4aae-9832-d5948bab4b33", "value": "3072:AOkpLvedQmXHoPxdvzyC5HxNPDNKMg+/Hk1jlZkEdjyngYNn:AOkpEQm3oPxdvzyCnNP5Kf+UlXjygYNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211256, "uuid": "401d500e-3a7f-487d-b3ed-0a030206eb9a", "value": 181840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211256, "uuid": "ca3403cb-e404-47f9-bce9-87481880778c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211256, "uuid": "f780d539-22f7-4a77-a24a-bbc1606722de", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c9f9a9-ef55-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181075, "uuid": "4429ed80-0c0c-421d-96c6-4b4b5cabc557", "comment": "Malware payload (Mirai)", "value": "00e79e0278fc87cbe46999fc93189812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181075, "uuid": "83d1b93c-f4c0-4549-8ac8-337f58d5be0d", "comment": "Malware payload (Mirai)", "value": "52949152fdc15d44c5cf49af9b2c244d2f8342415247c9e351e7b841a7e316de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181075, "uuid": "36bde8cb-4378-458b-9edf-38241f3213df", "comment": "Malware payload (Mirai)", "value": "97a5020f179b0c0e2b77a056401b54fd09a36b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181075, "uuid": "7bf7b995-b35a-475d-8509-e6adda59772c", "comment": "Malware payload (Mirai)", "value": "f0d06a3411c50928ad58b091c56809954e6b11bd56716ef574a3f4f86b6772556c40c5e8d77e26d6cc998c99c68a4fe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181075, "uuid": "bc3be699-0dfe-41c5-8ec8-e1e350004620", "value": "T137733A91B9815613C6D112BBFB5E02CE372613A8E2EF7207DD22AF21378785B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181075, "uuid": "86634741-5b0a-41dc-ab8c-2cc5b73b9b0d", "value": "1536:c1VzhypU0Lw5zIeQJqFd82Ox/FwhO9NsFaZvzs/F:c1Vg84Jq77wb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181075, "uuid": "c609545e-96db-4ec2-815e-1ef6bbc38551", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181075, "uuid": "65519506-4d16-4971-af35-6142fb76ce93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181075, "uuid": "0ad3390f-db91-4195-a4f6-5508fec9c50a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede9e54c-efca-11f0-a129-42010a9c0007", "comment": "Malware payload (Grenam)", "timestamp": 1768231530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231530, "uuid": "65480319-689a-4661-8f42-9eeb93593581", "comment": "Malware payload (Grenam)", "value": "b661f625a23831651ea53ac1a5b375b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grenam", "colour": "#BA14B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231530, "uuid": "13369e57-14d2-4064-ae7b-d33e7b15098b", "comment": "Malware payload (Grenam)", "value": "539237581e29cd00713ff5d0c1db24e647a95a2d65371b6602b9a72266dca94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grenam", "colour": "#BA14B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231530, "uuid": "4f7ddf04-4972-403d-8acd-d85fd5f355d8", "comment": "Malware payload (Grenam)", "value": "6d48ea249ffa15f752568f428b8b4ce33d548953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grenam", "colour": "#BA14B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231530, "uuid": "c9bdbac9-2122-4957-b8ff-7d653f23553b", "comment": "Malware payload (Grenam)", "value": "4db425fbab23a9969639c1c65035072f367a170a42ab7d108c92b8b7171f81a9311f1287b6ea35bf55cf923c561c0e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grenam", "colour": "#BA14B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231530, "uuid": "ba025b5a-bd3d-45bf-a308-8c3504510342", "value": "T154B49F71F7D09537D1371B788C1BA2A9983ABF102E2864467BE81D4C9F397C139292E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231530, "uuid": "fb126de1-612b-413f-9441-5d897bc22688", "value": "9a06f0024c1694774ae97311608bab5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231530, "uuid": "1d12620a-f2cb-436a-911f-66c9aa4c45b1", "value": "12288:VcMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUxjVR:GZyCA8CBmn+RrNj9ay5GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231530, "uuid": "5088bb88-9432-4781-8dca-1529fbfc43bf", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231530, "uuid": "b4ff974a-25a0-410c-8eda-6ef60320bb5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231530, "uuid": "9904f006-4d69-4848-9f0b-bb17ef896ba1", "value": "Tgsetwpbuhlemyv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4f49d4-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1768237537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237537, "uuid": "5bb7dd77-b14a-4e49-9f78-87bbccacbc95", "comment": "Malware payload (GenesisStealer)", "value": "22458a6133c4c00c1548a87bab750118", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237537, "uuid": "c7eb6255-9b7d-438c-9c2c-6d65b9e56b39", "comment": "Malware payload (GenesisStealer)", "value": "53e9331d17da4085bd7de89bec59f81360b1ad8aca89c895513e35ab3ea71fcf", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237537, "uuid": "f2138857-267c-43fa-b9a2-d69bd06d2cbc", "comment": "Malware payload (GenesisStealer)", "value": "4594e079a599a24ec71bcede362579d1daf8ef8b", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237537, "uuid": "d4a50ed2-27b0-44fe-adfa-4aa2b892a71f", "comment": "Malware payload (GenesisStealer)", "value": "3486d8007023db3eeba426f9c97e9e88e5a3af008958a109e6c1fd6fffdc9aff2cb1bf1c511d75717fa3c9fc73d0eaee", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237537, "uuid": "a74bd15e-164a-47eb-8b92-1b83453c0fae", "value": "T1E6E4E141C48E98B50365E22F12FDC3E9AC7C4780C16C5EB776BAD76398084B7A4B3DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237537, "uuid": "5c769fbc-b68d-4116-8f4b-8b85baf826fb", "value": "12288:dFhk7++e4xbm3GnPg5cwarFKxQ3cZqbHlA7VTumAMxq4MYW63UncjqOFQl491/Z0:dFhk7++e4xbm3GnPgeJEZaHlIVTumAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237537, "uuid": "c126a994-601e-4d5f-8a12-695a67564322", "value": 680501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237537, "uuid": "cce16a71-924a-4c51-8d62-a34e6c590f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237537, "uuid": "82dcba9c-9bb8-4fd8-a720-69d103e8fc3c", "value": "00005aef00762387.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379868b0-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768246256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246256, "uuid": "11949c43-b884-48d6-a9cf-3e746ac181f9", "comment": "Malware payload (Mirai)", "value": "a032e3ee4ec6b8a1df08b1745b196e1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246256, "uuid": "dce4c2fb-8532-4dca-b903-f6f83dd619a4", "comment": "Malware payload (Mirai)", "value": "54108ab3f417608c465f3a1179e85b0a8b1e5497a6c27cf5a085e850c4df7603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246256, "uuid": "c3a3dd7c-916b-4fe8-8248-0d33c7c135f7", "comment": "Malware payload (Mirai)", "value": "bed05f52b2cbe8205b05afc54b758fa2d9cd90ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246256, "uuid": "d1f0fcaf-cd8f-497c-a1db-908fcaf029d4", "comment": "Malware payload (Mirai)", "value": "ceacc82d15852e6d0cad16f4af8bcac17d1918b5578dba98c9090a5790d6697e15b4fc1ea4709c5350a351e36386396d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246256, "uuid": "b18fcf6b-a784-45b0-8792-945015ea58da", "value": "T1BED3C65E7E314F6DF3A8C63447B78B31975933D626E1C681E26CE5052EA034D281FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246256, "uuid": "12e079bf-feca-42b8-b225-f756539a1493", "value": "3072:BqKouHF/ikux5twbn3Ds0gQEzKe8UPAn4BEPSKRyRt8Qrfc:BAIZFuz8UPAnj6KQRVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246256, "uuid": "eb636472-e650-4341-a7fb-5b184506b6a1", "value": 139520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246256, "uuid": "ea78f2db-e906-4199-a585-eb69d498a9a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246256, "uuid": "d5aae1c4-54d1-4204-bf9f-61815678398b", "value": "mips.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80986553-efd7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768236930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236930, "uuid": "e5199611-dc11-494d-b1c5-ceeda08c61a0", "comment": "Malware payload (Mirai)", "value": "c8a6fb63415efbe5f70440cac12c3266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236930, "uuid": "706aae94-c192-4e01-abc0-5e34e52d558a", "comment": "Malware payload (Mirai)", "value": "542b12c4c06133955d14d2b5ba907b552644b88c852f478a9fe038db777e482e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236930, "uuid": "c4feb0e6-b81f-4cd4-a3cf-81c0860357c7", "comment": "Malware payload (Mirai)", "value": "0c7530bf35a732b4edcfb17ee6a618b0246c39b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236930, "uuid": "cd919249-ea14-4823-80d0-44240ffb9097", "comment": "Malware payload (Mirai)", "value": "cec1f4c233b1e16086fc039021436b61530ad2d801308b20eff0bfcd518f1584e1e3204325398e65d17a0c8b9b0d3936", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236930, "uuid": "acad4acd-da74-4656-9881-e596986b3508", "value": "T1F3243A46EA408F53C0D727BAF69F4245332397A4D3E77306A924ABB43F8379E4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236930, "uuid": "662999f1-7b1a-4b11-81d7-096babcf0253", "value": "6144:ZTK6ZSzYp8/FzaEOA3zHpz1tzWFgfl3theM/Rdm12JLGhQH:hK1j/FzaEOA3zHN/SUnhX/jm1sLGhQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768236930, "uuid": "6896929a-42a4-4b3b-90cb-fcce32597f97", "value": 219706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768236930, "uuid": "fb6e02b0-bb90-45b3-b12e-0f84ff8ac604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236930, "uuid": "c6085e0d-a8fb-49b5-a422-90ae8e1334eb", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fd06b1-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218759, "uuid": "302b1605-16c3-4f70-96cc-c9e1241733ac", "comment": "Malware payload (Mirai)", "value": "82bb2223910cbbe615ceaf08afed3a6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218759, "uuid": "aab63f11-4ea7-4a70-8f44-3663aed4b4c7", "comment": "Malware payload (Mirai)", "value": "553f9449bdd669cae781f76469045dd09c25e60e9e0c03fea924b711f64cc98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218759, "uuid": "38144443-f58f-4773-88d5-ece691075a03", "comment": "Malware payload (Mirai)", "value": "128f5bc250d23ae3e4629a8ce78a40b6252d5ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218759, "uuid": "3fdd377b-6500-4f88-8ca2-de843a71d17f", "comment": "Malware payload (Mirai)", "value": "5ca8d566f9f7d737a13691a09131bbdeb8e4c8a3ec2a1bd468c845b8c36b93d94ed58bc04938a016f25fa1db7c5b1a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218759, "uuid": "669f7f8a-7cc8-43c3-8807-22360b33e5ef", "value": "T197431780F8D2996EC6D4137AA73E318E33A1B3E5D1CA3613CD945B25338A6CF5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218759, "uuid": "3c7995bc-edcc-4d8e-b59b-132660a3157e", "value": "768:Ecys8ng4d08tmpydYQoyZEFM8fB958jdS8kIf4ubnJ2oN8RR43rMnBN3TWnfKmz:E7nZd04CW75EFMg8FfRbnJko7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218759, "uuid": "85fcb3b9-d732-4771-a770-49a0f9db65e9", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218759, "uuid": "7425aa98-9744-4d69-930b-015e71a14b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218759, "uuid": "7b5f36db-b27f-46fb-9e6d-6c04fc77f929", "value": "johen.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7263bb86-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214572, "uuid": "b0e160f6-7714-4ca6-9c83-f733c0fd1127", "comment": "Malware payload (Mirai)", "value": "7acacc75fa88d890698afc282330bcec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214572, "uuid": "935bf33c-db75-4d35-9def-67368674133d", "comment": "Malware payload (Mirai)", "value": "5551961b76444da10f45604c893d45304ac3c09e36f4ca8e88b56e049e43f350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214572, "uuid": "b4642146-36fc-47cf-b730-8455951d7699", "comment": "Malware payload (Mirai)", "value": "949c2f9c2f480c1d7676e56726894ad1e47ca0c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214572, "uuid": "f5191e27-93b4-4cb5-9f41-ee0e0bcf7afd", "comment": "Malware payload (Mirai)", "value": "53102e393e04936b617ce9ba612fd1d48764803331456cfe514dad42c1bbd429755b8a8b381fab3b7a31d06104645bf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214572, "uuid": "c3c8adad-558f-42d0-8015-4e693bea3d71", "value": "T1AA73B652B8C29107C9D4A6F7F71E019E330513A8D2DB3307AC266F613689D5F0EA7E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214572, "uuid": "b7694716-c63e-45f1-a207-dd587ca6084b", "value": "1536:V92GQFxoY79eHxiIYAtTuOxz2cIi+a3gvk+dvTi:V92GQFxd79eHvPrKEgRdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214572, "uuid": "44b1f1c8-b1a3-4e29-8240-5f519dc2b82d", "value": 77596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214572, "uuid": "1a409a54-9916-48cf-82e9-c03a7ba3d0e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214572, "uuid": "1d2d945d-ca29-4a3f-9492-98902c09adf1", "value": "shadow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b156fa-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223282, "uuid": "6803a263-5d6b-48b9-80f9-663b01250e21", "comment": "Malware payload (Mirai)", "value": "facc1def385d476c06063ee366e7b078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223282, "uuid": "04aa397b-5c1a-4926-a2fa-8a52ff326044", "comment": "Malware payload (Mirai)", "value": "557dad446a66edbfd36d8df4906c6ad3e4bb32ac5350168f16bb6532aaaa6927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223282, "uuid": "66cb1e5b-759e-4841-9881-71734e97078a", "comment": "Malware payload (Mirai)", "value": "2f5d40307a8d53acc23b3b75913f8c1646794b13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223282, "uuid": "fa6b45e2-6528-4d5e-9b48-4f27e93b801d", "comment": "Malware payload (Mirai)", "value": "f6770e1c7162132a5fb0171891d8ccd2dcbcfea59624616894f4af702335a57525e33c12d50e1230453785822c6bb794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223282, "uuid": "6fa828e8-e6cc-40b2-9357-f31bc5cc51d8", "value": "T13E933AA6B400DC3EFC5BE2B3C4170F15B12477A45E422F27B626FD67DA7D0A8681AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223282, "uuid": "0d1ed4eb-1fd6-44e2-a801-d17aab0b020f", "value": "1536:EQWg4JrZpb65oXNsXgR7F4rlY7IJMLDoQK2RElFDOf3PF5OVKpHVR8IWUETPp:EQWgcbO5oXN+a0X2uFDOF5sKpHVgUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223282, "uuid": "ee76d7c9-5d21-43b3-b668-3cd9f629aa8a", "value": 94864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223282, "uuid": "2eb4eb60-cc26-4cf8-a3dd-619fadb8d123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223282, "uuid": "716ffeeb-eec2-4fb8-bf56-0430a720c664", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ecad5e-efa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768217254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217254, "uuid": "0fb30f81-8b35-4be1-9c9f-dcba3baf5da7", "comment": "Malware payload (Vidar)", "value": "42d0cc442b4c4cdaf5f7def4785f0ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217254, "uuid": "21c8b22f-d08f-48e5-842d-dcc5425c0bbb", "comment": "Malware payload (Vidar)", "value": "5614d13ea00bc8060c4ffa33693fecb3c142713d1b6633f1a211845185b0ea2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217254, "uuid": "a5c3f132-1363-4f49-a245-fb2a7d778d3b", "comment": "Malware payload (Vidar)", "value": "3bfe9bda4f3e2740dafc1179824c33a8526e4a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217254, "uuid": "2b53fc29-7565-4992-b5c5-ae8b2f0d8089", "comment": "Malware payload (Vidar)", "value": "3b8886dec28fc4e0bbe6cd9d625707b0aab570c799735061bdc8873bfec3a3ff1a23cd46446ec76045490626bfcaeb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217254, "uuid": "cb8c20d3-f24f-4edb-b9eb-98d91c27bb7b", "value": "T106964AE2FA408675D6DBF239D961615A6230B448133510D7BF660BA48C6FBC4273BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217254, "uuid": "40f83825-f3f0-431e-9482-0eb2dc787060", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217254, "uuid": "d6d51f28-dcbe-4019-89e0-9307efe97e69", "value": "49152:lveX9gGmnrb/T0vO90d7HjmAFd4A64nsfJXU773GzxW7G4j9qVCJqkmG2rgp3xOC:6mWjDb11s+jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217254, "uuid": "dcededfa-7093-4670-971b-ffce99f3041e", "value": 9376896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217254, "uuid": "95d09109-721b-45d3-8d30-5241716c4c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217254, "uuid": "96c3ff9b-6c38-43b8-b674-0e902abc3cc7", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b495409b-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1768231004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231004, "uuid": "8f597232-118c-4dea-a44f-c6b71bc0d71e", "comment": "Malware payload (N-able)", "value": "9d6c50e21bb3e1b2201431c64f7cb92a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231004, "uuid": "676ea04c-d019-407b-9e9e-dca32547c1ff", "comment": "Malware payload (N-able)", "value": "573a4f43d7e8ae8618e201be2b9f4e9198257ae4c1f730a751f0ca49bf08e8f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231004, "uuid": "fddfdb57-fcac-4fa8-bb23-324426397892", "comment": "Malware payload (N-able)", "value": "9276e69e57fdb8463166663b8a591904201a2127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231004, "uuid": "2be94ee8-0af3-4011-93ea-7e0941d02dda", "comment": "Malware payload (N-able)", "value": "a997a83df0cce0fc8096baf84b6c4c6f39bb14c16cc453c98368edee3a8a61ab153fd0d72a426aa8565d919583c7b011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231004, "uuid": "0b2a4443-bf4c-420f-a4e0-e0b190c75fcb", "value": "T1E7E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231004, "uuid": "11699ecb-05ac-4982-894c-d9023014e18e", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231004, "uuid": "572e1cf2-e21f-4712-9607-40079419c08b", "value": "393216:8pF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1J:wrRxvoC/7a0jUxX7h1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231004, "uuid": "6d42fef1-bde5-40ce-a50d-9fb7c1f7e663", "value": 14782000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231004, "uuid": "843f7f08-9242-4ae3-99c4-95045d091e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231004, "uuid": "afa39724-bccf-41fb-ab8e-fca6c5af8579", "value": "FicheiroOrcamentopdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071b1104-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218687, "uuid": "ced8ac61-5aef-4f97-aa28-f70dbb0b8e7e", "comment": "Malware payload (Mirai)", "value": "fe862431b2e446d5cca103e4940fed39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218687, "uuid": "464d6daa-a8fe-447c-85fd-87e4dc51a91d", "comment": "Malware payload (Mirai)", "value": "575b2bfeea9646417fb699b0a24f7b574ed1232e6b7431fd1b67976fc8362836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218687, "uuid": "62f6b5d3-1ec0-4c75-a5fb-2d343eae19db", "comment": "Malware payload (Mirai)", "value": "0cdb05b6368d132b3ca87088f767ed0d8cec3ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218687, "uuid": "6edd1446-2e7a-473f-9f20-8cb1a33c940c", "comment": "Malware payload (Mirai)", "value": "ff0154d83fc792dbf516d7106e62954b014ef2e23de162051eb70ec3fc9b7111cfd8a530b976a56cd73ae63417d47217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218687, "uuid": "8a4ab9ce-9e92-4234-b66f-40891d4bb045", "value": "T1CDB2E035EAD549A0C570C5B1EA34CA4126EB4374C3FE7BB27512867861C354A6FBC8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218687, "uuid": "b6a54079-273a-47a5-8a28-776dfc798bf5", "value": "384:GVUAgwrUshIYowFf/IHqkWQIouYHG0MW3nQFud8iN8A4kGEoc/ChymdGUop5hut:uYwpAHq/QhuIG0MAYud8OGp7s3UozMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218687, "uuid": "3f772ad6-9c74-4e00-aaea-cb3c990686ba", "value": 25120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218687, "uuid": "a4ca63e4-cee2-4d38-a31e-809f8afec000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218687, "uuid": "86a996c1-a250-4212-a664-ff323e6253ec", "value": "johen.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52909453-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217525, "uuid": "8a710270-ec6f-4f90-a3b6-4e32d43f0b34", "comment": "Malware payload (Mirai)", "value": "25db94c351d4e731bd67e124b4fdd976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217525, "uuid": "502c4a3f-b5e2-44a0-9c3d-f316e4e06daf", "comment": "Malware payload (Mirai)", "value": "57a4f560fccbf26528b58807f7e72f1cc504d490360c0ff1843d61a9a49cf2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217525, "uuid": "45d33612-30c5-422d-a736-6bee74392874", "comment": "Malware payload (Mirai)", "value": "8893e40f88d1a6507778cf670364c022a9d0ceca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217525, "uuid": "3cc1e17c-04f4-4f0b-a0b1-923b065f5e30", "comment": "Malware payload (Mirai)", "value": "115eb322f0dfcdd54dbd6efa052e48d50ea8ca7aded6b96db66bda435fb566e30c6700a009a69f32124edd054fa3e257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217525, "uuid": "686c52e6-d1a9-4400-bdd7-e9d36fb561a2", "value": "T106F3C50E6E198F7CF79987344BB79E31965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217525, "uuid": "2eae72b4-d321-46e0-9dab-ebfe2d304adb", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwM:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217525, "uuid": "b0d36c0f-dd43-487d-b606-2eb97001b137", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217525, "uuid": "0c178a11-2fa8-4186-9074-d0d5506a29a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217525, "uuid": "e6c3158d-d10f-42e5-8700-3e5bc298f210", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a87283a-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218693, "uuid": "4047a6d8-3762-45df-9fd0-a612a5dafa82", "comment": "Malware payload (Mirai)", "value": "f7cda44ffbf8feb6db2f3800f4ffa93d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218693, "uuid": "52f6cb38-c7d4-4796-96a1-1ab1e8967732", "comment": "Malware payload (Mirai)", "value": "593d5a0d6d616bb94d26292330c33f890a3e56a795d5cd9dd3f7d6542a07fcc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218693, "uuid": "03c9e0f1-dba0-4a35-8b34-d6533eef0906", "comment": "Malware payload (Mirai)", "value": "da9f55c6f2cfe81589a5d7769a94ebc5950e4b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218693, "uuid": "fa5a67c3-fbd3-4141-b8df-7945469c978c", "comment": "Malware payload (Mirai)", "value": "d540f46cf628780eb3b3db93e4697f24989da5cdef9d671d3ccbf765386a9f536d502d83e1a82be29eaf644670295e9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218693, "uuid": "e93da383-3001-4c2d-98f0-0162ac02650d", "value": "T1F003F218F3402D64E6A37F3062A89EDCB3E5C7FAB3259FC09256C7513A23919E125EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218693, "uuid": "6e89b388-6d38-42ae-8ec6-6749d1162c8c", "value": "768:Mj7Jzmzi7ygo5RGtRTd2ZrvAU0lgySOTPDRm255Ig4uVcqgw09k:3m7y9rGT8T0hSaPDn74u+qgw09k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218693, "uuid": "744b7410-0761-44b8-904c-fb1bd8e7e22b", "value": 40124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218693, "uuid": "e2494920-985f-4b74-940f-1b124fb91fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218693, "uuid": "6a614027-971e-4547-96b8-4482439414ed", "value": "johen.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b758c23c-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211252, "uuid": "e9945be8-db08-43ad-bbce-28b31bdada0d", "comment": "Malware payload (Mirai)", "value": "6231491c570d519c2b0a4544e889800a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211252, "uuid": "383bc1b3-7346-4411-8e08-3f0779e68620", "comment": "Malware payload (Mirai)", "value": "59550b1ff7d3136d481a8236695accc30b05be8f7bc75115b24a21b0217291ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211252, "uuid": "8e51cc2d-7690-4765-996c-1e8f67067694", "comment": "Malware payload (Mirai)", "value": "efa01da0381e4a6ed2180e238d0dd412cca7285b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211252, "uuid": "86a56f4a-add0-41dc-a5c6-f92f5744f589", "comment": "Malware payload (Mirai)", "value": "f7416a50b62245e42ee9795e1da950a6add00158514ed0bd9e2d7e4fce7be01daa54bfd7baad622c4266704ef0652e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211252, "uuid": "4421dd4a-6ec7-41f3-ac48-1836646db09a", "value": "T162D33A05B30C0947D2632EF43A3F27E193EFDA8121E8F640755F9A8A92B1E325585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211252, "uuid": "069e59d7-b107-4088-8897-ccb3efe0e44c", "value": "1536:DPAko1FKt4ZGf27Hx4M7a3HnPw+HUWxuyhyvAK7JPiVp7Hqxpj9euEOrCl:7IXZI+xuvrHUkuydKLlrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211252, "uuid": "e0aadf92-4ad0-484c-a9c5-c4a3e9696b1f", "value": 141984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211252, "uuid": "214d095b-5d69-4250-9fbd-4120f4ea1efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211252, "uuid": "f8526fc2-fa5d-4476-91fb-49d3fd21af89", "value": "bot_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194d8970-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768237186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237186, "uuid": "a329d85a-bbaf-42bc-8c30-eb695e2c5be5", "comment": "Malware payload (Mirai)", "value": "6453e713b6ca1b6a2ede3d8f0de770f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237186, "uuid": "1301e15c-d06c-47fe-97a7-104f8c87a3f6", "comment": "Malware payload (Mirai)", "value": "59f2700d39333b37c7e3c42ea59a8738d2ec4a53c77c22b3bf72ed51d8d85080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237186, "uuid": "2ddc9400-2236-41c6-a047-9a40773f821a", "comment": "Malware payload (Mirai)", "value": "121cd90f88c595bda6081716b98fcdd28330435b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237186, "uuid": "7c5a0af0-adde-4734-b5c6-82acd24d1c96", "comment": "Malware payload (Mirai)", "value": "25431529abdd39a89f4e33a69680d369c02f3ae4badd0c6094c88938d8fcf9d47d12a1d93cc61b506b7b70da31e87c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237186, "uuid": "de399b68-e86a-4ce5-86c5-9328588171fb", "value": "T1D2F31A56F8818B16C5C211BAFE1E124D37131B7CE3DE7212AD246B707B8B96F0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237186, "uuid": "272c152a-b828-424c-8cef-ab968809ed19", "value": "3072:22YnJWH+/Qh+DXXT27rCEacFQCbQBAD2Mdbp+xrJP6hh1hO:22YQHgaQXTgraYQgBD2ML+xtoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237186, "uuid": "40e1a404-d529-48b8-b5bc-10998434b488", "value": 164604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237186, "uuid": "a46b43ff-6683-49a9-af1f-3fda1a4a4065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237186, "uuid": "d500f9b5-135d-4a06-b682-a9129af82a48", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d974572-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217517, "uuid": "eb5acfba-196f-49ab-977d-bc9667a3d741", "comment": "Malware payload (Mirai)", "value": "970e252067f093e368f3bce675429181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217517, "uuid": "46065282-fbb5-4828-a311-7714b8e61f88", "comment": "Malware payload (Mirai)", "value": "5b1967fd32820c37b505326944ded8fedfe412c3bbf551ef1bbe6866695cfade", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217517, "uuid": "81b205dc-c59d-4988-ae01-d4016078c2c8", "comment": "Malware payload (Mirai)", "value": "beea2e962396b5eb8da803f1b260a81c933ecf4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217517, "uuid": "a8744fdf-5c9b-4dc3-93ee-8ce51be98b78", "comment": "Malware payload (Mirai)", "value": "8c42b05adfc59bc4622adc885ec4a7fbd54caf0a89076ab25afca2d62ec1fb246b99d9259050301e6cf3bfe372f45414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217517, "uuid": "40bcf559-53d8-4166-bd9d-c0576a66aa2e", "value": "T10DE33A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217517, "uuid": "013afeb6-4e7c-4c04-a0a4-530c9407e766", "value": "3072:8NMcOPLZDozjI7rsrwT+O+1UqaEdE7XEyuOuImk/:IOBozjInsr2+iqalpuO4k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217517, "uuid": "162765a8-28c3-4af5-ad75-aa1fd9ae43b8", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217517, "uuid": "171e0fbc-88bd-4979-b381-915b7fc7de8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217517, "uuid": "26a25e1d-14a9-4a8d-9ef1-1c6740a6294e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9886a6fd-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246419, "uuid": "ef4c9d1e-27b0-4e2f-9a8a-408aa095c136", "comment": "Malware payload (GLOBAL)", "value": "6e73b577d40ac5455b12d12b4d51ddf7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246419, "uuid": "f5c99eaf-9d41-4279-97bf-953584c250c3", "comment": "Malware payload (GLOBAL)", "value": "5b872f26adfff2b63bd91ca50847e3fd19a6c612ee089a6953bdad00214f8df2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246419, "uuid": "d1709213-5d5a-4410-b22c-498c6db95ca4", "comment": "Malware payload (GLOBAL)", "value": "559ad125113ce13a045b81ae3ed445aa7f6c24bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246419, "uuid": "fad00ed6-548d-452a-9e2e-8113527a82fb", "comment": "Malware payload (GLOBAL)", "value": "e7eca5c0cca64777ff9e6b01831ee3545823e136bcb60efa9ac3ab70c37beeea3acfaa26870f8d68e1ec16a1fdc0913c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246419, "uuid": "af886c97-b4a8-44b4-a9a2-0135b3ce3f1a", "value": "T146347C30BBD28431F4B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246419, "uuid": "2e73f6b5-7928-4edf-89e6-31052641c0b4", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246419, "uuid": "e284ea0d-f623-4c56-a2a7-21eb6c426d6f", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9g:MQQBMLEi+AVT/H9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246419, "uuid": "658939b8-4ac2-45a7-a343-125e0439dc4a", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246419, "uuid": "7fc5c914-6b51-4189-a494-07678947cee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246419, "uuid": "aa147493-f423-4867-9772-eed65a8c35c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab87444c-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216815, "uuid": "9533af0a-e18c-43a8-a16b-3a825152e335", "comment": "Malware payload (Mirai)", "value": "51e60bd446c6ea4b359ee946f6977600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216815, "uuid": "b3377ea4-eae3-456f-b18d-1dff62c5e8b7", "comment": "Malware payload (Mirai)", "value": "5b8bb76057b39f2a25999aaff56f0b59da7b32396e517b33df2bb232c795ddea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216815, "uuid": "a047128b-9f05-43c4-9473-ad56014e3183", "comment": "Malware payload (Mirai)", "value": "07c4ae0dfdb3865db54662097eba529ad7e33ffe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216815, "uuid": "8a577e83-e216-4032-8d63-869916ee02bd", "comment": "Malware payload (Mirai)", "value": "58b1eba87148a21216e74332ac1cce93b2d4a911e25f0f9b81fb07960f4198c1283c3fde1823e9687685a9898a4f4d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216815, "uuid": "7dd372d2-81d6-42c9-a10c-69c25fef4eef", "value": "T18C044C46EB818A13C0D62779F69F524633239B94D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216815, "uuid": "a2037258-f743-4aa6-b9f0-3bb6e81c4090", "value": "3072:Xlsoeu/DLaD5dPRdnJBoJuUYCyK/UlNmy3d0fM/9XGCCeM:XllrLaD5dPRdJBACCT/cNmy3dEM/9/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216815, "uuid": "c0dbe452-a06f-46bb-96fa-fba7ac648fed", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216815, "uuid": "d8c42514-1a63-45f6-93b3-09b51d7066f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216815, "uuid": "4fc55a37-4ff1-422c-be11-e3ec17365cbf", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04f4ac1-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216824, "uuid": "0a171909-7857-4f1a-a613-f05787f153d3", "comment": "Malware payload (Mirai)", "value": "71ea07b63ed0f18ed80db968bbfb5932", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216824, "uuid": "65c65969-1691-4011-8943-d7f718783b22", "comment": "Malware payload (Mirai)", "value": "5bc02d14621cae0f5284f44cfcd3846085b614972164444200d19af3721611ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216824, "uuid": "bf117024-4a72-46dd-ae00-cd159a96cdd4", "comment": "Malware payload (Mirai)", "value": "a6088ddbb24e5fd8481a94ad1303d0099495e1cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216824, "uuid": "3eb65787-baff-467e-ab45-2d393898dfd5", "comment": "Malware payload (Mirai)", "value": "33c4f7013c22fba179bbae47c86083548dd07f277d884640cdb70951b8947eb78d1d28ccde275f5cd3644153cd17b9b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216824, "uuid": "db99b839-f039-4722-aaab-5cda7d26f3d0", "value": "T1BD737CC4FA83D4F6EC120A350037BB379AB3E13E2169DB87C3A9A525DC025C2DA1635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216824, "uuid": "d820f26d-67d9-4a48-9548-87dfc54e08ff", "value": "1536:IbMP6X3uwvYWCmHGREdwHE2N5Xekch3K68cSwD:IbMC3ZfHHGR0wDN4kM39D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216824, "uuid": "c73d0e2f-70cf-4917-829a-eb65469f7051", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216824, "uuid": "aced63e5-95e7-4e1e-a740-2408261bdb7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216824, "uuid": "d2ef22e1-4fc5-4051-baf9-bf85359e4ed7", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8b11f7-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246451, "uuid": "a6258daa-239c-40bf-82b7-854ddd95f920", "comment": "Malware payload (GLOBAL)", "value": "dd79d604c4911f916bde9ff78b45e410", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246451, "uuid": "8b66621b-eebe-447f-b9c2-35b4cf9a8829", "comment": "Malware payload (GLOBAL)", "value": "5d414a6cb575b89d11cf5cf37c554c29189130e3d8841e9f60ae5b5c08a2d5e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246451, "uuid": "51a42dd8-fa7d-41bb-94cb-9020227ea33c", "comment": "Malware payload (GLOBAL)", "value": "99bdd83a6273493ff31a9fc96c2952dcafe18c50", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246451, "uuid": "214d62a8-e60c-4b41-8680-4c04daa42f3e", "comment": "Malware payload (GLOBAL)", "value": "188334f3059e95503baf00da61fa04e3406153063a9793090de68db727b313f927fa6ae9b69ccafe56f25e8ca7cf7e43", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246451, "uuid": "a5a6f8aa-7372-4f37-a0bf-36715ead55e9", "value": "T1A9347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246451, "uuid": "24c5b9f3-0fb9-4f4f-afff-bf9bce4373f0", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246451, "uuid": "7c522ac7-9015-43f2-a798-0a02d193c11b", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246451, "uuid": "bce6cc92-19a4-4c71-b2fa-d6c16b5c8ca9", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246451, "uuid": "2b3a673a-f968-4249-a69a-171598da9b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246451, "uuid": "90abcc99-b1b2-4fa0-ab2d-1c1dd8b895fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a9d6a8-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180481, "uuid": "f44c4ca0-e4d6-4793-80f3-0dbdd3d94f8d", "comment": "Malware payload (Mirai)", "value": "0fe97ac5ad5f52e47cabe48143f2a58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180481, "uuid": "00ba84a4-76bc-42ca-aab6-114ea5e0d433", "comment": "Malware payload (Mirai)", "value": "5d7eab6b08a59aba262af29d48e35938dd9df87bc6f065b72581e85bfac05254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180481, "uuid": "c9016833-37e7-4e62-b00b-206a864da26a", "comment": "Malware payload (Mirai)", "value": "e277f87aa50d610a211472039a37a900efb682ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180481, "uuid": "03f57069-6090-4848-9af8-6b636790c62a", "comment": "Malware payload (Mirai)", "value": "b5a163a61ec842266bc7a9427f328e347cd1eb1fa00a16181bff768a0fa7aac9dc7180d84a71c70ca52ce9f85accba48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180481, "uuid": "f385d15d-919c-41ec-928f-e2426dfd30f3", "value": "T19CB30ADABC819B11D6C566BAFE0E518D33134B78E3FA7103CD145B2E678A86B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180481, "uuid": "a0dedd34-d409-4b46-832d-4e659f7c20b3", "value": "3072:+PhTWETikB2ELXTgQAcnihxZByz6n6z1MAeBvEVX8+wcT2:EBFDgQAcniDy6n6z1MvBvEVM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180481, "uuid": "c6156cdf-7737-4e63-a5b0-86359c050c2c", "value": 113432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180481, "uuid": "0c27f449-b063-44b5-a50b-4ba6eb115914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180481, "uuid": "47fc6ad2-1af1-4620-88b1-0188cc75d6ff", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9049bb-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179637, "uuid": "60a2478c-9380-4f3a-8320-7044ed1a5ada", "comment": "Malware payload (Mirai)", "value": "1dd7b7957064fb444fa10b9d83ab0c43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179637, "uuid": "1dbb55d7-a9c1-4ac5-a1b9-5bb28b94c70d", "comment": "Malware payload (Mirai)", "value": "5ecb7afc9b0ccd189ea4021477253ae5ea98a4eff58952b3cc28f5be91596c22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179637, "uuid": "c1b36fc0-e658-4d4b-bc3a-b7f182bfcc38", "comment": "Malware payload (Mirai)", "value": "b4eb3b1f5e53c6efb6691d9248d18ed24726f9f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179637, "uuid": "76b3f2ff-1a10-45f8-b5af-547ca6122ece", "comment": "Malware payload (Mirai)", "value": "f5e8eeaf31b6f7c2a1fdedd730abcc47d5c87e4269e327b36d80e0dc52f789113210ba74c6000ffbf50e491074e6cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179637, "uuid": "3f46c41e-3162-49cb-bbd6-35b581190704", "value": "T139435E42B3084A83E5571DB0393F7BD5939FDD9011A4B386350EAB8A8273D33554AEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179637, "uuid": "5d3a9c71-15a7-41c5-aa88-06e0783d4f33", "value": "1536:OxhQTOvARVneImxFkK5TXCPF2MV9chT2bVR5:ObQmPtxFH5ra2pT2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179637, "uuid": "3617366b-80d0-4c7c-97b2-2600fa6f5bc3", "value": 59896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179637, "uuid": "5cd9f6d1-26c1-41c3-8e84-c917017beb12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179637, "uuid": "7c024a4d-b8c3-4840-9704-d683f0e5283b", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc60deea-efe9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768244761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244761, "uuid": "582c0332-8273-44a2-969e-8ad9e1148e38", "comment": "Malware payload (Mirai)", "value": "9b91bd378dfd799ed33f128a651c1759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244761, "uuid": "5b0c2283-cef5-43e1-a72d-6e4da3e1df42", "comment": "Malware payload (Mirai)", "value": "60418ae02bb82a34d18ece44c26ecbed9b6d3a7e0e33eac73d6f89b9356b4cb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244761, "uuid": "1ff382a5-92e4-465a-b5d7-1d1583cae6c5", "comment": "Malware payload (Mirai)", "value": "2148f3a676659d6610839ad1ef6fe7c4312929eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244761, "uuid": "cbfc4bc6-1b84-45b0-a30b-34b6e54f42fd", "comment": "Malware payload (Mirai)", "value": "3213f3f573c94109fba45c10292291bd5b8d0c8d6d9679cd7f152119f566db28077694cc64fc53ed0b95da0b9c713d01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244761, "uuid": "4745e733-5e1c-45fc-b4b5-95f06645ecc5", "value": "T1D724D71AEF510FBBD86FCD3701D81B0225CCA45722A57B763278D928F54A54B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244761, "uuid": "16310b75-ba75-4a4e-8c0a-608099c4e1a4", "value": "3072:es4wag0x68ih3VoUdgHlaiu+oICrtB/U6hh16r82M:eLzgFoPa6YtB/+r82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768244761, "uuid": "0e1a8f33-5dc0-464c-a2df-c4fe906dd45d", "value": 214908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768244761, "uuid": "f52edc75-76e0-41ff-9533-fe4eadcf6a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244761, "uuid": "4e22651a-34bd-4e9d-883d-f3f118611b91", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb373fd6-efb6-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768222935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222935, "uuid": "687a292b-0020-4ab1-b4b2-2487e202f977", "comment": "Malware payload (ScarfaceStealer)", "value": "8d0d6271a628f8cc9bff5b2a5fb955e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222935, "uuid": "a9f85d28-a835-4d9e-8e40-6b2701ba3912", "comment": "Malware payload (ScarfaceStealer)", "value": "607e5dac2e9d08d913490f8a30e680e8980997e13b426bdd6074bc553883c07b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222935, "uuid": "24fd1516-7c30-4f94-9794-c31c1a327702", "comment": "Malware payload (ScarfaceStealer)", "value": "a3d9509ddb5ef9eb027928a31769d45dc4c75c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222935, "uuid": "a74c2d25-614c-40c5-9ec5-bd4a52661a20", "comment": "Malware payload (ScarfaceStealer)", "value": "31b864654e3b89205c2aa460359d929a54a22683eb2476189c684cac890a5dc9c528dfae360cf6296b6221182a078309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222935, "uuid": "947251b5-5a89-4a08-86d7-bd33cdf82468", "value": "T1C2086B4666EA04D4F9F79A749AE66213C673BC063F30D5CF3208172A1F736E0997A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222935, "uuid": "613f057d-5f59-4d85-9786-f4019e460c23", "value": "04397e0bcb7648e70cf6570253f46feb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222935, "uuid": "3df53787-b057-4b94-8ce8-04b31a4e7a4b", "value": "393216:yFmNYSYZXCpixyZbvJVANEEgC/Kyxf663DQu58EASEhoIaE2lShBujCm5w1PN3hV:yrHx8iQJhYWuhvYvxOOxeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222935, "uuid": "21b47be0-eedc-473c-a376-444aa6a336d3", "value": 83392245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222935, "uuid": "ee9fa621-4769-4877-a62c-e53878a0463d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222935, "uuid": "e3a71ed1-8dd5-426b-b1fc-7e3553d70691", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056ce97-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224447, "uuid": "fe153506-d6c9-4c25-b729-af792b49525d", "comment": "Malware payload (Mirai)", "value": "d62e1e5051802224066e575b78131fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224447, "uuid": "2ab05e01-c195-49d1-9d7a-a856129d63a0", "comment": "Malware payload (Mirai)", "value": "60e951dcefd2b6e74ba75cb8ef77e9bf10651426fe2fd083c3f2f92c47a7bd08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224447, "uuid": "8808dbe2-83d6-4351-95c6-88ed823511d5", "comment": "Malware payload (Mirai)", "value": "5f94d85a447a2cfb15130a4bd6e24eda48153711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224447, "uuid": "35873e91-554a-4975-802d-dd24e29bc01c", "comment": "Malware payload (Mirai)", "value": "c6f0070b717163e91fa8dbd9414b6ea5291f95d272db1695c96c2f817bdb9999f7b308abb1ed705afc2237f1aa6559ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224447, "uuid": "3612910c-e4df-4df6-9976-a783ef72ebb3", "value": "T189C3F80ABFB11EFBD4AFDD3345B54B49249C460621B93B7A7A74D808F25A28F06D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224447, "uuid": "eb0c8591-bd6a-4c44-92bc-8755a23daa67", "value": "1536:MUbvCxNSduAgyv5/ueoDZl5uGDl8AhMz78Wzbtc81KUHBGLA2e0fZfqFX39wu7rx:MUjKfZlwV0IcacpD7JFT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224447, "uuid": "79d3ce98-2d83-49d9-a843-a794ecafdfe5", "value": 125748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224447, "uuid": "38d2959a-d3ec-4d62-b0de-9fce5aa6ea41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224447, "uuid": "5785b185-2502-4f37-93d6-cd8f180790a7", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96748c15-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181991, "uuid": "d9578ce5-5800-4e04-8889-1f2e47b1f58f", "comment": "Malware payload (Mirai)", "value": "7fbb634afbf0671aa8d4f679676a44b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181991, "uuid": "20a5a8b7-d480-4aec-b279-a5fb69214d85", "comment": "Malware payload (Mirai)", "value": "617144a9d0eeba4f540005b2ea699955e11a1ecd60b1ea18bbf760144aa5b073", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181991, "uuid": "e3c094fb-59f5-49e2-ac98-01b3206b3b75", "comment": "Malware payload (Mirai)", "value": "3a27c680ca094dbe5a869ae318378fa5f21d4d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181991, "uuid": "b384c122-41c2-4220-ad4a-d57e93aca920", "comment": "Malware payload (Mirai)", "value": "b144588555ec02c0de67473f9eb3be23cc23869c659295e8eb8d3b3c5ea31f55639cc9a66b79487a54b16768fe504043", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181991, "uuid": "e5540876-dd2e-4148-9865-434e31039c3c", "value": "T19C83E78AF9819B11D5D565BEFE0F518D33534BACE3EEB2029D245B24278B92B0F3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181991, "uuid": "c5841d7c-69a5-410b-a066-52b715dc4625", "value": "1536:+9ndldRBPasyX23LwfuHT+q1FbNUGXB+pCl2YieRG6Vq4ZAYmzIT2bVR:qdRBPaYLZT1FbNUGXu+G6Vq4q/IT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181991, "uuid": "d26d0586-1b26-4dc0-a0fd-d1533bff8f7a", "value": 83316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181991, "uuid": "10e9c2a1-22b2-40dc-9218-d7207b5a7bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181991, "uuid": "385039f6-8775-4790-a045-693d4810fcab", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52048d21-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205069, "uuid": "006fee21-85cc-4bdf-a2d9-7ee75394c5c6", "comment": "Malware payload (Mirai)", "value": "e12207d1792ede78b6c67ba78a05b9fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205069, "uuid": "670ff9bd-b03e-49a6-acb0-fa2d009c9ac7", "comment": "Malware payload (Mirai)", "value": "61c2abc48361636d0f3eca1251f18d94b2ea590196ebe761698fd8a363c5f994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205069, "uuid": "9bc0292a-9346-4693-b0a8-569d590c3dd0", "comment": "Malware payload (Mirai)", "value": "55bf29ed2ea6ca3f8a407d68d9fd84fe983c9390", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205069, "uuid": "8728f4c9-c789-41f3-a77c-e9ea97e53bd5", "comment": "Malware payload (Mirai)", "value": "e127b86ca78bdafa64cc724897b4b774290b4c0e6d3e76e1a33b55c79353696af1f556dd2d8aa0b17166121ba090576b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205069, "uuid": "05c7f7f0-e0eb-4eab-8a01-d3e1391e4355", "value": "T17373E74AAFB21EBBE4BBCD3305A5074938AD660721B57B793574D81CF21B18B46D3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205069, "uuid": "75d33e53-8247-46d6-9c91-baef970d825c", "value": "1536:yyG8Lvu6v42QrMZe70mfvVYC7xNdMcX+vMHpO9lrAB1MIY+Uj6UQM0RNhvC45Jcn:yf8Dv42skE9vCQlP1ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205069, "uuid": "bdc992b2-98a4-4beb-a513-7acb3b815e92", "value": 80468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205069, "uuid": "dca2663f-225f-4e55-836f-2ecd7e9b7248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205069, "uuid": "16f7f8a4-96bf-4809-bd0f-128f1581a37f", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9847ba77-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229668, "uuid": "c8202b4b-745a-4de3-ac87-b91b3eaef3fc", "comment": "Malware payload (Mirai)", "value": "6f543e786cf90523b0a8eeb4abb88c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229668, "uuid": "6a4f437a-9230-4ce9-935b-2aaa5f2ca2ca", "comment": "Malware payload (Mirai)", "value": "62633d9ddf722a221cae668f019482675a8a01e81ca2fb859c9c879358290a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229668, "uuid": "735deeb5-d5e6-4c60-9ef3-b1ce14cc04af", "comment": "Malware payload (Mirai)", "value": "996a7b42d681db534b1bd6e8c58c49a1c1cfb85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229668, "uuid": "984a412c-aadf-4b53-94dc-51001e853cc4", "comment": "Malware payload (Mirai)", "value": "79c8c32f62a83b1f4013b0706ecc42643e77e0b664fb2a8d8a406dea577d62a5fe3ac91430bfa68b3ead834ccb68e13a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229668, "uuid": "75b9da38-42b2-4941-ac3d-9ad970d860f0", "value": "T1979302C115D469BAD5DDD33733AA57B3F8D4B83214D86836E62C821BA883006B53DEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229668, "uuid": "df5661aa-f626-4f99-86f8-28e23e7439e1", "value": "1536:5ysMASTzWOdxsdh45hP7N3apWTyKCGdBPVllvslif63TjT/GVMSTKNOiG5/TBwhu:eWtdh4zWq3BNjslif8e6kKNOiG5bBwRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229668, "uuid": "aaa1382a-a4bd-4652-ac56-7212fb9739fa", "value": 90084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229668, "uuid": "72faf362-73af-4e83-9542-ffe3ae062956", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229668, "uuid": "f2ccd58c-053d-4b94-b9e5-cb7e7c970dbe", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d574937-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246400, "uuid": "0183d2d1-183e-4cb2-a9e7-9be284bdc174", "comment": "Malware payload (GLOBAL)", "value": "9e734d6bfbfa12da45ba9af45ea8ec2d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246400, "uuid": "391ddbf4-db5f-4d57-beff-537fc02a8489", "comment": "Malware payload (GLOBAL)", "value": "62715d8a00ed60ebf4736d825628a2c0c6faaa3f9b567b393343f79caff1c965", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246400, "uuid": "519c32a0-a60d-43ff-aaf4-b16b7f7fb3fa", "comment": "Malware payload (GLOBAL)", "value": "e91302b909cf51b56d748a5a513f9cb26e5afbe8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246400, "uuid": "92f39b48-52a7-4000-81f1-58b278461c53", "comment": "Malware payload (GLOBAL)", "value": "11d0a031a9ca3ec1fb51f3558ad4ecd7cc0d852a9ceb2317266351d128481aa767da6f026acd9f077e7ff2b3ce608cc4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246400, "uuid": "c0b85b5c-e4fa-4dc2-97ea-0237d7fe7fcc", "value": "T147347C30BBD28431F4B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246400, "uuid": "0381bdad-b98e-446a-9e24-bbf5fac79047", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246400, "uuid": "29f90ece-86a9-40e3-b3cf-af31b85c69ce", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246400, "uuid": "d758ac4a-57f5-40a2-a6dc-5a4b246c4184", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246400, "uuid": "584dba90-5df5-424e-81f9-de23f0006ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246400, "uuid": "edb4749c-9064-4ce7-b5cc-5de2ba847f87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b47b968-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218694, "uuid": "6ce3a0dc-9d34-4200-88ff-8c4bc9847e7b", "comment": "Malware payload (Mirai)", "value": "1515b65e694414b49aa6c6bd2f2ef792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218694, "uuid": "cdd2263f-fb7c-454b-818d-e0ca30fd6ee1", "comment": "Malware payload (Mirai)", "value": "62ff185e913511632d011c0fe7381e46a7ac2a0acfe1e1065f7263f0aa9f05a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218694, "uuid": "e1cbdb57-db65-49b0-a0fd-7aef030af0f2", "comment": "Malware payload (Mirai)", "value": "d9398691dad697727a942546cbaeec59399e0303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218694, "uuid": "41222b60-5fe4-4e1a-96b6-0cd820deeaa2", "comment": "Malware payload (Mirai)", "value": "acc639d18c5e5709d49d548bac1799edc6c13109ff4daa1a4745c7bdcf5a4e9ff461a340007c617366c2a3cb6b780765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218694, "uuid": "1228b3a4-6061-434b-9e3e-07b59f3daacf", "value": "T10B63010621A2FC70DBE11534F439A25E7FE057B8A46EF49265A0E38E76D180BD738753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218694, "uuid": "58ba9580-e34a-4ffb-b6a9-1a94d4ad2428", "value": "1536:rWIe2QfoLEoqEWB6hqPjyty3Ynk4ODxLkG1Y9sg5zo1h:rm8EUa6kbyty3Yn89Lz1Y9sWo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218694, "uuid": "38c23fc9-5557-4ee9-b51c-dce64d32e8b8", "value": 67436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218694, "uuid": "d0a37f13-2ea7-4d77-8e7e-935257396b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218694, "uuid": "ec12da95-65ad-4382-b150-36d04d7c9717", "value": "johen.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b867ea-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216718, "uuid": "e947a2d2-41b3-49d3-aa94-f2026e7619b3", "comment": "Malware payload (Gafgyt)", "value": "ddb66239b348ced83a18ba08407290ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216718, "uuid": "4a7153ea-19cb-4bdc-a6da-8334eaddab34", "comment": "Malware payload (Gafgyt)", "value": "6382b41c894650cffefe6b142cd2a5d04e52c9bbdbb68087115500af823299fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216718, "uuid": "9239a5de-a57d-4e35-95ee-0ac8edf9f506", "comment": "Malware payload (Gafgyt)", "value": "c3ef871dcc15c9114feef512326177feb6f48b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216718, "uuid": "0fb38c09-f22a-4028-b283-1c1f94b1bd6b", "comment": "Malware payload (Gafgyt)", "value": "f3c42c41978236828a7e15bd691e001e91074786421ce30dee1cf4cdb4201b50c594c4acd924590fe89f41022c9948c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216718, "uuid": "1ef67bb8-6a52-44f5-931f-a342e36dedb7", "value": "T136C31805E8918767C2E2177AB79A425D33232B6893CB33255938AFF81FC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216718, "uuid": "979934ce-9484-44ce-8ef4-96a42a7c38d6", "value": "3072:KdB2qwap6KVXPi4jv8x+jMDZmDuZmTQOIsXAqE:aRwap6Kt6+jMDfZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216718, "uuid": "6de85759-6401-4793-9a44-fdc9948d2cd8", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216718, "uuid": "1654d49a-1b0e-4e15-b535-83b8cf4b1f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216718, "uuid": "80994dfe-e031-403a-9371-26a1329b7172", "value": "a-r.m-5.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579bae5b-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217534, "uuid": "a65fed68-2cb9-4d31-8463-7e0d99106d9c", "comment": "Malware payload (Mirai)", "value": "37982fdfc81f226ea2c8e9f56f6d9fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217534, "uuid": "1954c0aa-29ef-4cbb-a2fe-54279acb4db7", "comment": "Malware payload (Mirai)", "value": "63d0541bc816417bcd4f17f4a9662bbbc357c730aebe0c606b1a747ed9b32a6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217534, "uuid": "af00dfbe-5d24-4105-addd-a44604564983", "comment": "Malware payload (Mirai)", "value": "754265dcfc0906c76c15e1b70320e3239f07e6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217534, "uuid": "def9337f-9ffa-4d6d-aea7-0537b49960e2", "comment": "Malware payload (Mirai)", "value": "8ac730a5790c68a91fab9277c6e48f949760947460589e78619a118b7fefacbb63b403f9016547f151634704d8962990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217534, "uuid": "717191fa-e3ff-400c-9c2a-371c57c1506e", "value": "T14303E212A50CF121D9601C32D0FFA743A78F465E81FA3BE26A08973ABDB52B539B9055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217534, "uuid": "237e8528-242d-4421-b148-ae33beee74aa", "value": "768:TWf3s0MI9zy2pSiMjJ/TIfZ4Pl8cwFjgwMvEM7m0cRFLYjzX9aq3UIY2:s9zy2pmjFTSZYl8xswMvE2ntNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217534, "uuid": "cb317034-acde-4c63-a5b2-e073a756eec5", "value": 39476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217534, "uuid": "0cc78be3-0e4a-483a-8612-33381d418927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217534, "uuid": "8369f302-748f-447d-8361-1bfab043ab40", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61aac3e6-ef5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184479, "uuid": "18f078dc-16d2-493a-adf2-9d6721627236", "comment": "Malware payload (Mirai)", "value": "b20ce4bb27504f716dde3b7e1c0243c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184479, "uuid": "14017312-309f-4654-9724-fdbcd360b4b8", "comment": "Malware payload (Mirai)", "value": "63f39c2c833f84fb078d5320777815cba3b9826b4ca5507557eba3012b40f229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184479, "uuid": "7cabd913-62f3-49de-8f25-a9f28f932cd2", "comment": "Malware payload (Mirai)", "value": "d285710e401c9708f5d4fd95122210792bdf06f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184479, "uuid": "7269fafa-2c68-45ef-9bc6-ad7b9253754a", "comment": "Malware payload (Mirai)", "value": "043acb33a4a43c0707c08f36b2c507e556f732549e06e935e61a3eb01cc0d7646d18f1e30aee5cb8cd1d594ed6e4d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184479, "uuid": "3bb79093-4c84-472c-8747-806085e3c981", "value": "T181859E97F3A760BEC1268131469BC7621637F8BA02126E3B7594E5342EB3E645F05F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184479, "uuid": "3db10418-36b8-4ea1-affa-c505edd5fadf", "value": "24576:3FKrqOunw1OXTLA5nVKmVWr0aGumkDT/uOVMd4fOQwl5gjPvu5TV:3Yrq7nw1OXTEFVKmVWzpIQWgjPvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184479, "uuid": "cb0423aa-7458-41d0-886c-b9716711067b", "value": 1731664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184479, "uuid": "dfc70480-9b03-4c9a-8fb9-bf19dadee7c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184479, "uuid": "b97ca556-9b6c-469b-849c-03e69fbb71a2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f2a4a7-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180222, "uuid": "20bc21b5-5d85-40a0-9075-c32c83fb7081", "comment": "Malware payload (Mirai)", "value": "852385860441d4976e5e5aaa015f534d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180222, "uuid": "02c42049-9745-46d1-9d72-ab72cad68ed2", "comment": "Malware payload (Mirai)", "value": "642cad1ad976ce2b761276c2b99955b581e8f9989e20d1c66ae30e96aa6cdb4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180222, "uuid": "95a1791b-4cf6-44ca-a352-5c2f0ac432f8", "comment": "Malware payload (Mirai)", "value": "5f1583300e32bef9cd32aebfa4a105656ad9de42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180222, "uuid": "b03a238f-60c7-4881-b89e-d5ecfbf68a5f", "comment": "Malware payload (Mirai)", "value": "02ee87c11866e13e196a187df0460e0a63c8caeba1732b46f5df52b1de028f36a69563f7a1d78077ee1eb4f0579863d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180222, "uuid": "55941545-8f37-4352-972e-b1cea11a2c6d", "value": "T1B4A34A12ED796D27C5C4313B51E34531E0B653A916BCCA1A7EB32D5CEF18320312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180222, "uuid": "499ddf9c-d3cc-4151-b869-f08621639c5c", "value": "1536:UlpEIsXmjImsKFyn02O9EQ0rHn94efrsTyZewfIO4zXkzm7uhi:QdN4vnOrefrs+5XDzm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180222, "uuid": "f93f9e50-b1f4-40ec-a758-60e47fb37189", "value": 99548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180222, "uuid": "79fedf6f-d254-46a7-986d-e67a85860775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180222, "uuid": "c736eb49-64b1-4b0c-9306-ecc31e6d582a", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0512a7f6-efc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768228992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228992, "uuid": "7077710d-dbc0-43f9-8f4c-d6a611b44924", "comment": "Malware payload (Mirai)", "value": "5c4e0923d8dfcbd78ccaed9f09c56a9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228992, "uuid": "9131d958-99a7-4dfd-9921-618265a33b6c", "comment": "Malware payload (Mirai)", "value": "6481d3a1c1d639a82462ef25cd74e644866baea0a18a28a3bb56cf5c49c381d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228992, "uuid": "82a3c890-e2b8-4c17-a2cf-dc1aaa86300e", "comment": "Malware payload (Mirai)", "value": "4d875e968c52f6ed640c2aa239c6fe3d6c8ce40b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228992, "uuid": "a7a951d6-7245-4ddd-975c-1edcd7d70cb0", "comment": "Malware payload (Mirai)", "value": "4801309fa154c5707ef1d87f1cb175e96b7783ddede3f9dd33a2e1ea5ffb8bb72c546c278a961abd4c0cf2ed21969e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228992, "uuid": "5bc173a8-02ce-4fab-86fc-e4142aa41ecd", "value": "T1EED312402252B1BFF3E51CF8D988E5847293A6BF5B930128A855BE00F2BC55ADCD7177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228992, "uuid": "4a6ce8cc-d2e4-42bc-a3b4-bef840a411a8", "value": "3072:OziRQKdZAjE2PJnPw7ly3yuZkhU9dexP8FHrVkO4Sth:OYQ8ZAjXJnI5Id6UrexUdOONh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768228992, "uuid": "15e908ff-03eb-43e3-b3e9-d07d10cbbbce", "value": 137708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768228992, "uuid": "5cba843d-6d1f-4098-b3e2-e78872d5938a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228992, "uuid": "10e15d48-b985-4f06-af6c-602ddff1b6f5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784c3c1b-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216730, "uuid": "41410a2d-4519-4e7d-abff-add4536c5312", "comment": "Malware payload (Mirai)", "value": "eaa26f164b5006ab9db083c5b2ab9c15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216730, "uuid": "51f0737f-8784-471d-90c7-b99046baac19", "comment": "Malware payload (Mirai)", "value": "64a93c5b0e32cd73f1312dc3d10a9cc63ee26e139ca1f5c9c9d580c120d73980", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216730, "uuid": "015584f6-a41a-436d-a54f-aefc461d225b", "comment": "Malware payload (Mirai)", "value": "083c557078857e922f01c865d722ca1cd0aaf37d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216730, "uuid": "591a066d-040b-4733-9fc9-5508e068aeb0", "comment": "Malware payload (Mirai)", "value": "86daf563f8951d34cd7cf40acd58592cdb4d3add7e6b6a62b46b9901f39f2fb2ae188fa3866340a1ce12162e4d3d78bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216730, "uuid": "e8da48ab-2249-4f0d-9717-bf960448cc89", "value": "T1286172A9218252B43CB9CF63226D46183283C4B6ADDF7F46F5EC79E8809CE56F042742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216730, "uuid": "a79da976-b1ec-4479-8b25-09cceadc9f1f", "value": "24:Iti0C05si0X0Ei0w0yi0j0+Ti0Z0Xsi0B04i0sp0snJi0q0+Li0J0i1Li0yp0yNe:iibcX1RubJyNLaJLV3kLCJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216730, "uuid": "b1e76c1b-71ec-46c9-8ca2-7a60020e7d2d", "value": 3224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216730, "uuid": "955c8c79-d5bd-4dd2-b46c-738a68255712", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216730, "uuid": "9732603a-e263-4e94-8102-9376297d6e80", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3de3e9a-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225500, "uuid": "5d4b03c1-b8f9-485c-a07c-50b5fb64cab1", "comment": "Malware payload (Mirai)", "value": "d344533b9d4c2ddbffd209dd53afe523", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225500, "uuid": "da8d0200-cba1-463c-9ae7-05cd7b52f7c1", "comment": "Malware payload (Mirai)", "value": "653bd32b621aebbfac0c6e89874f212f11bb59667b5cfcad2635b6a56a32f1b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225500, "uuid": "776c0c1b-b192-4e27-a2a0-bdf0a67a0691", "comment": "Malware payload (Mirai)", "value": "fc7f2d07aaee59f7da1143bd5d6725114f07211f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225500, "uuid": "fc33a3b3-9d63-4bcc-8d2f-59a9a0dcb05a", "comment": "Malware payload (Mirai)", "value": "81142d565dabdd980819b215e91e7dc2657198bfb3f1915bd1d6035d7013b3a92d2ecf12b8c7484a2ce1bc6a55b82311", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225500, "uuid": "78b4f987-4687-461b-b5a2-c4dda69d13cb", "value": "T128938E11CCA5ADECF13A7E3010B5DA774B17A445A90B6DF73D86C2250017988F5EABF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225500, "uuid": "e85e650a-e9de-42f2-b243-4e0daee7c3bf", "value": "1536:6OF4QXNduET+iu29QrSxq4M2JheQxSJ/jgUNXPFNrCSAkOTxTAbVR:6OF7Xr/+iu2WrS/rH8/7NrKxlTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225500, "uuid": "28a07cc2-a9d7-4a8f-99c5-23e025de7c03", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225500, "uuid": "eae557a2-6b47-4adc-866a-bb82204601ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225500, "uuid": "c69baf0d-0809-42b0-b82f-c1e41da976ba", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3567335-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223271, "uuid": "820c4215-1bad-452c-946f-221d1687fa23", "comment": "Malware payload (Mirai)", "value": "7ff0bae02fc769857521b00d3323ff74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223271, "uuid": "a309347f-86c3-4f91-b8ca-3ebc6b2ede60", "comment": "Malware payload (Mirai)", "value": "654dc0af61d48b84465457cbfbaf6ce451c41eddbdc42582d10f18062c35a85d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223271, "uuid": "05dc704d-fc67-42c3-91d2-568977d49b1b", "comment": "Malware payload (Mirai)", "value": "a4ea36e14598993634cee3b58fbd2c106ebb4655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223271, "uuid": "4e9b3b6c-e2b3-466a-ba3f-b3a67b7d570d", "comment": "Malware payload (Mirai)", "value": "8d644764331bf3056b072f08f1c18ed1dcebe9af79af5f2c56759f33c7ada3166d414f247161fb6f20da4e5ef9d0de81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223271, "uuid": "13fd55b0-caea-455b-88e5-33769efc653c", "value": "T1F4835AC19A43E8F5E9090134607EF3377132D97401B8BEF3F7949772642AA94B54AB8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223271, "uuid": "e95b88bf-fd2a-4bab-9061-6fe35d8de722", "value": "1536:dawJ1J5Ts4k7GwX8Eip/N8La3Ro2zgY9WyqRjoWs5fPyeF89o3zEMeSbjSxnZRR:daI1PIViwXlQ1RvgDyqdG5fPyeq9oDEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223271, "uuid": "a589b586-a38f-410f-b7d6-a0a337ddaf0b", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223271, "uuid": "73a78caf-9e12-4cd1-a0a8-05aad5255e47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223271, "uuid": "b2206dd2-4fa7-4d81-bc72-9bcf65886905", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137ed088-ef7c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768197663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197663, "uuid": "20771967-61cb-4690-b4e0-41c887fd644c", "comment": "Malware payload (RemcosRAT)", "value": "d358f4edb0c509c6e8b6f12a12950831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197663, "uuid": "16f8b059-b96d-48ba-a232-8028b6056725", "comment": "Malware payload (RemcosRAT)", "value": "654e9166acaee1646a53ce51154f81b1b8d4b3d25e07ea4046294f3a02240caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197663, "uuid": "312a9f77-9713-4dc1-b33c-21e490b8a1b2", "comment": "Malware payload (RemcosRAT)", "value": "a80e93ecac3c7c28f273430a61e246e6a0c35591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197663, "uuid": "6bb77c02-35b2-4452-ba98-7861597d6c44", "comment": "Malware payload (RemcosRAT)", "value": "a12ea78dcf35845699891bd33a988c8837ca345b87dae019cd5ffa37eb3810c81633a80fdd8992cf564e87f16bd18847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197663, "uuid": "62d45690-b61c-47e6-aa95-031f2275df2f", "value": "T1F755D01373DE8360C7B25273BA667701BEBF782506A5F56B2FD8093DE820122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197663, "uuid": "39826abf-2a2c-4056-8dbd-41eedb816eaa", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197663, "uuid": "332a82dd-8855-4472-b6e4-44fc5fdc889e", "value": "24576:Rtb20pkaCqT5TBWgNQ7aEHqoO7lfiW0A4gfD6A:iVg5tQ7aEKNR6W0ARL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768197663, "uuid": "dc125633-e91e-446e-a13c-7e83ada13531", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768197663, "uuid": "3bc6336d-63c7-4c88-b279-2005d90e02c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197663, "uuid": "52d9a0fd-c00e-47a4-b7f4-993227eb9f76", "value": "Airwaybill, Commercial Invoice, Inward Manife.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4846fea-ef59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182873, "uuid": "247906e3-28a2-409b-8146-4b0ec1eb60ab", "comment": "Malware payload (Mirai)", "value": "89b4404d2fee90bbbf8da5f2bd47a9c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182873, "uuid": "4d23245c-d61f-46e8-befb-9226587ca5e0", "comment": "Malware payload (Mirai)", "value": "65523c14c60278ae9c770fff70432914ddf539524f3f1477663076b69de997f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182873, "uuid": "006c7795-2c00-437e-854b-c47d1485aeba", "comment": "Malware payload (Mirai)", "value": "a4c6050d7d9d55968caa32307e018c786b896c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182873, "uuid": "e221b029-6a89-493e-bef5-eca967e315a7", "comment": "Malware payload (Mirai)", "value": "f87d43bd89af91316859db13826efff9fcbe10043dbc5ba057d8938f8cf3bf4f55c288863b364b37087da3f49f6ce155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182873, "uuid": "951daf25-025d-4c96-b723-6cfafe377429", "value": "T1D8538D73D8396E84D35941B5BC748BB51B63F58481830EFE1A99C2B99047EACF6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182873, "uuid": "fe19c413-ee13-4269-b8ec-431c5fd39f2b", "value": "1536:maLwtrmUF1QgBVIvKVQHSKthnIC4QHiSKEs/F:mYFULQgrIyV+thnIECBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182873, "uuid": "9f810e0c-0a07-4443-b717-e0ac642f721a", "value": 63628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182873, "uuid": "06c54d69-dbd8-413b-b03a-4ea74baf5d7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182873, "uuid": "9f7d0304-cdcb-4d9c-884e-d9496619d054", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551a2227-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205074, "uuid": "93720fc3-a713-4cfc-81a3-15977d33c109", "comment": "Malware payload (Mirai)", "value": "33de357a398c649e890b9c1a8d1c7d57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205074, "uuid": "15535f12-349b-4513-971f-7494a2a12dad", "comment": "Malware payload (Mirai)", "value": "657fc98eeeb0ab5978e74ee5d6dfb885451784f8bccf1375e17f673a558ec34a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205074, "uuid": "12e3d997-7f7c-4016-9ccd-b8bab534ec8f", "comment": "Malware payload (Mirai)", "value": "1af6854993d723c83d3361cde2df5f6f56545c3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205074, "uuid": "e98f502e-4d96-4923-8884-54a25b5e0115", "comment": "Malware payload (Mirai)", "value": "daa76ee03b00314a83b77c2b3e72435e2d532b3a545129cc1c8fa909a24e8c626684860b0ea91e15b06ad8f8fd35d65d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205074, "uuid": "7e845fff-8c18-48ff-975d-a3933898407b", "value": "T16FB3D74A6E629F7DF32C82354BB78B36AB55239133E0C285D26CED405D6038E5C6FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205074, "uuid": "71edb279-8327-49c7-bf5f-beca1ea822e0", "value": "1536:Qh8XILVzfJzf37fQdb95PWCqHX/sMFqPO+wCLwTzQV7uejT2bVRot5:mkIEbveCGX/sMFqPO+wXTzrejT2gt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205074, "uuid": "34a64cff-b0e1-45fd-9cea-d58ee4e09d5e", "value": 117544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205074, "uuid": "f493a782-a921-41f7-aae9-538600b0d77a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205074, "uuid": "1c1b4747-dfc0-48c6-bf23-1416a0226715", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58867dfd-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217535, "uuid": "85f53d32-d559-4b8f-81d2-db515cf8095c", "comment": "Malware payload (Mirai)", "value": "ea281388486ebe8c45df2888eea8cb88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217535, "uuid": "164191a6-0444-49c5-bee1-4d1a8bea4245", "comment": "Malware payload (Mirai)", "value": "663bfe45ac16a6d8bf27df2029bc207b03a095ae3653ab196440138a031c6647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217535, "uuid": "e6d3fbe7-7742-497b-a3b9-ba424c65d9eb", "comment": "Malware payload (Mirai)", "value": "531a979ebba8fd9671b3c9c06805bf94fad31df5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217535, "uuid": "1f7f5743-6931-4369-b567-7cf4f8731251", "comment": "Malware payload (Mirai)", "value": "f4da57391e7161a7eef8e3ab36dcc1df7a008a5b7e57ae17ef399815d981aa3f1782e14c2028559b2d8c518409aa8b8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217535, "uuid": "0cb63f85-c7ee-423c-a0d8-0449e8f9230a", "value": "T199343B45EA418A13C4D117BAF5AF418A3332A7A5D3DF730699246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217535, "uuid": "ca122a9b-e626-40e1-858a-fbbcfe3027d2", "value": "6144:Ego/jNyCHH/a7qacE91dwnptrj/f9ihM/9pAU:EDhyyH/a7qacEbGp1QG/rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217535, "uuid": "a56d743c-80f2-4950-a59d-feda0ae08b5e", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217535, "uuid": "f5a50f55-dc17-4844-a217-d76408bf8dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217535, "uuid": "a1044cc0-3b78-48de-a871-1311d19727ce", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3882c17d-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206315, "uuid": "1e3154e5-8b9b-4377-904e-b81951599f88", "comment": "Malware payload (Mirai)", "value": "1733d23d47ba2b1829ec3f15f7cfc25d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206315, "uuid": "b7041a4b-4473-4c56-b43d-37313df8f754", "comment": "Malware payload (Mirai)", "value": "66b863b4625e11f4cf8e506226f3583847a6ef22d0ccca9aa9aae8346772426c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206315, "uuid": "ea0ea546-a33c-4a39-9bbb-74e6892ae0e2", "comment": "Malware payload (Mirai)", "value": "d3eb8f4c5a309956090c09107a31fd6401da8bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206315, "uuid": "0f62b0a2-2072-41a2-8904-b1fd1e1403d1", "comment": "Malware payload (Mirai)", "value": "608fdb87ff6ef4049f9c9f4b40cce132d4dff526b653fdd74c3ddfcb9d54a79f7d9b10e5dff8112a4000f8b5d9d22f1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206315, "uuid": "e084fd4c-d9f1-43eb-b15c-9420e5521a0b", "value": "T1EE532A0133694057E3E74DB22C2F6BF1A7EFD6A131E0A185985E9B4F8135E321586FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206315, "uuid": "728b2f92-ca78-4be9-ae74-ccf0d341e441", "value": "1536:v90qPbVVKGykrLYIHiv20JINEGDUlwS/vR5TL:v90qjlQINEuS/vDTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206315, "uuid": "2cfff54d-6bc2-44d0-ba81-62baf6385a8a", "value": 63592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206315, "uuid": "84985151-2a6e-42df-9e83-584056690730", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206315, "uuid": "10348e9b-65e3-46de-afd6-7a12f979776d", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430cf21f-efb9-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768223942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223942, "uuid": "6d30db36-d6e1-498b-825d-d36ab7df6d4e", "comment": "Malware payload (Stealc)", "value": "425e9b0cef3ca12a7c6c53db9b92bb22", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223942, "uuid": "6815fb16-59f7-4df6-a0f5-da5864173cca", "comment": "Malware payload (Stealc)", "value": "66e76a879a7ca8baed927fb539aa34e649070f6050ec8070aeba193d4a5746c4", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223942, "uuid": "df0ca17a-82c2-429b-911b-9ac604725b2e", "comment": "Malware payload (Stealc)", "value": "7acff54833df2b846dd73ad1004489a33a931e90", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223942, "uuid": "1dcf08b1-e486-45a0-97c8-451c034c068e", "comment": "Malware payload (Stealc)", "value": "34cb5013684c8c3f25cd611fc725d9c9cf7d130762f22ab1820ba2809189be24810e6403f0b21ffac8bf84b90f8df358", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223942, "uuid": "c1e3ef3a-8230-49d3-b6f5-e13b34e92b3d", "value": "T18D957C47BCD154B5C4A6923188BA41917723F8491B312BD73E0CA6B92FB7BE80E7D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223942, "uuid": "c50a541d-a300-45ef-b8fb-534123810a40", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223942, "uuid": "36abaae9-aa45-41a2-b935-fe9d35b644b6", "value": "49152:GsDDkGzeB3rb/TxvO90d7HjmAFd4A64nsfJne4WPsSgOnYgMqKZK1s:NeyjWPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223942, "uuid": "cd9d2cea-e3a7-40db-8189-847604f5bad4", "value": 2028544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223942, "uuid": "6846a2e7-4db2-44fb-b0aa-f1b2ecf59077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223942, "uuid": "7cef5040-c3ad-4ff8-8138-cdb40ad85de2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9122987-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225509, "uuid": "4f9b2ddc-6cfd-45cb-8495-f9c5bc3e5ad6", "comment": "Malware payload (Mirai)", "value": "ca8b7e04ec37d4bd55f75c9475c732dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225509, "uuid": "2b246055-7576-43de-802d-fc32a362795a", "comment": "Malware payload (Mirai)", "value": "67027cd7551a5a1a813e02d884ad82379fc412d206e8a349e93e89a632c695af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225509, "uuid": "53177a30-4e06-407a-b200-ceb9d3d8ed47", "comment": "Malware payload (Mirai)", "value": "db24379aa15852655724640e56bab42bfbd543a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225509, "uuid": "66a7db9a-b5f7-4b0e-8c7a-135c99ee87ba", "comment": "Malware payload (Mirai)", "value": "76478862494b4892e917aeb06ecd60fe51c85f82c6c63b7c0f40ab062ea734312414270c4ce7730f539c6570eba2ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225509, "uuid": "c72885f3-d926-49d6-bf48-6e238a51df22", "value": "T1E9731BC9BC848B11D5D516BAFE0E214D33238B78E3FA7113DE185B2E678AC670A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225509, "uuid": "c01dd26c-403a-4b50-b4b6-4562b2055695", "value": "1536:ndnQsLpzzN9qTXO5MjdFtAKEgZYf/l/snLrYPbqMGip3DKVBRT:hpzzDcmMpFtAKEgGfN/l3DKVBRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225509, "uuid": "7a604f4c-2138-4906-9bc6-8a29a988cb00", "value": 74956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225509, "uuid": "e0355ea5-391c-4b4b-b13f-daf5cfa860bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225509, "uuid": "dd959fc3-ae17-4947-941b-00364656a882", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf4771a-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768205488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205488, "uuid": "a0467ec8-2f04-4044-860a-759140d2366d", "comment": "Malware payload", "value": "60b814fb5f5534b0b13c531b5d0fd997", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205488, "uuid": "7091131b-9d24-49c1-bd85-785c39166efc", "comment": "Malware payload", "value": "67397b557510a71e184be6bb2354bfed3a5cdf654987695e8fef3c6e733aa3e8", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205488, "uuid": "9b82aac9-57fb-42ae-be5f-813240fe7a1e", "comment": "Malware payload", "value": "d4dbc4e1e76d9b93e008b56ff96fc8e13127203f", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205488, "uuid": "85d7c076-8251-44b9-b50c-e786a8cd5fa1", "comment": "Malware payload", "value": "5e193fecce591afd5c385c2e35f5d2e150ee32d04d48fc659c0391a34b79e7b6d6d18259c8da5cbf6bf4cda1013967b2", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205488, "uuid": "c53df42f-fe81-4fec-bda4-40dea39bbd8b", "value": "T17075E172B2814436D1622638AC2BC7B5552ABE202F17A446FFED0E4CCF776827DE5253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205488, "uuid": "94021e44-f9b7-4ee2-873f-692c0eee6a56", "value": "24576:scTWi4GHXTAUJDb68xrp0v5PgqjF3kDQID2NynnrXO4sp1OTCESYI9h4EI+8/ZjQ:soY08Gfx9oIDhLO4sbOTkvpijHbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205488, "uuid": "0afd38c3-78a2-47a1-b9e5-94ecf273abdf", "value": 1642019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205488, "uuid": "1e2b2651-6f68-4613-bd9f-421fe8d5eb28", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205488, "uuid": "6797a555-a2f9-4756-9934-346d47971e9a", "value": "Po Number-4500035136.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba58d0-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205553, "uuid": "e3ee2374-a419-4b8e-8771-285132a74caf", "comment": "Malware payload (Mirai)", "value": "66683a9e918781bdf5c51f232a3d0bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205553, "uuid": "0502194c-8444-4d21-bf3a-574febe45ef6", "comment": "Malware payload (Mirai)", "value": "68460565bdbd9da7d3c0c4449b8830dbd2c6ca911681460ccf923c215a963c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205553, "uuid": "8bce1bbb-e9ae-4fd8-98f5-83eb1ec34bd7", "comment": "Malware payload (Mirai)", "value": "89061d6a823919cd721edf62ad19e2bc0df66ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205553, "uuid": "6fc37249-4371-4ec4-8efa-3cf6ad4f56f9", "comment": "Malware payload (Mirai)", "value": "3ff63dbe4e85dcb1cc370888566df267aebd973f0ac89ff7da43ecfece89a981709f2359682822e4f439f87d3dc81f98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205553, "uuid": "6f3c009d-577b-4c68-8845-e9c7e486c00c", "value": "T1A673E71ABB714EFBD86FDD3745AD4F4525CC820722A83B7A3974D428F24A18F49D3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205553, "uuid": "080bf2ab-6cd8-4b5b-b6f1-1ab9ad034967", "value": "1536:PJLvjX5JJTK59aAwuENwHLg5rIAl44iTdGT2bVRY:PtjJJ8a24rT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205553, "uuid": "11a04a5d-89bc-476c-8ef1-50f405d34fc1", "value": 80672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205553, "uuid": "ce208569-4e47-4631-bce8-81c4a9cce574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205553, "uuid": "4dc88904-38ec-4724-b10f-534968238abc", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca9e597-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212012, "uuid": "520528dc-2ef0-42a5-9e01-7c5e0f23a7c8", "comment": "Malware payload", "value": "1faaacda699b0b158baa18c4c5e88d68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212012, "uuid": "af16876b-b3bb-4f5b-9a48-55851be8c6e2", "comment": "Malware payload", "value": "694170de311b4cc9e5754ad483462b7a5b515ffac713c8a198bbbdd0c4999cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212012, "uuid": "6349e1b0-5a56-4106-aca5-8a3cf03586df", "comment": "Malware payload", "value": "5e5b3c928afa1d7c7917b763f724cdcdd7ac037f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212012, "uuid": "928d9d23-c874-443b-b678-505097bae7bd", "comment": "Malware payload", "value": "dadd266535d353c1b4b05fddc2f5cee21b51f1de0d2852b445e35883190a3808724e94e9faea2aeb6410d64f46d72aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212012, "uuid": "92cc5da0-54b9-44e5-bbf5-6ce4744a4c89", "value": "T112F433080F9D5E0BAF649FDDBA234B470C85A5CF0197E8832B1C2B766A9CC9CC68D557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212012, "uuid": "060b3f4f-94cb-4539-88e9-239afec0e5f5", "value": "24576:ZIwe9MUgwNprGuohWoHEtDbs6n6I5STku/Tpo4oT9COj:mLgErGTMtDbp6I59j4oYOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212012, "uuid": "aea394e1-925e-4564-9ab5-cf6f30f75d96", "value": 792616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212012, "uuid": "ec1182ec-c2ee-47a0-9498-b04a0d3f56d0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212012, "uuid": "a83cde68-ee5f-4b87-8ffb-85c16aeab38f", "value": "client.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877d9fa2-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212031, "uuid": "3fe36979-4bff-4d88-9c6b-69635505ec3c", "comment": "Malware payload", "value": "c0e55ab44ccb8553088a4da81f6a35d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212031, "uuid": "e57b416e-1947-49da-8532-a6a613337ed0", "comment": "Malware payload", "value": "696a63ed0a5c2142efd688bb07ebdd242e71ad0c1cbd2e71052fee80eb7d45ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212031, "uuid": "055c82ee-d7f7-4259-8abf-7961ff2c046e", "comment": "Malware payload", "value": "0c3a32362b10ec361c013212a2820794862e2294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212031, "uuid": "b85d20d9-07af-4f5f-aa1c-99513a9e1c4a", "comment": "Malware payload", "value": "5d63330aaa51ca4423d503ad2d870734d8c1a93730297284473084ba5dc4421686fad1659c585cf05d883015bfc9d2c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212031, "uuid": "8ea5136c-cd4b-4f97-b0e1-401ac20ef06f", "value": "T1DEF423241FC775EE46FFF060F2B70B7B641A282D14F4F81E502983A5A7D62D8727A518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212031, "uuid": "4b1e904e-c2ae-44ec-b81d-8a16c868c370", "value": "12288:Cb9Kz/YZkwQ8JI3xSYNPpbCbOn3n407g7MOYcdxdSgXrl5zKsBb3wkPVuKDK5sH+:CQsSwpsxphaO3nL07MOXdxhXrPzK67PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212031, "uuid": "ed8c4183-8d94-4c7a-a8d8-1087f00c6ae3", "value": 777716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212031, "uuid": "ba2c2965-85fa-4d95-931c-94e2a990d495", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212031, "uuid": "28676e64-1b65-4e6f-a85c-fd95b1206b15", "value": "client.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37660492-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768219627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219627, "uuid": "5e431dca-9aa8-446c-814d-1a8d70ffaeeb", "comment": "Malware payload (AsyncRAT)", "value": "6bf62d5582a1fc7febba7044de658671", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219627, "uuid": "3ec3dc85-84c7-4622-b568-8bac640b962f", "comment": "Malware payload (AsyncRAT)", "value": "6a14c33160a4a542f95df93c71700b3d50ac45b172a2266615413bc8a9bdb02f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219627, "uuid": "81ecaf6d-7ef7-4deb-bc24-0f2ac31c8e97", "comment": "Malware payload (AsyncRAT)", "value": "51286a69fe2bb45664a4a8b41ccbe06975578c27", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219627, "uuid": "a2bdfd35-4eca-4afe-917b-e148990766fc", "comment": "Malware payload (AsyncRAT)", "value": "f549e086a5c47ebcafa41738f6043f5c67dcb8702dc1cc3b8a2ccf33d0d11b72cb80508d7a1a118f9c35633663c0c801", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219627, "uuid": "67c62489-d138-4233-9252-7a1081ee8cd5", "value": "T192034C4877E48312D5FEAFF02DF3720A1675E11B9813EF5E0CD489962B63AC246507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219627, "uuid": "ec543c47-5648-41da-84af-6f1ba376020e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219627, "uuid": "0bea3439-df21-4d35-8c5b-7e3b3eb4dc73", "value": "384:zIaJiqqWmMBHk9eDqXBvOMQ2XnLQRAvh0FbOKTCOQpCR6pkFTBLTAOZwpGd2v990:lkWkxt7KAvGFbO75pCDFo9jCOjhabh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219627, "uuid": "e089c05d-ca7f-4105-b5d8-46746168a073", "value": 39720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219627, "uuid": "6b0ea3b5-f3f8-4d9c-b458-d11ae7e97e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219627, "uuid": "6326a1a9-4898-4aa2-8150-5356c74dec42", "value": "mod_xw_decrypted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c8310d-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226181, "uuid": "3f2ff004-fea4-4501-8b45-12a06da4ec35", "comment": "Malware payload (Mirai)", "value": "192182b186d5f481cb2e838aaa1306cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226181, "uuid": "456e20a8-a101-4a0f-9493-4fd572bb034a", "comment": "Malware payload (Mirai)", "value": "6a2959fb2175bbbf509677d7684d6a86d9df6f58f759c868552c91d7d0f9e0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226181, "uuid": "6061f7c1-da49-4cf8-9b87-d9b4965cc57e", "comment": "Malware payload (Mirai)", "value": "b8a23877933250fce105fcbe8b9058d277c6e315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226181, "uuid": "65c9d8c7-cd3f-46bf-af73-cdbe9b357ecc", "comment": "Malware payload (Mirai)", "value": "72c2953b76f9203affeca998d2a03d4124561c0f290f893be4ef4678cf4e28fad262113d038271ea970ed16090d9ca91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226181, "uuid": "49fa9691-b3ae-4db4-a893-e8ca84df73d1", "value": "T166530985B991C617CAC4627BFF0E42DD371643A8D2EE73039918AF25378B82B0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226181, "uuid": "f1e8dbde-7a94-4c66-af04-efa433f46072", "value": "1536:jMhqFVPkuhJX1PSGihZgnholZX/vUT2bVR:4hqFVPlhJXoGihZOGP3UT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226181, "uuid": "2b7b24a1-2990-40f6-b9cc-bc04a9af5beb", "value": 62676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226181, "uuid": "403c48ac-1fc6-4e7c-ada2-643b6765e85a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226181, "uuid": "3d6484eb-6289-4ab2-9210-071c444211d7", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f37034-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214545, "uuid": "922036b8-acee-46db-b404-0e94ad33060e", "comment": "Malware payload (Mirai)", "value": "1a0ef047b424a5d7b31388fc3fbd846f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214545, "uuid": "9a2ca8d9-bad9-4e3c-90ca-8276d16f5dc9", "comment": "Malware payload (Mirai)", "value": "6a7b956fcd8e426c2c5b706938e454d048997f8662da2068f1a1eb7bfd61d98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214545, "uuid": "4255ce34-5d28-4d6e-a5c8-f4586630a314", "comment": "Malware payload (Mirai)", "value": "fca560515cd5e051b5595b825cad64963a7bd52f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214545, "uuid": "811864cb-199e-4361-864b-018d7583d1f1", "comment": "Malware payload (Mirai)", "value": "5c078082f26e9b9c4470d5ec43b40c94f1e2e7e27b9960185f3c317f3f6db8e904778bf71d8b9cc5e1f0c291d10b9847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214545, "uuid": "30830b63-cff5-4bfc-89b2-682689159263", "value": "T1957307A5F480CB35C6D5627AFB4E129C73630F78D3D932019D25AB352BEB9264F3A412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214545, "uuid": "d7c37fed-de38-43ae-9f44-cc2036384f2e", "value": "1536:kWWWMjObO+C5WLzzTMOzzoM3x6RtbkFnTQhUS05sKnyGTOZcI8Ir:k+MjWXC5Uz8MB8VkhQx05jHIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214545, "uuid": "277ceda7-b97c-4f4f-8b09-6be8b8bf6bb0", "value": 75032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214545, "uuid": "8fc32734-b6eb-4f42-be02-7e4857ed9989", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214545, "uuid": "15a2b323-1327-48ca-8557-c37a9d97b4ad", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185100b9-ef94-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768207979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207979, "uuid": "473ee918-0c39-49a9-ba25-8be8b30d0bdf", "comment": "Malware payload (Mirai)", "value": "a2fa872d65eec92c5bc9d0bf818ee117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207979, "uuid": "d1c7b988-4078-4941-8e2f-9b352aba47c9", "comment": "Malware payload (Mirai)", "value": "6a8cdfa32a525a15401a75a9cda96a2dc8e785cfae28002ee3096342f75a0b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207979, "uuid": "635a5540-24b2-497c-9e3a-aad8b55546ef", "comment": "Malware payload (Mirai)", "value": "f5a87972e8d3429d0c2bbdd19e649a649c26abf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207979, "uuid": "ef0e35d0-f48c-4ce9-b920-051e05473cdd", "comment": "Malware payload (Mirai)", "value": "6707e10ba8bb0cd3d6f41b111b7e717d9d493c8dbe57d48c9bbdeed5dd8d2f25d8ef9a2381302e73ac3dd2a69122406c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207979, "uuid": "de7aa974-d2f9-4344-af2e-7a27a0d09fe9", "value": "T1D6B3D74A6E629F7DF32C82354BB78B36AB55239133E0C285D26CED405D6038E5C6FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207979, "uuid": "c7232c5d-d2df-4985-89bb-2f2ae4463e17", "value": "1536:Qh8XILVzfJzf37fQdb95PWCqHX/sMFxJMACCLwTzQV7uejT2bVRot5:mkIEbveCGX/sMFxJMACXTzrejT2gt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207979, "uuid": "6691109b-bb44-46bf-a3f1-d1e878aba4c7", "value": 117544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207979, "uuid": "9cea9a99-5cbb-42bb-b246-0cc736b91ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207979, "uuid": "2ea4ee65-204e-4ed7-a911-5c2bbd342ffb", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473de048-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1768219654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219654, "uuid": "83d3f643-0769-4136-9714-b0f4c41060e4", "comment": "Malware payload (PureHVNC)", "value": "9abe88ab873fe55f26e583c4516867e1", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219654, "uuid": "11c6d441-1641-4e9d-b54d-993e585ddaca", "comment": "Malware payload (PureHVNC)", "value": "6afbdd737bf86294c83d722f4470fe94fff8ed1c52b3739bcd3cffd3b97a3471", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219654, "uuid": "4b39d6f5-e76e-4148-8251-97ceec76d836", "comment": "Malware payload (PureHVNC)", "value": "4653a100d891f6d96d183e15f07f31cb274495af", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219654, "uuid": "da5bba02-2684-4777-8677-ae0813c8dd21", "comment": "Malware payload (PureHVNC)", "value": "a3d83c5a401816fcf03c368c73e54b264638afea5507d599c9861efd2c0056b50e64f51f87583a214998a31210cad109", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219654, "uuid": "90ff8146-a0f2-44af-897f-bdc5665264fe", "value": "T15CF423082DDA6FB1CF2E5D70DAEBCC87073A880BA542C38EAC5C50875995759EB1F742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219654, "uuid": "52c15cda-7c3e-4a8a-bcd4-027c48460900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219654, "uuid": "59549e7e-073b-4d10-976f-bf9620a4de11", "value": "12288:miSj28njw7iPK0g7/eZfMnONW0tPHWmWpUzPxjXxAgL90xxuUu22Qsh:F+7jw7iE7AfMO02VmGxjXDCxuz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219654, "uuid": "9d15a938-3d14-4604-a478-e59cf251535b", "value": 754472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219654, "uuid": "eca86c39-f471-4e8d-a4fd-4a37d6f32a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219654, "uuid": "0d6634ef-cb5b-4e9b-9527-d3539bbe7234", "value": "mod_rp_decrypted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec986cd-f001-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768255046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255046, "uuid": "6e31fe11-a816-46d2-9c0e-7e2ca9a6153d", "comment": "Malware payload", "value": "7ea84322a3a6c9f66f43f92c98734569", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255046, "uuid": "181ebd13-6243-4219-8b83-e3f0ffef23d9", "comment": "Malware payload", "value": "6b2baad04293155518a6bbe0ec25b9b062bf3d2169b299ea8c98203be0960dce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255046, "uuid": "46fbe743-f3e1-4394-a95f-cbb61a420d8e", "comment": "Malware payload", "value": "4fb7caf0b087c570f9f517387be3c9c9cebc8c3f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255046, "uuid": "7898eecf-24b1-4085-9e4c-adbc6da5e756", "comment": "Malware payload", "value": "ca8c8074159b3a74776b38df476972d8c5420e5c8a18550dfffd13fa36ced9187d777cff47710f8d43e43e341f48f724", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255046, "uuid": "2b09b2e7-dc66-46fa-85eb-65737f02e318", "value": "T106314BE990BB8993C96D9E19F5F1856DE040E68A7DF3DFE8FC6E08250C578447008F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255046, "uuid": "8ed4b0b5-3cd8-46ab-8a23-17432dea93f0", "value": "24:nDjf8bOXS758fwMytqIuUf8D6LwrJJwAAf8NI9AKRCb:nDIGIqYZtqID/CGAA7Axb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255046, "uuid": "69e60d45-3467-4798-acae-bea4e0230c15", "value": 1459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255046, "uuid": "08b38880-d904-4898-a45a-cb6783cf18e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255046, "uuid": "0a1a48a2-f550-43f5-87ad-f334b5cdb03f", "value": "pewpew.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bd666e-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1768224803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224803, "uuid": "bbbcc1df-fda2-44b9-8ffd-4faadcbb1fff", "comment": "Malware payload (Stealc)", "value": "8df64ee128811fc25e2f472146363338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224803, "uuid": "5cdd75a9-4e0c-4e2e-a895-207006492976", "comment": "Malware payload (Stealc)", "value": "6b95bfa1b9fa972189bc24b7898be9d7aa045b9da988716b0bbe37b3bb6c2f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224803, "uuid": "d7b7d2a9-514f-4478-901f-40295e601fda", "comment": "Malware payload (Stealc)", "value": "896b2db86f261ab23ce46558564683c460bcf133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224803, "uuid": "6955314d-9f6d-40e2-af0c-b0514defed55", "comment": "Malware payload (Stealc)", "value": "dbf12185359484e966ec466e497d3dafb13d5906fb9df90c82d55ced990f662eb6bc658aed354b75d45aeee2e89e514c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224803, "uuid": "0c00bcf9-4656-4a34-b25e-decba4f3cabb", "value": "T14F36E9BB8E384C89C6C7F1F69781D6700DEA9E67A4E6E0FA51D109401F43B106F61EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224803, "uuid": "20f16992-6504-45e4-a9e4-aa5dc56ebcdb", "value": "d512f74fd5e290f01bfc48029b75487a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224803, "uuid": "ad522b9e-a37a-4720-b688-1d145c9357a6", "value": "24576:+ojTuUsMg/Ua+1KR877W/gLXFDNZJV2B99+6s+rMwH1GUJ/7t4dNdYEUbb7WRy1a:+bULLa+YRluVDNZL27JXo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224803, "uuid": "939ade6b-c7ab-4bea-a593-5def151c4d8b", "value": 4901376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224803, "uuid": "92431db7-4f8d-4706-a606-839986ef035d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224803, "uuid": "3418025d-663d-4920-82a3-407ca3ee3455", "value": "LoaderX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681bf764-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214555, "uuid": "7051e97f-d3e4-407d-bc78-60ecd9b307ae", "comment": "Malware payload (Mirai)", "value": "ce2c0bcdf3414c535994ce5aaff10336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214555, "uuid": "28fb6e28-f6aa-4713-a8ad-829341467433", "comment": "Malware payload (Mirai)", "value": "6b97d9a6ff10982ad9645d15b3f168b0b0659ca072c8a5cffd57773160ddb395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214555, "uuid": "b7edbb52-d5cc-4a93-907c-b5900206d4ab", "comment": "Malware payload (Mirai)", "value": "7db8bb307228fb14c57d7c52354254589b6b7c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214555, "uuid": "cfaa4dac-6e09-4b99-abc5-261e418615e0", "comment": "Malware payload (Mirai)", "value": "77bbb8e2a7360d49075730c7e3a52be549c5d7d4c8e8a7dc160723292a9efd0e49d647617753052cd712f6b089250f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214555, "uuid": "aebf35d2-dd26-4d3c-ad31-cdf9ddf47f1d", "value": "T1C1B3E8967700AF66C22CC13009F387D5ABF627D126D29149B26CDA1C6E7174D68AFEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214555, "uuid": "3811d2c4-e210-4b99-9286-7bdbb3040172", "value": "1536:njPiAJKjMcrYt37Q3Y1ORfxAtgmILy8SImyIglvGeMQd0XkI4XeTCMTbLQhHvrgj:nKQQsKmIWtyIOnd0XkhXG8jg62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214555, "uuid": "b479c34b-f1de-4b34-9920-b83173151a78", "value": 109936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214555, "uuid": "85e9fba7-34f8-40c7-825c-8279269f0ed6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214555, "uuid": "889f0cbc-5c70-4b0a-ba8f-669f626f1c16", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4706b9f3-ef84-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768201185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768201185, "uuid": "f20a051e-084c-455d-af65-cf1239e9adaa", "comment": "Malware payload", "value": "83872f8667e043acf3b66d777474dea8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768201185, "uuid": "d94d1de4-dc8a-4585-972c-f4182d49832c", "comment": "Malware payload", "value": "6cae7636767bb48d5091d62ada45db718169e7b16d876640af4e98df8e6e6def", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768201185, "uuid": "c7739721-4bdd-4d08-825a-946a3b706199", "comment": "Malware payload", "value": "b746c2e7b20af106a141304f4297dc4d1e8fc8a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768201185, "uuid": "6628eb1a-6aa8-431e-894b-dd75e520ef46", "comment": "Malware payload", "value": "26feff9776e87af6ed7ceed79ccbc2b306a17ad6359153efe7c3b02a49a676c9317ec7b6dac7f4011b5b9b9d2fe76ff5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768201185, "uuid": "db5c111c-c365-4167-a879-be072004f4e4", "value": "T144D6238FA7164B2BD47D85BD49AB772416279D0049E1970BE52C322CB8336A88FDDEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768201185, "uuid": "9e83635c-e436-44a4-93cd-25773fe52929", "value": "393216:wX4hbT1uVQMRbXylCVmqqf0iCc0STD3OR:E4xMZCldqqzRDeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768201185, "uuid": "5fa8b696-97bd-42a7-8294-b2f4564d8c0b", "value": 13862127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768201185, "uuid": "154bf408-9f1e-4322-a549-579bef6dda4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768201185, "uuid": "c716175b-9a71-439f-a51c-6eeabd36b22f", "value": "\u0130nat BOX.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e809c1e-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216740, "uuid": "99f2fdea-2a35-4fca-9541-4dbec1aba6a7", "comment": "Malware payload (Mirai)", "value": "77deabfacbf951ca0e96d0980104e375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216740, "uuid": "95aad83e-f6c5-44d5-bbfc-7082e27ad2c1", "comment": "Malware payload (Mirai)", "value": "6d0329f2cdaf6670732328f9f9ffd0282af6aa99e284643e44bf9b33f70cd9e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216740, "uuid": "1a809c02-49bc-4d65-868f-5ab2de389a31", "comment": "Malware payload (Mirai)", "value": "864d1e5b956fb2efd2bc33f42d6e757688cbc579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216740, "uuid": "0d5adec7-a3a6-4611-8b26-ee03e13e94d2", "comment": "Malware payload (Mirai)", "value": "28aef7a2dcea5e210e7719a5c1f8f5ff8397d6068d4d63eac00e9f54aa589e8e60d092cd93dce7312a9eae7e1d30ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216740, "uuid": "74eb5fec-7a8f-4385-ac9a-658a8e429607", "value": "T13363023499446141CC625DF3B339450E7E2D6FB821BE541B1526A0B4B3EE92A7FE23C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216740, "uuid": "eda5a087-b044-4781-b2c7-8b8800f4610b", "value": "1536:EMyqH3DeNMx/PazqYqq/EQtAeZVzD7d3iQv8mLpB9jG:EMyogMx6OYfbzD7dyS8mLbtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216740, "uuid": "32e7737f-9b0d-46d2-988d-cc003338e8b5", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216740, "uuid": "ee98bc18-636e-45f9-a7d6-1e1a6f9071a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216740, "uuid": "bea4e9a8-f834-4770-a731-91dc2a332353", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4e77f4-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179640, "uuid": "f79bde93-d19c-44f4-86f9-f6c30d274728", "comment": "Malware payload (Mirai)", "value": "5f9d6faade3b1b2dd4b1a08c28770b77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179640, "uuid": "ebb0f7fd-6323-46a3-b03c-b5bf7b337a92", "comment": "Malware payload (Mirai)", "value": "6d185d5f0afaba3c0499085a803f8147228e4b5962461d0828a24ee050d35d06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179640, "uuid": "ed47db61-f553-463a-8217-26e6ebe10818", "comment": "Malware payload (Mirai)", "value": "effcf12310713d707f9040e333d506156980bcb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179640, "uuid": "5f852ebd-5689-4621-82ff-59d448f0a8b7", "comment": "Malware payload (Mirai)", "value": "8f3c9655487d1b962bd3e54058cc750dff0afd31b84c8c1e2767da16b35c6137901eb85feda7e042bf98f2a992da7fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179640, "uuid": "4d15a65c-f1b3-4cca-b4e4-c1ca3bcf5b7b", "value": "T1CCA31231B733C484D183E9FE3214A1BB9316DFA5AC5895DBD45812CA3C8626A53F1E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179640, "uuid": "084414a2-f3d2-43c6-9690-ad45bce48a45", "value": "1536:yp4OnkI9oaJa72ykErJKRnGXSasDESTws4mPsxu3Wf51ea6lP++uWejef5MSDK:yp4OkI072y1oNDES9ou3WfHWPRtOCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179640, "uuid": "21772ba7-32be-4e10-ac29-c562d158b9ca", "value": 100588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179640, "uuid": "f8058ae7-00d1-4642-af66-28b9bcdaff38", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179640, "uuid": "19927215-1bba-4aac-ac83-4353e94ecc07", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e2f3a1-efa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217081, "uuid": "944e891d-042a-43f5-8773-f4594eb87ac4", "comment": "Malware payload (Mirai)", "value": "c97c35d59f1cb963f384891dcfde4b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217081, "uuid": "ad645ab8-642b-4a2b-a20b-3184efcc5e82", "comment": "Malware payload (Mirai)", "value": "6d333994ded4fc189759f0da7441165ebf78955553d2e88b1fd385bbe703bc6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217081, "uuid": "7d90f203-19f8-4f71-8fbc-6812411df7ba", "comment": "Malware payload (Mirai)", "value": "dca5370feca0e3f36e28b3efafea7ef8401a714d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217081, "uuid": "ca25c04e-3d78-4dfa-adee-b4e1313c89d6", "comment": "Malware payload (Mirai)", "value": "4af6066ebeab08efb182afbc3cf9b339e1d5dfa2fa3c787f2a177481477049361b6657362c740de6b63442ece7505b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217081, "uuid": "dc1d6e58-15fb-44d4-9788-0c9f223f5085", "value": "T149A31A8ABCC5C602C6E071B6BB1F51DD375643B8E3EAB107CD18AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217081, "uuid": "4a2c3b49-2e73-4e3d-9e5b-43417e70eda4", "value": "3072:bphBKZafCJdmgpNyzZTfOAWowBy9XPtGT2:3Bcaf0dmCN88AVwByh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217081, "uuid": "fa2dbd6c-8c32-401f-b509-3b48feb88b10", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217081, "uuid": "0826eb86-de82-47dc-a57b-2056850df001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217081, "uuid": "2a0c23b2-1ada-4534-a2da-fd028b30cc7d", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4887760a-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224810, "uuid": "4afbb6cd-1381-41d3-a3cf-aedfd27d5d77", "comment": "Malware payload (Mirai)", "value": "24c98ffb3a24aea45e42a7f83181ee83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224810, "uuid": "25182842-8a76-4c91-a992-d6ade8cf52cb", "comment": "Malware payload (Mirai)", "value": "6de9eda7ff26186a94b57938df8ddd2e447235e6f6e6d9ee8c06890acff2401a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224810, "uuid": "0916582e-29ac-440f-9e60-aa5bca51b507", "comment": "Malware payload (Mirai)", "value": "7c4e7916ae1efd413bd34e3ca9633bcc0ba4c78e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224810, "uuid": "334581b8-236c-401c-a02e-7bde867083af", "comment": "Malware payload (Mirai)", "value": "7412d3e222c474963445b9d18f4d88bedd93ec16ef2148452a1c31ceeec5488cf9cd4dc74659bfd5688d1ef3734605b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224810, "uuid": "f525c6ee-e02b-41ad-a9f4-cbbf3b407df4", "value": "T14483B84BAD539FACF32C43744F738B3AAB55238633A0C185E66CE9411D6024E596FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224810, "uuid": "493be114-eefa-47cf-a4a1-5f6bf5f327d9", "value": "1536:QgLDPSm7C19C1kv1l2vye1uEHHkkdfa34M6Vo0QTZe:QgnSovye1uEHHkkdfjM6VDQTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224810, "uuid": "41dd0b99-1aba-46f9-aa29-48a1ab8e0144", "value": 84576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224810, "uuid": "fd9fa72e-cf8f-44bc-9891-be1e00b745fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224810, "uuid": "8a3728c4-8ddd-4d99-ba72-51432b3a8ecb", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857fc913-efe3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768242092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242092, "uuid": "28656fb0-26e6-43de-892b-e7e3021f1a47", "comment": "Malware payload (Mirai)", "value": "b450a530129dcec64588f23313bffca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242092, "uuid": "e715cef1-ef94-4fd7-b89f-86b3b19313b0", "comment": "Malware payload (Mirai)", "value": "6e156c93b0359dbe22bbcaa30ebc24b366dd97a077ebd6eb315f16ef71f03782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242092, "uuid": "09315787-0df1-41fc-aab3-ae1dca675139", "comment": "Malware payload (Mirai)", "value": "9b8026eea3902c020014397491a290ecf021c6f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242092, "uuid": "9cdd6e2e-ebb4-4255-8a9d-3f9eede66b8a", "comment": "Malware payload (Mirai)", "value": "82d5c04b03d30f9470f2e249fb8e4bd6cd5bc79508868d6e0b64d00a92e287c2f2df393ffe417226a68211337441f9ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242092, "uuid": "f08ec9b2-de3c-4c68-ba90-fa116d2e5368", "value": "T151043A2277760A27C0D4A57671F75733F6BA47CA14A8C61B7EA10D8C6FA45903223BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242092, "uuid": "5ec5e252-ee4e-49ea-8560-f6c3ec4e2a6b", "value": "1536:kYeAQUL/TqzLPNe76W+nyJ2qYDLMVhKU6HtPuC8niWGwdNhLLBz/gCFYt7aeRVz7:VLkE+niYsQ9pSGCt/Ia4VHlrqhh1e0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768242092, "uuid": "e12deabe-d644-40dc-b004-6d8c1fe341f4", "value": 175368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768242092, "uuid": "29d6c8bc-0ddc-4cf7-a1e4-ebc4683b1639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242092, "uuid": "ab0072d3-7155-4c04-aeab-aa49105a7bbf", "value": "csk_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75df4af-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204783, "uuid": "0911aa48-cf45-4317-8ef8-fc5e03545dba", "comment": "Malware payload (Mirai)", "value": "810fe9af5138106fab3c96b02515b787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204783, "uuid": "56aa9659-48dc-47cb-a8f9-7cfc17ef13eb", "comment": "Malware payload (Mirai)", "value": "6ea7bcf928c00986f8f5b95cfbb8fed3881334dcddfc6947567191b7d76e34e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204783, "uuid": "96467103-412a-44e3-8923-1683df53101b", "comment": "Malware payload (Mirai)", "value": "462f19110ade22a4be1f4a3896e51e3592048e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204783, "uuid": "afd7637d-c3e9-4543-a102-fd78b9f53c56", "comment": "Malware payload (Mirai)", "value": "30f6dd704308b77943e4b631dfa4eaea2f94b5a09f8d9f76e8b4431211bdce10e479e80522ec3abb2563823eaabf03a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204783, "uuid": "d74c7e96-22a9-4d5b-af3c-02d0d277306d", "value": "T194835AC18687E8F1E80905792176F377A2B2E97541A8FEE3FB54863364119E1B18E34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204783, "uuid": "f0dbbf93-664a-4508-8d49-76e2da8dc0a8", "value": "1536:aY5IqYs+tzkYITuNfUZ+3fjA22p1J8cf97jvT+rX3M+hMTAsozEdu1itbX/rSXRR:agpYs+toHCZvjip1J8aVL+rnfhMTAs6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204783, "uuid": "f94d3b07-91ff-43eb-8c4f-9c17bfe06b44", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204783, "uuid": "d1c51581-a20b-497a-8caa-5563a49aadde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204783, "uuid": "164b38f9-1c2e-4bfe-8f28-b3ca22f96941", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b14709-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217604, "uuid": "e77367e4-5e25-4c64-8d6e-8a9ddb1bd660", "comment": "Malware payload (Mirai)", "value": "4150e2b196208037da63340963163897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217604, "uuid": "886bc05b-4ba9-483b-a044-d6716010f647", "comment": "Malware payload (Mirai)", "value": "6f1c6eb410adfb1db3cdfdcaa195a098fa53c67e69bde2cd8449716bb47faf66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217604, "uuid": "27d49c26-667f-44ba-9c64-20f4ef1b897f", "comment": "Malware payload (Mirai)", "value": "7eedd5290443acf9ce292721dd6905cc566e8415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217604, "uuid": "2d6ea91a-a23c-4e05-af2d-01e28529c80e", "comment": "Malware payload (Mirai)", "value": "0c034bc380f07b0186a8768604eb9f33b725ee7b088eea2fb99d8dfe02c807f0c6dc809863f5a52db42d04fbf9e58cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217604, "uuid": "996fd372-5280-4045-81a4-05dcd6a19c3a", "value": "T1C2831846BCD28A12C6D423BAFA2E11CD332563E8E2EB3207DD155F1437CA92E0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217604, "uuid": "6baa5cfe-363a-4c09-a1c4-9783368f6eee", "value": "1536:le2mNlr2sasXOLROmY7VDfOnWWEPN15kVPWHfhMykdZphbCqrftm:le2mNlrtqON7FfKGu+JzqZphXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217604, "uuid": "bef378e9-6b42-4875-91fd-5d43b89f1566", "value": 83784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217604, "uuid": "9956c21e-57d3-481f-ac2f-9146c6bb0b7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217604, "uuid": "97789ce0-c611-487c-bd47-2eead3df1a89", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28d4ada-eff6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768250435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250435, "uuid": "55011448-b4bc-4525-bc5e-41edd529a70b", "comment": "Malware payload (Mirai)", "value": "576bc91089e798fe1519f2e4a46267fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250435, "uuid": "7a8dad83-783a-4ba0-8c12-f80a84db9a42", "comment": "Malware payload (Mirai)", "value": "6f528f4f554bd0e0b2dd4fc36fb3c1f626726710af8a7fd215a8529e513491ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250435, "uuid": "04ca7570-bd52-41b6-9d9a-d45d65fcee22", "comment": "Malware payload (Mirai)", "value": "c697a8c82596f8b297cc922d076d39a51dfea81d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768250435, "uuid": "9ea8eeb8-9e82-4966-89df-033f8b01aa2f", "comment": "Malware payload (Mirai)", "value": "29e3245c268320ed53b330882c310f3af0787aaba47f381a004cb3b474b6f61b7bdd99c6d5cdcd0d13220a3eb13457e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250435, "uuid": "4b6e16f8-a726-494c-a179-43f6fb64acb5", "value": "T15F4349B7D86AAE5CD228D564F0B29F792B43A910814B5FBE0AA7C2754043DDCF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250435, "uuid": "8d97e4ad-3ca1-4852-9669-828f810f72d6", "value": "768:eTolP+uYyflsL5ZLCw5whbRyHC7rae52gBrOPcxaOC1mNTKCAqr4a41oLQZzNY5s:yAR/i5Z2w5ebKgqU/C1kKCAq/46L0NYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768250435, "uuid": "aa4e08a2-41ef-4308-b8d9-b1f5fd17a726", "value": 59428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768250435, "uuid": "f0f47862-120a-4c60-9504-f246365fa1be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768250435, "uuid": "1d7e4c50-361f-4ba8-bf4d-67634001cd3e", "value": "odin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7252e7-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211262, "uuid": "9112c71e-4073-424a-9ee6-75553a4d2f1d", "comment": "Malware payload (Mirai)", "value": "2cf8ea2ddde83b28c75db603d2e62f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211262, "uuid": "89914de4-8626-46fc-ba9c-1f3e66accec3", "comment": "Malware payload (Mirai)", "value": "6f5f1223fe6ce0909e0811af4a9815193fbf50c69e3fca0470fe5abce1a13116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211262, "uuid": "486be3d8-d662-41e9-a056-f0f091f30146", "comment": "Malware payload (Mirai)", "value": "d268d5468fc014e8e82a1d3f77d720c69954b6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211262, "uuid": "b5721809-0369-4b8e-86d6-e6c973cde255", "comment": "Malware payload (Mirai)", "value": "764b9b5f7feb2d25c5b824960706bc15079e99a0f6051ed4c6af06de8a7ea8b167e30f1fa8c482f7fa82a2fc39fb0eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211262, "uuid": "9ec2b5eb-cd9e-412a-a3d4-22adf73f6e51", "value": "T14FE30946F8819B16D5D511BAFE1E128E33231B78E2DE72029D246F647B8B87F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211262, "uuid": "a6e0312c-21b5-46b2-b85b-07d31167ef5a", "value": "3072:my+2sJhOGbiSFUX4yGahV9I3hvT4pybA5+d/iR:my8PXiBXPGahV9uhrk+d/iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211262, "uuid": "a39d28b8-9600-4e2d-9fed-8b654675d0ec", "value": 148720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211262, "uuid": "69dc2aa7-fe05-47f8-a8da-56894ccc68d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211262, "uuid": "d0955411-d4ee-4a7f-9200-46a243db97d9", "value": "bot_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664f38fc-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214552, "uuid": "f56b04eb-ec7e-42b4-9bab-ba464b09d40c", "comment": "Malware payload (Mirai)", "value": "645c230638dbd8c86a3600a9b7154853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214552, "uuid": "739e7a3b-d8a0-4059-bcf3-5e84e6fb4be4", "comment": "Malware payload (Mirai)", "value": "70019f29ed2208f1dea3a9ea4ffe191e22120032962b6b2bf0ea05e119ae2114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214552, "uuid": "86611267-91e7-4803-a810-d45defe590e4", "comment": "Malware payload (Mirai)", "value": "f81593491387de3b426e59023af8a89278504df5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214552, "uuid": "fb3c7980-5771-4522-9657-2239a86f9366", "comment": "Malware payload (Mirai)", "value": "a4ed7efa4ca5845963a347011bf06c2345163bab25a9b3900f31d8248de03b733f1f601f079db6207392eb0e01a6b19e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214552, "uuid": "43f4f5bd-0b45-499a-aca4-bb1f23df7873", "value": "T1EFB32C42FE915FBBC44ECE70452A838611DC84CA83E6632F727CC98D7AAD64949D3D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214552, "uuid": "8e3e9a97-d50b-4743-9c4b-030b5185280f", "value": "3072:Bh+f6mpODZt2IakydG2dUzcSJc3260ddz4NrCvwbv976FPlinF:Bh+f62Et2Iakyc2dUzcSJc3260/z4NoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214552, "uuid": "4073c73a-c422-4839-b907-99b20a03cff0", "value": 110064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214552, "uuid": "b4e3a953-247b-4004-b82b-8f99729f3b49", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214552, "uuid": "6e542684-5777-4730-a6bd-af6a12ca61e0", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e977734-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218700, "uuid": "ff91cd3e-7ec3-4ff1-8415-6b75642e030a", "comment": "Malware payload (Mirai)", "value": "d445977091acaee0108c7bbcac00a380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218700, "uuid": "b2846c42-aad0-4519-96ba-7279bfe38e6a", "comment": "Malware payload (Mirai)", "value": "706933b63a14eaa535e84a565b76dbceacab6a0c413b966c7828d8980e2fb847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218700, "uuid": "92aaacea-6ef2-4924-a4f1-e5e2fb633d6b", "comment": "Malware payload (Mirai)", "value": "9494bbafbc85baaa56f0b61efe0a33bbd803ee76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218700, "uuid": "af6594f6-117b-46f7-936e-c2c242995424", "comment": "Malware payload (Mirai)", "value": "1d5f011ea5d5e44af2148a183a797d175614b08d290a8e2bb133a9871db0fa6d4f59bee214804b2e5e97529ef971ad66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218700, "uuid": "de03d3c7-8c77-424c-826a-cde3b657d4dd", "value": "T1D7935B22B539193BC4E4947722F35326F2F6438A14B88B2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218700, "uuid": "796d370b-ae00-4155-8b1c-37edf5f01b0d", "value": "1536:08RsLd2/48pr4LaYqPoQatmjKtHw8Ym5owAtQIttQB:0USjsxOR9YOlWQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218700, "uuid": "895460a3-8797-43f4-8327-1f250d9cdeeb", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218700, "uuid": "a086d56b-ce38-45ec-befb-b588fe05b7fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218700, "uuid": "9439f889-c486-4a34-866f-46e5b0c60a61", "value": "johen.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eed8b05-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768223183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223183, "uuid": "3c23fdfb-e4f2-4aa2-a7ea-145295b0e207", "comment": "Malware payload (AsyncRAT)", "value": "e3f358daf88f5e2770f925a0667d65af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223183, "uuid": "145b885f-9ec6-435f-aec1-491082bdfd71", "comment": "Malware payload (AsyncRAT)", "value": "709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223183, "uuid": "d49c94e7-227d-484c-bb89-cacc5588bc53", "comment": "Malware payload (AsyncRAT)", "value": "4a75efd8cafdee49709319a994ae763fc9199b1f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223183, "uuid": "a7a3026a-3a1b-42ee-b46f-339b6707c27f", "comment": "Malware payload (AsyncRAT)", "value": "68d69ccff5e789199b109efa177b81ea6a0b7a39e49d548126cf13a4d971b9aa555b025a7c4afda0170b61ab86885e22", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223183, "uuid": "c1efb5b6-bcf9-4468-805b-b29574278500", "value": "T1B3060127B2CB653FF07E4A364977E212593BBA6169128C6697F4086CCF260D01E3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223183, "uuid": "f7fa8f1c-df5c-49e8-bb38-feeeb824961f", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223183, "uuid": "e3f5ff0f-368a-4245-9ac2-f65001915b66", "value": "98304:IxHXserC+JZ05Uz+qDF7ttR4YxxrY29L0DiKvC7o:wserpZ0525ttRpxr3F9KvC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223183, "uuid": "fed134ce-5bd8-46c7-8f55-c8034c71570c", "value": 3715248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223183, "uuid": "6907c515-1a8b-4d47-b1c0-3f4a3d85dc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223183, "uuid": "a54403ac-b77b-484c-8b5d-fa30850d87e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e8efcd-efc1-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1768227268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227268, "uuid": "97e78956-77d2-45a3-ac2b-41bdccbd8e24", "comment": "Malware payload (GoToResolve)", "value": "b43c52d7f2c0f09f00d615c4213ab04c", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227268, "uuid": "4780e575-f400-471c-a957-6c17179b160e", "comment": "Malware payload (GoToResolve)", "value": "70a260593cb2cdb9363ad98f7cc97dc53d1819468436553bd99ea33fa3cdd131", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227268, "uuid": "d3cc26cb-f3de-412f-a1e5-6812f2dd42d1", "comment": "Malware payload (GoToResolve)", "value": "ad024b1d6482b763398543cf1fa554ff95842aa8", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227268, "uuid": "0907cc4d-439f-4e79-a14c-d6049e481699", "comment": "Malware payload (GoToResolve)", "value": "cb1cc9e0629c545b58eb847cb7506360b2d768ba1743fd4ee8280d8bd3333352dbd13ddc1e983c03b906d53f242c479a", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227268, "uuid": "26fc9266-29b8-4706-a59b-e0a7c711f317", "value": "T132373312744BC636DA9F5133402DABF5633C6E505BA481D3B3DCBA7A6B302C2177269B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227268, "uuid": "85079425-d20b-44d8-9357-43a081de7a59", "value": "393216:qjy36SLgW1nJoKIfnxW+2BF+fcY8g53DqdB8IlflOnb7ywg/bVScr8efi:cvWZ08+2Byh5zkB8edYb7pibf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768227268, "uuid": "d5f670e0-7425-4cd1-8cfc-05c86ad41045", "value": 24379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768227268, "uuid": "c4b2ce85-bda7-4afb-a220-5a28506a2670", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227268, "uuid": "beb18021-807a-4b84-8457-f11f429729aa", "value": "Open_Invite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7fe414-efdd-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1768239310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239310, "uuid": "d1f19f38-9fc9-4d72-91ab-6d1e4e49cec9", "comment": "Malware payload (SVCStealer)", "value": "25cebe70547c2732de0a9050fd4a76cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239310, "uuid": "76e09c5d-4386-4d77-8f5d-c3c53a581c37", "comment": "Malware payload (SVCStealer)", "value": "70cb2301d0eef30d587d26052cf7cab6f3334dcf529485a1586ad9e21584d035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239310, "uuid": "70113bda-c563-41d1-ab97-931cecb74955", "comment": "Malware payload (SVCStealer)", "value": "f071cc95e4360f4874c4345a17a4ebd24c9ac4e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239310, "uuid": "010fadb6-6b5d-4c8a-952f-22f999de19f9", "comment": "Malware payload (SVCStealer)", "value": "5e0b3f11a24b389b42c621f9842ce976dd201d33c7aed584a270f9b6b4d51b016013906689beb61e7644d13d9c8ff527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239310, "uuid": "a4e317df-0bad-4830-bf5c-82cac8ec153d", "value": "T1E8538D13B7F2C032F16295B409249B624FBE782156B4D6BB1B9C10E9AFB1690CF39357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239310, "uuid": "d397a97f-5693-43e3-b1c6-57f3b3e0255f", "value": "55380ca6450e841d3d090c9d1307b680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239310, "uuid": "63b36021-d8a7-4a42-8776-8b49d9b9b6e6", "value": "768:GUp9fff0yKZax2wNfEiMgQacRZidIZMq+sZhHxDPakkaLEDDNVntAiNwZCi3AhRE:df0yyaRlDsAqxpSk/E/AAhoB2yk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768239310, "uuid": "db4659a9-0e1a-4b6b-80b2-f77f13404828", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768239310, "uuid": "70b37675-38dd-40be-8279-dff94b4e248a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239310, "uuid": "6346d6d1-2f2d-4c52-a871-ab7b95fd4c87", "value": "x70cb2301d0eef30d587d26052cf7cab6f3334dcf5294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c20aa-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218684, "uuid": "73c040bd-72d1-491b-8458-798c10e608d5", "comment": "Malware payload (Mirai)", "value": "fc52ce7e4d572e4d7becdd83f1d3fcd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218684, "uuid": "f4ad415e-764f-44e2-aa34-9e5c6dc10348", "comment": "Malware payload (Mirai)", "value": "719aae37a038b5f0699c7cb07c9088a5a398e5c96e3365149c94e35edb1aab10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218684, "uuid": "2fc71e14-4af7-4045-a357-e51597c73b21", "comment": "Malware payload (Mirai)", "value": "b618d9f8c986dfff1378f3cc4d82aa99a7cfda63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218684, "uuid": "389a285a-aef0-495f-ae17-460be1bbcb78", "comment": "Malware payload (Mirai)", "value": "97bfc80a153f6714e777c6e5c8f7b4b60a71c747c16448845c5c6989bfb42e6f7cf345b3e4e8f06bbb90f0c32ac8b98c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218684, "uuid": "12bfdff8-24c5-423e-aa85-b026ff1833d6", "value": "T18203F121E6EAE246E7F85073E0DE710749A1E61166ADC07ADAC0943F4D4BF54BF3E620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218684, "uuid": "9e995a81-7bb7-4739-9167-c541b2122421", "value": "768:g2HJeRRzOfGyM21RgGW1Gz0kclnnKwHgLf6QjX4rgJaUIpx5nbcuyD7UHQRjl:5CRzGGyDjbWP7nnKwAT6AogaUIpbnouo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218684, "uuid": "7b3070fc-587a-48cb-a845-cb7af8cbe9e7", "value": 41296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218684, "uuid": "4989522e-6556-48df-88e3-dfd85f023ebc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218684, "uuid": "cb266d82-a69f-435c-8649-a71e08bc93c8", "value": "johen.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6749a0d-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768211224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211224, "uuid": "38423bcf-ee28-44c7-8526-8e2a276e45e8", "comment": "Malware payload", "value": "fed8f4d0f74c9a6f917984cfb5137bee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211224, "uuid": "f72022ee-fcb3-4ec1-aed1-f06669fca00e", "comment": "Malware payload", "value": "72268ca67c3a7b170ceb009fb98919063d265cb2d911d2b07a507f479e48908a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211224, "uuid": "087d5d7c-cfe2-496d-b76f-2a4ab187b1e3", "comment": "Malware payload", "value": "093189891839a698ec85d88d3ddf18d10b0f2859", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211224, "uuid": "0773011d-5ada-421d-992e-1782dd4947fd", "comment": "Malware payload", "value": "2a8ab634380ab70a9cd21d5a2ff3906b64be338e2a93fa0477ec5fa7715cb36a399b85f1d5f2eafa64b72e1c110791a2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211224, "uuid": "d71f5a20-fe2d-4e6a-8350-1b014c3dc190", "value": "T1D5E4A687F1208ACBF44FEABF04904311ADB0E4704607F2552B6E895B2FE79C89F556E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211224, "uuid": "744fe2a2-45c4-4916-a7f8-a5e8a43b6ec3", "value": "6144:zM+McR2DvRUQKNqXMPHZDkZWeQiw0XZbFyhA1eMX5Uh/W94gpr2T+h6PjhMop0:K5SHxU7C0daAfEL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211224, "uuid": "9ea2bae2-6ecb-4361-a1b9-c88523a4fbdf", "value": 692562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211224, "uuid": "3e2a5313-0ecb-4d32-a992-6d9a2bf55bfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211224, "uuid": "62b474a2-cddd-46c6-9723-87303010f13b", "value": "ui-utils.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d378da24-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (KongTuke)", "timestamp": 1768230626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230626, "uuid": "a4497d33-4ccf-483e-be15-e1d8c514a1f7", "comment": "Malware payload (KongTuke)", "value": "c7437d9fef91dbcb53cb34df780c5b34", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230626, "uuid": "5d928223-ad7d-41b3-aae2-7f7852c8ba4e", "comment": "Malware payload (KongTuke)", "value": "727643cc6bc5d3f0ccf5211217b2a5276e71eee81454dffa8ddab56d24ba3f6e", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230626, "uuid": "9e08eb89-8973-4747-bacc-cc69ee0b4305", "comment": "Malware payload (KongTuke)", "value": "582c0d3cd9e2e0631610d3b7b29760038bf046cc", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230626, "uuid": "a9c742b6-335a-4013-854e-058f2a737f37", "comment": "Malware payload (KongTuke)", "value": "2e51f3a3d4577935a615094ef3c7f1d73ac1e2869af558589c0a94713dd1f45942465ee1ed1383f59fcf2a996f4f53ca", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230626, "uuid": "352c3eb6-7830-4259-9a34-762823733cd3", "value": "T18571DDE7E2E8CA5F646511E9952A310B20E1C6BE4CDF834465D2260FD62F850BF2B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230626, "uuid": "315210b8-0ed1-4bad-83e2-319ea4595e34", "value": "96:Te8xZqgFOIQqjkb4cj5pzelcj5pzeMptxMT1ov+p2:TJrq9ILjk8gilgiYteT1ov+p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230626, "uuid": "2cb5acd7-97c2-4165-a0fe-18a10e806706", "value": 3758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230626, "uuid": "33cd72c9-9c2d-48e8-8125-09dd6d53af9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230626, "uuid": "e2bd0632-4f75-49ea-91ee-272ac678fddc", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa22c6a-efc0-11f0-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1768227265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227265, "uuid": "329e1da1-e8de-4141-b53d-a8051e8ce7c7", "comment": "Malware payload (SimpleHelp)", "value": "f63f86cf25891f8609e5523545d46a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227265, "uuid": "1b3cd7ad-cbc7-46d1-8d61-9b555683141e", "comment": "Malware payload (SimpleHelp)", "value": "73255da4bb7f8af9ac80de803b86c8f808759f5796998e90aaa2af946a129647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227265, "uuid": "65e1d922-2f88-4efc-ba04-69eb5dddfb4c", "comment": "Malware payload (SimpleHelp)", "value": "23b444193115284810fa7e8c6781344703d4c0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227265, "uuid": "14b4c9d2-7456-478f-8e98-1deab00bf746", "comment": "Malware payload (SimpleHelp)", "value": "8be78f3f932a3f2cd4e01e6319414a0ed6b5b520bf44a5f25d833b10cf15ee1ade2b6f75c82973dff64cb0846bb7a690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227265, "uuid": "5ee31db8-0195-4fd7-9ebb-44dc4f2dd696", "value": "T1DA85C034E6A15DBDCF37AAFCD08E44DB979BB9A203C5012717F086D68B613D0542EE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227265, "uuid": "b2e70b25-0ee6-436c-a4aa-0d2ac1c49aae", "value": "8e73f0b1ba8e9ea271385585fb4d5c02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227265, "uuid": "6070b58a-5b11-4711-85d3-9386c81f6964", "value": "49152:MOlCQ8msodjHF2bg2h0kSKX15dIpRkud5ou/btE:PXJrVRR75ou/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768227265, "uuid": "a328b307-8075-4149-97d9-7a8772b0232f", "value": 1721928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768227265, "uuid": "450192cf-87f5-4135-98c0-3bc0203db00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227265, "uuid": "54604ddf-0781-4e0c-9c4c-4aed6abcd15b", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e612ae-efea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768245280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245280, "uuid": "4e08fa07-692d-4cc3-b1e9-c417d7a347b5", "comment": "Malware payload (Mirai)", "value": "8f8dae09644e3cda1818e1d88e3dd02f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245280, "uuid": "c8e7f5c6-1375-469d-80ca-e357d195071e", "comment": "Malware payload (Mirai)", "value": "732a50450aa69ea1c1c59ee4cf8c304d6d45994567157d7f777e1aa3b5544782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245280, "uuid": "36be2488-0974-4451-97e2-9e390707ff66", "comment": "Malware payload (Mirai)", "value": "d166bd8aa4743539582a1cb1ed82e15b56e156a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768245280, "uuid": "87cbaca1-2d13-49ec-9cbf-920ca2f78e23", "comment": "Malware payload (Mirai)", "value": "e78c2cde0c9014a77855f4d31e08f9fb6cda320bd47a06a0803c95d6a9abcd467b93f91569c284ad7deda279954ec3c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245280, "uuid": "caf6a981-9915-40a8-a74a-990f483d4458", "value": "T190056C1BB2E3B4BCD027D030439BDAA2A935B43602116E7B65C8D6303E5BE701B5DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245280, "uuid": "35ec20b3-8867-4c50-9c62-742829f7601c", "value": "12288:R5LBEMxkDH8o4s8dD/AklX7pBnGYvtwvTdd8jTufk47EetcPBdzuF3MOJywpZVxH:TiTD4sjklXFsY1w7dYux7JtAiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768245280, "uuid": "bd3969b2-c782-426b-8c46-62e28fbe6d37", "value": 841360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768245280, "uuid": "e3e7e008-725c-410d-99f2-aa8b9a94038f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768245280, "uuid": "f913c1b0-9b85-4d40-936c-81e2dc169f33", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4974c7-ef87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768202487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202487, "uuid": "6b35fe58-c3b7-4bfa-a631-c9c28d15d47b", "comment": "Malware payload (Mirai)", "value": "cb04edb264bb98ab46d9d1998f2cb76a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202487, "uuid": "34145c87-abc9-495d-a66b-86ed45e58e45", "comment": "Malware payload (Mirai)", "value": "742c82579806a741b4fb8203886b9f83b7fde19fbe3b35550da413597002f75d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202487, "uuid": "ba226a75-911a-40df-9dcc-b3f28877e3f2", "comment": "Malware payload (Mirai)", "value": "e069f8bfa85c6f12f066139f01f3cc664afdc7fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202487, "uuid": "59ca7dda-778d-4bd6-ad04-240c448ea702", "comment": "Malware payload (Mirai)", "value": "1d3bb3b323c0ff4045c810eae356a55a7bd9af5d95f7c3c311b4479bbcaa57bf1359cc329c9798b38b030e7a7410607c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202487, "uuid": "db1acc38-b638-4977-b650-5b202c207035", "value": "T1F9437D63CC2A6D58E15499F6B034CFB99B63941481875FFD16BAC2796083F8CF18A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202487, "uuid": "180fc618-1199-4520-aeee-c9903a059956", "value": "1536:HocmIAKHB7tXwMDgTQAKFegP7m8pOCCzilB:HzmQhF//pOC9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768202487, "uuid": "c5c8805a-f070-4445-a3ea-ef528bab089a", "value": 56209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768202487, "uuid": "b983c614-c820-41a6-808c-a11204721fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202487, "uuid": "daba22a7-7f81-44c8-919b-2d4eed3c0446", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb034574-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231444, "uuid": "78d7bd46-2f81-4f35-97e1-c140be1c90f5", "comment": "Malware payload", "value": "185ee6418df08ae2e1dd6e4ebb42b5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231444, "uuid": "880c9f64-ca1e-435d-9124-cbfb3cf98ed6", "comment": "Malware payload", "value": "7473dda3ffcfe2e31ac6eb5890d03a57acee056cb574231b4313058608a45da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231444, "uuid": "e66c92c7-2718-4119-ba06-4c973edb3df8", "comment": "Malware payload", "value": "32e36269a7e70e565a2daac383bad994550eb86e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231444, "uuid": "74c21d8e-2884-4fae-8cd0-906f140db3eb", "comment": "Malware payload", "value": "249fec9666328e49fa8d3c8cdc7cc4d1a2bd345cad62bc76cceb08110ca551d26cd66a0d383c5433532cc82aa36c4a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231444, "uuid": "456f36e1-600d-4a44-8598-34eaa5beb5fc", "value": "T1127229129E9014A1DE91037583BE7A32E1BC6742234844D357BC29896F706D7FE3AF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231444, "uuid": "77455e6c-cf36-4cb6-8cab-144af3d92d27", "value": "384:3o4wDTyysCTBIRJBAQy4gk+QhTFfsveuF0L/2mv9HN:3o4wnRsCTB+JBAQy4zd+1RmpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231444, "uuid": "92f10a69-efb6-45fb-b4af-65f51acdc3b4", "value": 16006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231444, "uuid": "24af8057-450c-418d-972b-aa3d1d2c5fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231444, "uuid": "d2eacc33-2911-46e6-b16a-4605c015b77a", "value": "185ee6418df08ae2e1dd6e4ebb42b5ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee41185-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214566, "uuid": "7577135c-c8ac-4a21-8103-a4be9eb8e83f", "comment": "Malware payload (Mirai)", "value": "674f129f331830ab087340b604e06d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214566, "uuid": "bedc53e3-8fe6-43bf-a4df-f67b12eacd4d", "comment": "Malware payload (Mirai)", "value": "75168007ca22c5964434604ec5aff7983e0db4bf6a1cab6076bd797f1458ba35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214566, "uuid": "6ada7252-a3d9-4f90-829d-94e1c276fae0", "comment": "Malware payload (Mirai)", "value": "de2ab27c58d6999c2ad58c709ed7dbd4ca388ea3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214566, "uuid": "c2e4a4b0-3e5a-4ba4-a0af-ffb8b777e8cf", "comment": "Malware payload (Mirai)", "value": "097c79685a513072ab78757e2877ae142843a1b740fad9e9e66c4c2eb57bf20d18999856868b496a509b60fee433d5ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214566, "uuid": "81d9f22d-e551-46d6-ae1e-62b03486b537", "value": "T10D631942355D4A1FDEA6AA70042F07F0C3BAA6F150F0B986251F6BA64371EB60447FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214566, "uuid": "5b5652f8-958f-4613-b27b-0dd753feb2b1", "value": "768:bENbQ9yxxMSp7DkcUxis89JPiM69/y7sskquvK3Ihy2+uFNiy6t4ebx/X6JT6IP2:bIJ57Wis2JPi16xBuC3Aybfyad/qJT6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214566, "uuid": "34b5f97e-09aa-4464-91fc-ad5222f99908", "value": 71624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214566, "uuid": "273aa828-6ddb-4a5b-abc8-955ef36cab1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214566, "uuid": "a5f436ed-7094-4078-bbc4-62cc9a6050b1", "value": "shadow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5efe16b-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246468, "uuid": "5b9dc5fc-47c7-429f-8026-eabc38570907", "comment": "Malware payload (GLOBAL)", "value": "eebbd7f9b9a57f99dec9462c4eecd65d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246468, "uuid": "5556b7af-7b10-42d8-93cb-c467391fe23e", "comment": "Malware payload (GLOBAL)", "value": "766f430544751677d52fb8602a6eb27a8fea7513826aa99319017209c1970029", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246468, "uuid": "2f829a73-25e0-43c1-8721-3c230ffd5810", "comment": "Malware payload (GLOBAL)", "value": "f60cac8586b168e98f776f656309259890642a1b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246468, "uuid": "0ba6697a-df10-4d56-b14d-3ddf09a3b77b", "comment": "Malware payload (GLOBAL)", "value": "d049248a62bf488704f18d6c778b3c0aedbf6153963685e43b523bb537bc6a07c0d17be71d9feba993b4ea14212c80d7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246468, "uuid": "5d600ea4-3840-4561-9f5c-51e5440ac667", "value": "T1E3347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246468, "uuid": "ca14191a-66ea-46d5-b710-0431683f2c0b", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246468, "uuid": "bfdc8b31-dced-4611-aefb-c5b53fb7a7a7", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246468, "uuid": "9d71cd56-d8ba-4c0b-990f-709162d76e66", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246468, "uuid": "d2dae64d-f2e2-4b36-b209-cd396a4ec20e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246468, "uuid": "56256e34-421f-47ff-bee5-299187c88059", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f32d3a-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216732, "uuid": "9b1fe35c-9153-478e-8770-345e404f9708", "comment": "Malware payload (Mirai)", "value": "61e562065d963e957add8170379db606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216732, "uuid": "17edd94a-5182-49c9-9eb3-3706f3c301ef", "comment": "Malware payload (Mirai)", "value": "76b5daf6bc1527726048d5ee444b5e2d79f99f519a1b290bbada05892cf14d78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216732, "uuid": "5cb3167f-1977-4631-b384-f155168208e5", "comment": "Malware payload (Mirai)", "value": "bc200b9fcfb0de121f8b7dd16c1213019cfed731", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216732, "uuid": "58fe5508-bd7c-4c23-ba57-bd83bae4ad5e", "comment": "Malware payload (Mirai)", "value": "0b96d80363116f2cc87ca7d7b8ebed920a68b458e792e225b8742dade0c64d4eefca30f2e304db6680555e4fbd6efa18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216732, "uuid": "b6418a39-65da-4a59-ac49-8c11d2b23e75", "value": "T144739E23C8AA1998D25C42B8B170FF3A5773E45056536FF7069ACA7AA047EDCF8053B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216732, "uuid": "cec425d4-6b63-44de-ad95-23135775e1dc", "value": "1536:E/W/lVA7lvzYyfaLKoJqU74Q/FwC9yEht8L8:EO9VUxYyfauo55/FwdOSL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216732, "uuid": "dc2a74ce-bcd1-4f67-ae0f-2f10cd7a5034", "value": 80368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216732, "uuid": "d3c10a5c-66d8-46a8-a940-b23b87cc12e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216732, "uuid": "37e2ec17-b926-464f-9bd4-dcadd091dba5", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c18049d-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218695, "uuid": "724fd847-07dc-4ab4-9271-aaadcbce9f44", "comment": "Malware payload (Mirai)", "value": "91a7a7b394cf70b7f0b021b01df78265", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218695, "uuid": "d068dc86-4076-4bd7-8897-501484de0295", "comment": "Malware payload (Mirai)", "value": "76c88be27a69fe4878379414d17f9d6f1a9f3887c7eb27043b80093227eb136a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218695, "uuid": "097e6d5e-c9fe-4b6d-af24-7c4cb391838f", "comment": "Malware payload (Mirai)", "value": "5c51a6e5e5d7e0ce5e6538c8105e3d6a3ae80c0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218695, "uuid": "8598395b-2aa7-4034-8060-fdc0694d74e4", "comment": "Malware payload (Mirai)", "value": "15ebe0a5cf68d3136f9dba16b1254929d4397e2307b70ab5b03c71c26f57d6035148f5c38dfd485c2e515585f4c90a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218695, "uuid": "9ca1d612-ece9-4c17-9a86-0ae6b69d94dc", "value": "T1C313F1EBA77FFAF4DD393C790A0C518CFCB1761FE881B76B44E4A02A5D254222825E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218695, "uuid": "cec46cbf-ddc2-4155-8748-fcc2ef354a33", "value": "768:ChIfHyA8J99JgD00/1kx+T+xveN293zzCdOGPmZQAUxbPC0NdoTUBx05s:ChIvyJ7gq+TKv+2lzzuOXQlxbPCOaIAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218695, "uuid": "002fb8c9-fb60-4df5-8f81-953416e8b92c", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218695, "uuid": "b1a2a66b-4559-453d-9305-c90568648337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218695, "uuid": "fb2c219b-5fe8-4154-a6c3-760dee171eba", "value": "johen.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2d2579-ef4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768177759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177759, "uuid": "d0fcb78d-6e5e-4d84-93a8-ac1861d3e329", "comment": "Malware payload (Mirai)", "value": "588bd5986d9f209bcb073862d866bbb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177759, "uuid": "a8afb323-1944-4e36-b1c6-53695713ddf0", "comment": "Malware payload (Mirai)", "value": "76ee1fad854d61de1e8855aacb162789ce0cc3f9a095aa2e3b6c61abb3e26358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177759, "uuid": "6859c722-dad2-47a5-be2d-5aed55a61b14", "comment": "Malware payload (Mirai)", "value": "559988d67a9b19085b917c01eae4c13b981834e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177759, "uuid": "8a73fe4f-b6e6-4b9d-b731-f7afa881a0d4", "comment": "Malware payload (Mirai)", "value": "0c458e1e1c3a69f4effe44e14d4b9a661cc6ba5e1b655017f008edb5c09d03d9f2d6d979b3e295fade80cbdfaadb54f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177759, "uuid": "01aecd82-f009-476b-8701-33b416c8f355", "value": "T197934A21ED756D27C5C4313B51E34630F4B6539A29BC9A1B7EA32D9CEF04710312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177759, "uuid": "0ba79599-3f26-4a24-9165-38d4761ff5d3", "value": "1536:ohPzIHj+4v/6VvGNp6kMwDiY8Ho0QfFWlHa5cct4izA7uhy:w8DSsps0fF1CIzAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768177759, "uuid": "6cafa2e6-3585-4fff-bc48-c764690a80af", "value": 91356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768177759, "uuid": "0f1a314a-f306-426e-bb15-1f2271953ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177759, "uuid": "c13bdd6c-f20f-457a-96c5-f80e415cf257", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9869f916-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181994, "uuid": "129ee318-2c3b-43ba-89a6-4bfe1c43133b", "comment": "Malware payload (Mirai)", "value": "91e9429596b34d9646c50ceb8dba144c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181994, "uuid": "7a3f9df1-787e-4bf4-877b-c24f6ec364ad", "comment": "Malware payload (Mirai)", "value": "76ef4d2fcb2a362c628dc3d0b5d088a6f5baaa63fe16024ea07b25b8c316ff51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181994, "uuid": "c6bc43d7-27a9-4d35-a11f-ff72369ab5e5", "comment": "Malware payload (Mirai)", "value": "a1d770f2fd8bdd13174ef1d46dbf6ea052fbc647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181994, "uuid": "603bca0f-6bf8-4168-9327-d566e4cdd8c6", "comment": "Malware payload (Mirai)", "value": "faffc53960f5a9ee05547424b465841849a20760fe0315ceae75975ae58ff5065d3bca933b92665bbdc797b993c5f018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181994, "uuid": "f8d07a7d-280a-4bd6-951a-6c8e6c466f8d", "value": "T177930BD6BC81CB11C2C156BAFE0E558D33134BB8E3EE72138D149B2E678B8670A3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181994, "uuid": "27ec90bd-7238-49fb-b3a8-d990f9ddae2f", "value": "1536:X9nUFEHSHQ8xy4IeHq3CzWERMFzctNOrn0BRcsAl6zy30hXOVs2o+HbVMLia1fJ2:ScSHQ4K3gWERMgBRcT0911fJ7nPSAbid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181994, "uuid": "17ebf2a7-a93c-4fae-99fe-30dd4b06cd6d", "value": 95436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181994, "uuid": "18ea96e7-783a-4446-a197-f25ad33b6328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181994, "uuid": "f3dc76a8-e917-4df6-93f7-ac7b617e9c32", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb34a4a-f002-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255256, "uuid": "760d2a77-5e10-4b1c-af82-de1c3276a598", "comment": "Malware payload (Mirai)", "value": "b53b9ec96072e5709b406256e4cd1c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255256, "uuid": "da671570-5f97-48fa-a617-65071e6ecac2", "comment": "Malware payload (Mirai)", "value": "771b24ae004fa65a9df902619cca3f898abaae95961f8ea812198ecf8e4a049b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255256, "uuid": "40347571-889c-49a4-8fbc-16c0a8ac4149", "comment": "Malware payload (Mirai)", "value": "45ffef0bb66b7ac59492207c38fb42ef6b0f649f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255256, "uuid": "fe9b25e4-7f13-4c48-a29d-3c6bfcdc88d3", "comment": "Malware payload (Mirai)", "value": "cbe9f0f5890d1fcf1223ae210d43dcb790fa9e0a94e9c80a25b99b25ce5b43562b192cf02868c76952ea4d7dd0642bfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255256, "uuid": "d704d1c7-4ded-4ca0-9180-85e1f0b66465", "value": "T15703F8827D428F03C1D122B6F7AE019C3B11BB7CA1EF3352E9227F91778689B1967651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255256, "uuid": "276d95b2-5f23-4dad-9144-0ad426d7d707", "value": "768:obnltkBjVqNvyZySCGIwOvP5jEGundqNQL2qvbV1HEaM:AnGjDOvjKd4Qbka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255256, "uuid": "adeee976-23d7-45e9-ba27-b6df2c34eccb", "value": 39672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255256, "uuid": "fd9be281-1b7a-4d65-80b7-375a6c2823ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255256, "uuid": "d1c543e6-2f54-4ff1-ac19-8a1500358157", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0a8b41-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179398, "uuid": "3789f0b6-eed8-42b8-8dd4-22eeacb5f8c6", "comment": "Malware payload (Mirai)", "value": "5dc19fa6be79a34059354de16157a7fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179398, "uuid": "1965f984-ab4b-4583-9ea4-224eacda01b3", "comment": "Malware payload (Mirai)", "value": "77ab89345b2496b22529d42f6e81b990b2403313011bcd877bd32f7bc63cd332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179398, "uuid": "925fffae-b62a-4543-b11b-f781eb73c317", "comment": "Malware payload (Mirai)", "value": "644cbfe15fc2c07d77305c3d1fed2874b1e9b92f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179398, "uuid": "545c55a1-8268-4916-a8cb-46a400405437", "comment": "Malware payload (Mirai)", "value": "6c32f457cfa1552c977cc37b7becc25254e88fe26e3dc86b7f95334e6fc0d8b64de910273cd7089c6a72ac17a4f470af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179398, "uuid": "3d4f7e7d-517f-4360-ab5f-e9d71d5cd734", "value": "T1BE44FA5DF880977ACBD0217EFA9602CD33334F64EBDE320589356B3837D6A25993A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179398, "uuid": "c3ab81bb-c56b-4779-a3c7-4702613dd4e1", "value": "6144:XHCtbMr0sDtsjd58YOjK/wV+TFkVTGe1IgIVajYqJw4uB3wnhl3t9co3nOsjSAxb:SRMyFkVTGe1Bw5ul9bOsfxd0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179398, "uuid": "a616edb4-0179-4b6f-afba-1cae703748fa", "value": 262012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179398, "uuid": "364470c7-2598-4f73-a401-0580bf822264", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179398, "uuid": "eac17619-6666-4b05-beae-cd3464ee400b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c6378c-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218703, "uuid": "55781b25-04b5-4b24-9bbd-8359627cef6f", "comment": "Malware payload (Mirai)", "value": "79598560e2e407cde7ce163f2d14071e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218703, "uuid": "43aee979-ab2d-4449-8470-e6cf71abef81", "comment": "Malware payload (Mirai)", "value": "77cb54840a32f1361a7007f821183a9d90fcbb992471b812f3fff477872bcfad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218703, "uuid": "220c421b-6f5c-4b52-b5f7-dd94e06e4fbd", "comment": "Malware payload (Mirai)", "value": "6e2f70c8e097bca7ce6b3b4d5a7f1ee45a25a467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218703, "uuid": "2dd21373-fe15-4ad6-bbd7-9df77abbe5a5", "comment": "Malware payload (Mirai)", "value": "e73be99e5885bea37bb7d08831fc361e1871f8c4fefead61eabf947923b46300876ac8ce486a5e6473bee803734aa4e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218703, "uuid": "67a10705-fc2e-4691-8e2c-f5f79da01fba", "value": "T1B213F1DE708C125BCB7EDD39644842258DA3A9F2025BA60EAB00064C9BB43D7BD6C1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218703, "uuid": "2980e64b-5620-4a85-91eb-bf2a1bdb8137", "value": "768:rInJXx/OohmsD7bh/xerAfORlUR+aZs3fA+nEWd3j53qUJyWEcn7/Z4OHSWP:rIjOqvbhgAGERxZAfvEWdTwUJyWEcPHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218703, "uuid": "519ea30f-2e69-4722-b344-eabc1151eaa8", "value": 44600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218703, "uuid": "bbf772b0-4133-49f2-a6ec-0447ada8461f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218703, "uuid": "e6e25bfe-e674-4113-ad87-3cbacf9fc8a0", "value": "johen.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881c5a4c-efd1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234365, "uuid": "61a0a20f-8555-49be-b19e-5244f70a715e", "comment": "Malware payload (Mirai)", "value": "8b9f7e93d88ec181e6d9600f3ad2eea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234365, "uuid": "0d259192-cf49-43b6-aa7f-ca277421ffb4", "comment": "Malware payload (Mirai)", "value": "7812671ec90266c18a29aa1c135d4c5f809aa8bab64efdf657e30df64eec149c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234365, "uuid": "6c9b2ccd-bbf1-4675-abc1-64a22087df05", "comment": "Malware payload (Mirai)", "value": "d5414253da1e2ca18bfda7a77c87b325e2e100e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234365, "uuid": "0557edeb-f01e-4614-a732-a9125b2faf87", "comment": "Malware payload (Mirai)", "value": "c332e3103a8bbe1289c912253eedb2d292af498908cd8eb5a541073193f63b62ffe2d9ec2fe20e52113dfd8f9e2cb11f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234365, "uuid": "0f751e17-bc46-4240-b412-55eb878295b8", "value": "T15623E9A2FC4289ABC2D402B6766E6B89375257F6D2CBF353F52407A03A4650F4D32F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234365, "uuid": "e6dfad88-fb3f-4a55-908f-b5dcf1353f1e", "value": "768:pMfgoWdQF0a0SaiBn7KlBA6nQhyeSwzwO8nttsjYOWm8qvsa4zTAo2IymQY2AUmA:pMfgoWdQLn3W6y9NnttUnWm8qvsf2Iyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234365, "uuid": "013072b5-44be-4281-954b-ac71ee1807af", "value": 46512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234365, "uuid": "e1401aff-ad46-4229-8498-fdd69d5362f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234365, "uuid": "5843178f-6999-44d3-ab75-668a50545e02", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755af44f-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216725, "uuid": "9b269f6a-63cb-4a3d-a344-4f591f7abe6b", "comment": "Malware payload (Gafgyt)", "value": "20e2b7fac65ed394e60b8d56805205e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216725, "uuid": "0f50bf70-b500-44b2-82fb-0d42a4f62404", "comment": "Malware payload (Gafgyt)", "value": "78daddb177fcbed8d06d899a70935c690a312a170ae1fa52756d4bb02d1f7db0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216725, "uuid": "e2ebad6c-f73d-4350-a830-5b95a0fa73f0", "comment": "Malware payload (Gafgyt)", "value": "39f8fc206a1ab6f98e294e1d68363ec7f28057c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216725, "uuid": "ccf6369f-b68b-454b-a31c-f001991e569e", "comment": "Malware payload (Gafgyt)", "value": "83b4609e5dbf11e2f58649a989d5387350a4f16f8c4876d0d12b20a25c0b40bf62f7d66958ef40729efbdeb4fbbe918a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216725, "uuid": "2ca01ab1-d4e1-4756-b51d-40df05e109f8", "value": "T1EBC32905E8918767C2E217BAB79A425D33332B6893CB33255938AFF41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216725, "uuid": "3c36c874-1e3b-4e8f-90e9-ede9d7092601", "value": "3072:KdB2qwap6KVXPi4jv8x+jMDkmDhZmTQOIsXAqE:aRwap6Kt6+jMDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216725, "uuid": "2d2e000d-3b2e-4268-92a6-e0ed0adf993f", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216725, "uuid": "b4b07ca8-a7e2-42f3-9e56-3aeb48b7e78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216725, "uuid": "0888276c-2ce7-45ab-8126-3ddd41bc5b4f", "value": "a-r.m-6.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac86002-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1768206130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206130, "uuid": "f24d76ae-ae16-4bf8-94dc-6ece77a1cca8", "comment": "Malware payload (XWorm)", "value": "089edbced446bd801d4abf83b95776c6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206130, "uuid": "1c6c063b-0dff-4365-a077-110d9b804c0f", "comment": "Malware payload (XWorm)", "value": "78e42dc2fe1d89f120a7c41dc184bf8e5fe6fba98b21eeb08fe4e1be8143b3e2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206130, "uuid": "c62f315f-b55f-4614-baf1-67323e6c99d9", "comment": "Malware payload (XWorm)", "value": "5884b5d56400fbd2fb0bdbfc5d1d9539a82b44b5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206130, "uuid": "bc17ac22-6e10-4da0-8235-6d3884276f51", "comment": "Malware payload (XWorm)", "value": "acb64cf67501a548112e99d1c447e648fe2aa9e534c4bf0e75094d5b158d48cd468b933087bbb453d74fe19389010bd7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206130, "uuid": "5f8bf0e5-226f-40a8-b728-39aec4b59076", "value": "T1F754DDF33586B5D0CDAEE65F865F8768732E2282FB534189035F0E448B2794E7BC458A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206130, "uuid": "95302492-419a-450a-b9de-3f237f9a27af", "value": "6144:Tk+jWcXACUrZZb4uuqQ7BXuPx68vBz6eFyJIC8g85AbCEhyJg7FMSYwPTSP5saz0:Tpj/XCZZb4ZqQEx6aBzBSfBMSrTSP5sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206130, "uuid": "01006b76-6d01-44e4-a764-dc55f77b6d85", "value": 288876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206130, "uuid": "cc2bafb2-eba8-4229-a20b-93284918cee9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206130, "uuid": "7637b0c8-e883-4da9-bd6f-c6ee6779e772", "value": "Request for Quote ENQ-RESB-PMB-PROD060-1069-26.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ea31bd-ef5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184483, "uuid": "4f884b42-a917-44b4-b6fd-c9efc5e8021b", "comment": "Malware payload (Mirai)", "value": "b59878ef1fec79685977a0feb2e3120f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184483, "uuid": "c4e9f41e-1ca9-41e6-a674-cc1dd5d81619", "comment": "Malware payload (Mirai)", "value": "794554999262b9fe9ac6b5d955a9d3b9971632213805e3b65c1c1338305ac10e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184483, "uuid": "21a016dc-3bf4-4f97-b632-32e235956013", "comment": "Malware payload (Mirai)", "value": "405ed3ee1aa95e9cf45990aae8bebec242a0516a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184483, "uuid": "d34de5c0-f689-4d7b-801a-cb096d9dd907", "comment": "Malware payload (Mirai)", "value": "82175ed95e5e71534139f865996afdf0d964bfe9d850dc77e4c22bc288bbae5dbb8c42ff8fbd2dd1396a2fcd35d38388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184483, "uuid": "4b60d918-5dda-4ece-84bd-6acb5bcaed46", "value": "T1B9D3120F637A36D5E639FEBA8E07151571111CEEEA909049FE0EBAD70C4914AA90CBF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184483, "uuid": "41c9142d-2da1-40d6-a77e-3796fa6eb779", "value": "3072:df12jydr197wAqGIMeIS2bk/gBfoLeHaX:pHcA2MeIBkoBfBHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184483, "uuid": "bc04696e-6b60-4980-944d-10c2345a76ff", "value": 134172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184483, "uuid": "c63cabf5-bb69-405c-86b8-0babce342f10", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184483, "uuid": "55cfec2e-78c5-4cac-a9e5-e2ed860b0481", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f25ace4-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226485, "uuid": "a28ee9b4-e029-4fcb-a393-9bbacd751684", "comment": "Malware payload (Mirai)", "value": "907d700358cc55502d1054f42a3689fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226485, "uuid": "c79aa137-04c5-4a97-b534-54613d88339a", "comment": "Malware payload (Mirai)", "value": "79501cc73b6c589076028148fc2339affd9e417e8559064705610cc98372e818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226485, "uuid": "5b9273b1-e66f-4d71-b42a-a6fb570c9bcb", "comment": "Malware payload (Mirai)", "value": "f01ab6630f5c5e8423fe846fbcc46a7b8fa1b582", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226485, "uuid": "2e495d5b-4a52-4413-9f82-b43887b832f1", "comment": "Malware payload (Mirai)", "value": "f0f9c83f1a7be52bb546d453684aa9da3723bfc83656e4512d4074f270ed7fccbfdca20134b3cc6296b05edb607e9c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226485, "uuid": "8e44bfd3-8cac-48c4-87b5-139c792e6f61", "value": "T15FD36C53B70E0A43E39A19F0663B23CB93DDD9D131F1EA882609BA4942B5E775085FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226485, "uuid": "aa44b55b-fb53-463b-b975-e03af78fae71", "value": "1536:on0GrYhLNUuz1QjrF+gYDEEFz7UX4MSQxqqbasy5ltDDBZYQhzsR5Wrglz8:uD4UOad+gBCoPjNy5PDlqarKz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226485, "uuid": "ed0f6f64-b5a1-4a98-9942-e7456af6268f", "value": 131144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226485, "uuid": "93576831-cee2-443e-848f-3094e45263a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226485, "uuid": "f4b9346f-daf2-4a0c-ac23-d15d8853aeff", "value": "rondo.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4973f2-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179102, "uuid": "a499119d-cb69-49aa-aec0-d8a998e44cc6", "comment": "Malware payload (Mirai)", "value": "127fe145994f7b075e91b0466acff65d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179102, "uuid": "c4fe501c-f0b4-4fee-9288-e7ae822cc8d6", "comment": "Malware payload (Mirai)", "value": "7a487a7b997d2d7cc0a4b4c91dd432590dbb82916d580f033dabd03c35807d1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179102, "uuid": "e30fd6a3-8a18-46d8-a03a-47596906d42b", "comment": "Malware payload (Mirai)", "value": "47ffa733f2fc62daffe3be850c6091aa1f90fef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179102, "uuid": "8f1736ab-ce66-484c-af58-c456137d531a", "comment": "Malware payload (Mirai)", "value": "db6481c10b9f45a5ad41935fcdab01056db094b268ae3f2aae8784ca2ca0d776603dece21f8f236c2eac59a9dc5f4add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179102, "uuid": "ba0bbe4f-7be6-4ad2-8d03-3836c869217e", "value": "T15773E70AAFB11EBBE4BBDD3305A5074938AD650B21B57B397674D81CF21B18B46D3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179102, "uuid": "4aa928b6-18b0-4f15-a8e7-d5c0ec4c2f96", "value": "1536:SyG8Lvu6v42QrMZe70mfvVYC7xNdMcX+vMHpO9lrAB1MIY+Uj6UQM0RNh0B5datw:Sf8Dv42skE90v+PYAT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179102, "uuid": "5a97cbea-13fb-41ae-9527-823c84e340ea", "value": 80468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179102, "uuid": "aad7dfc2-cf7b-4fc2-8917-bff9e786fca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179102, "uuid": "ba6541ff-cf50-4671-b5e8-38e0d9664194", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29afe6b-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231001, "uuid": "5158e42a-ec2a-4887-a0ab-c7d5a87df26e", "comment": "Malware payload", "value": "9b435c106c8d81adee4ed715868ab110", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231001, "uuid": "0bcb16a7-c2b7-4634-bdc3-723792e1419e", "comment": "Malware payload", "value": "7a69bd478983b6fa07abf5ba24da50fb22f7e953a3fa33020dbdf8cf617d962e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231001, "uuid": "eab616f2-5f85-447c-97da-b216048575b0", "comment": "Malware payload", "value": "72ca45fa35c77d93f9d371464f33e3d4d4f31c19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231001, "uuid": "9efe3e0c-8e56-46c8-8ae9-bcad32ff7f7b", "comment": "Malware payload", "value": "4b1292c3e1174187b951b4b5bb5fe0f65ee8a918289d447aef3601f82b93bb9e9ff8ccb03ff75caa3776b8662d2ffd4d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231001, "uuid": "006371aa-00db-4fbd-b925-fb977d9354e3", "value": "T1895533732F917C8FE7D795A1F3CE12287C6C2FAACEEF9020557492C600644A552B99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231001, "uuid": "1a9944b0-a6a4-404c-9c0b-6fd6cb79d28d", "value": "24576:i6zDiVkgEq9zRhop3FN8LLP3I1sO7+I1FCD9ih4tp6/o4DtceqKlhd8FWV31N:i6XiCgEq9zRhoJALfI1sO725u4z6tDxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231001, "uuid": "5aaa0305-ff7b-4fd6-a683-902cda68c3ee", "value": 1292803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231001, "uuid": "e9bc7180-292d-4677-9e84-b20ef1bacd93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231001, "uuid": "b6882fbb-787a-42b6-9143-8bff5987f6f2", "value": "Archivo_513.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84254965-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1768223192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223192, "uuid": "65a04d59-72bc-48f9-bc7a-8eed6e179038", "comment": "Malware payload (SVCStealer)", "value": "4e777659c4be3ce806292f7cd42f419e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223192, "uuid": "1bf7c644-9422-4c9f-a5ef-e1296a3b0e7d", "comment": "Malware payload (SVCStealer)", "value": "7aa1476644721e9879a2c6397bf76a2b441de943f1a766dab09a2d3d9bceb698", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223192, "uuid": "0ac6883b-bd55-4368-9e4f-4c4f1f70ecd5", "comment": "Malware payload (SVCStealer)", "value": "6b40b9e1100537a1e8f4f34158978c1c4987f3a3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223192, "uuid": "7b0ac5b2-a990-49d8-af5d-b85e505aaa38", "comment": "Malware payload (SVCStealer)", "value": "14c2b265f705937cccca56ff75aee0633572a0b3fa1d76f74476f11c909eab2c5cff455eef286e237e42ff7a26b05c6f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gfdhgcxww", "colour": "#DF88D1", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223192, "uuid": "e552f386-0d0b-4303-a982-c850ac8caa2e", "value": "T199759E55B2B400FCD167C178C9475A0BEBB278061770EADF57908A6A6F23FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223192, "uuid": "5b4b7b4d-cf15-43ab-9299-5b9d617ba60b", "value": "14c00cd98c6c67089f15befbbc9b5dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223192, "uuid": "5350644c-c32e-42fb-9943-fc7668f64ef7", "value": "24576:i02+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqxOqrXtd0RlgbCpS:wQ8FDjWJAfPVHCpheENndH5r03gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223192, "uuid": "461068fd-6483-4038-9a90-f5f7108b4901", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223192, "uuid": "18ea14b0-7f5f-4d5d-930a-fbaf0caa82ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223192, "uuid": "bbfd3b67-579d-457d-96db-f4b70be89f49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100a04bd-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218702, "uuid": "b2a7b660-a7d2-4712-9eca-81cdc37d7e1f", "comment": "Malware payload (Mirai)", "value": "436cc9122964c5d51168ad09f496391b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218702, "uuid": "ade01964-0bed-452c-afc5-066bbc080478", "comment": "Malware payload (Mirai)", "value": "7b14ac75bcacfe95ade13a12038b6264418f30b70a680c7ee624b71aff292adf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218702, "uuid": "042d9900-d96f-4269-b046-36a6d623c7dd", "comment": "Malware payload (Mirai)", "value": "702812fccd7726d762c7553e39cf21d206bb499d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218702, "uuid": "cabaec14-e1b4-4fe6-9412-b0feb13e8458", "comment": "Malware payload (Mirai)", "value": "b341b2bbcffcda02d4697e1d0a47b1e2a0fe69e379ddb4900b7ef8f14d11ec47798818fc0c29ce3c9266b3c975097535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218702, "uuid": "f8ce6314-6041-4497-9ac9-f7bef8752ba3", "value": "T15413F1A261326C50E1F269F8FCFCCA81D5179B74C85EACEB5524C61DBBCB48916C06C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218702, "uuid": "48cfe8d9-5da2-445b-a24b-e0eff3a19ab4", "value": "768:Y4GEt/uZTK+QsAAVfnXQwkVjs6ucZywynO0fH3qTeu9q3UEL8+:YLExM59Ks6D0nO0/3hL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218702, "uuid": "e8c06b5c-8581-4a75-9b0b-da4f8783c23b", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218702, "uuid": "358c724c-4161-4f23-b28b-c2c6ac5d4913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218702, "uuid": "97a6dbde-63c1-42d3-96b7-05ad0b3872e0", "value": "johen.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733286ea-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216721, "uuid": "d2a160f9-0fc2-47c7-8744-9a3898b1f9c0", "comment": "Malware payload (Gafgyt)", "value": "928fae2b76b79f0cc056666677b6d8ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216721, "uuid": "a30b4d38-563c-4af0-a8f9-89c4a0cfe5c0", "comment": "Malware payload (Gafgyt)", "value": "7b541360a623d5f8897b171c585caba9e381655ceb2a48b19e3d6fbef9d2203e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216721, "uuid": "70c52b77-d23e-4e80-83a6-f0c98e08e00f", "comment": "Malware payload (Gafgyt)", "value": "027f95ebffcfe5b2981328feb5c20caf606bb334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216721, "uuid": "f02b8ac9-5f24-47c2-8520-5cd343da90a1", "comment": "Malware payload (Gafgyt)", "value": "96420c7f0101b7b646eec7ef62e546c617a9b808dc946a19e9c6be97ac96b6d26ac49f1f513c43043b02caba82e67adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216721, "uuid": "adfa9ac7-d5d3-4c6c-b552-83ce3ce0f788", "value": "T16EB32A17CBA6D07AC48B13B11BDF86269963F4BD0772312F23846FA05F05DA99F5A342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216721, "uuid": "3e235ab7-1bc8-4ad2-8aad-d30855b0137a", "value": "3072:I1Us+1yGIqOYzx4EX0/9gKwlKhzVrm0mlTcyH7od:5r4/WkmlTc47od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216721, "uuid": "21adda7c-9324-41fe-96b8-d5fdb32e6b72", "value": 115519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216721, "uuid": "62131d04-989c-48fe-8933-94ca7dd53df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216721, "uuid": "0e5de2b0-e880-4cf5-a8cb-27eeff33fd3f", "value": "x-8.6-.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7b9bdc-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179369, "uuid": "21efff06-3865-4a3f-b505-16ee2b81830a", "comment": "Malware payload (Mirai)", "value": "3523b091c8742611c9d51cf1ff6c7af9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179369, "uuid": "c677ce3a-3d96-45cf-9564-009e155697d4", "comment": "Malware payload (Mirai)", "value": "7ca7fbe4318ecd58ef896a4f799e97f61f0812097e668f38e55313feaf90d0a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179369, "uuid": "afd7b511-5309-4376-826f-8874cd118da9", "comment": "Malware payload (Mirai)", "value": "b2f3fb4c8ba350f46efac610d147f0e0a7ced6ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179369, "uuid": "9a8b2679-1590-406e-a4c9-2fe06c115d0e", "comment": "Malware payload (Mirai)", "value": "74c700ce0846200435b5979a1abe3e573ce284f96c282aa2c5b4beb46c2c9d8478f083e5ed13e2bf0588c527fbffdf22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179369, "uuid": "e71fcad8-a9ff-45f1-914a-c222762a5e3f", "value": "T1209302B11B2D5E78F2C6A5B1E13E53C6FA0A744D636C364FB43E894B6583913F100E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179369, "uuid": "2ef57d5d-04a4-472e-b846-4e789c836190", "value": "1536:mYpJ43RkG8Xdww+hIK8oxlyCo+bu/HXNN/qpBZcHQjSdbzgoKnsvbD:TIkaw+hBlyCo+bu/3juBaEIzDKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179369, "uuid": "aba1bfb8-7a06-4069-8ab3-a0dc45b52afa", "value": 90076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179369, "uuid": "d8e6d06b-ccf2-47e6-a9e2-19107e608d58", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179369, "uuid": "4df4bee7-aa41-4741-aac0-fcc9ee7b132f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d95cc2d-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179372, "uuid": "f4fdf253-1816-41be-86fd-9a4673a9adce", "comment": "Malware payload (Mirai)", "value": "b1d822d3e604e38e75002bec019f1665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179372, "uuid": "3a7a3a62-13c0-4bc1-871e-3ac94b98ac80", "comment": "Malware payload (Mirai)", "value": "7cd6b68f8d8195456893a34ce702077d1dd36b107c165bf35735503db2d31602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179372, "uuid": "336a6070-27a7-4fa6-91e6-18d6c7889483", "comment": "Malware payload (Mirai)", "value": "86655de160652e6988157e4d4f673cc4bb19587b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179372, "uuid": "056d23c8-936c-452b-bcea-340ee3b83657", "comment": "Malware payload (Mirai)", "value": "0b1734d927f663f82488499a4eec10adf8b81a2a8f6f82753d4b34ad0055cbc2972071b9023eecad4d56d3de692828c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179372, "uuid": "ba6fb6be-5ff5-47fc-ab8d-67fa971792e7", "value": "T10AB3180ABFB11EFBD4AFDD3345B90749299C460621B97B7A3674D818F24A28F46D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179372, "uuid": "742b7cfe-a4d6-40da-81db-5238efbe652d", "value": "1536:ApGIQ6S7FuCxXnIqZK30GzvxYCXDNRMcXivEHFG90rqj1MIY+Uj6UQM0RNQJsLp1:ApGf6fCxXIMVOJynx/YWNoBT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179372, "uuid": "3f8a2b84-1f5a-45f7-9448-0832d43cffde", "value": 117800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179372, "uuid": "374869be-0178-4da1-8622-01531de1dfdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179372, "uuid": "97d1286e-e046-443c-acf3-f34c30deaa7f", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c0aabb-efc5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229369, "uuid": "dd2d77da-e594-4915-8cf9-23b836249697", "comment": "Malware payload (Mirai)", "value": "127f098a109e6a6e1c22307f1d6b0cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229369, "uuid": "6595e84f-2dd5-4fda-a881-fcd331193d61", "comment": "Malware payload (Mirai)", "value": "7d4d02fd723ea1d015597d81b9ccf134916125ffc0af929174d7dc7fcc27b3ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229369, "uuid": "954f39fd-6710-40d7-ba25-43f0c800b9f3", "comment": "Malware payload (Mirai)", "value": "aca6ade83614f1d94ddd47bd127df5199135a3c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229369, "uuid": "476372ef-9a68-4759-a339-c423936a10b1", "comment": "Malware payload (Mirai)", "value": "3de24eeb48743468dc42c8c43bcd6fc43a6233e7809a040ed0e8b5a7de7b2dc45dd642694ec5d1861491dd48da491199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229369, "uuid": "225d0056-ca69-4915-8ae0-2a8a3c905971", "value": "T1F5A30225B742C41FF105C0FB798911A0EB2ABBA5AF4B21674C00DDE65CC79F4A21BD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229369, "uuid": "0f2c1dac-22a1-4557-97d7-6cdfd111c86b", "value": "1536:Xfk2JNDu7fTedhXdhwVMFvCKuRi/6MMNIheMpyrbosl+DkgzYhY3gdSwXO1cuDk9:1u7fQikuRiSRu1pyuYag3XlWk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229369, "uuid": "e9e12b0e-89d3-4a35-9600-5999c062f517", "value": 100644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229369, "uuid": "f1c1119a-24f5-4dbf-bdcc-a5d0bf82241f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229369, "uuid": "18d761b3-ae4b-4301-96f2-05f185c6d802", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa95d22-efb8-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768223506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223506, "uuid": "796cb1a9-10bb-4c3c-90ba-69d397debf2d", "comment": "Malware payload (RemcosRAT)", "value": "8f0afc92c1eec88fcac37b35a7903f0e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223506, "uuid": "0a402982-62f6-4ac7-86a9-24b29b6d8559", "comment": "Malware payload (RemcosRAT)", "value": "7d6869b3df6ceec58b0d1b58c9734e46869104b3bc16fe117effc07ee5c07b5c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223506, "uuid": "fd6c5c5c-7b22-4ce1-b12b-79ff00cc73b5", "comment": "Malware payload (RemcosRAT)", "value": "2481f4b896b17a7d018d1125f9d1cc67d05563f8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223506, "uuid": "051a9cb8-8623-442b-ba60-095c3fdebf21", "comment": "Malware payload (RemcosRAT)", "value": "7166556b6ec0c867cccdc280596ff5a471fdcec56e91eeaa455c9071123c784306dd26f7ca8953a9c355f3bce34806dd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223506, "uuid": "ae02c0b7-11c2-418d-b3db-f53dd7551dca", "value": "T1867733C89043FA1DE53161378EE2686C626611B7D0860677A17FB4DB0FBBC7D19BA039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223506, "uuid": "9b065bd0-9b52-4edc-8968-2f8bcb666d9c", "value": "786432:qiqroT5gIMADMtRVNohNth71fYvSkzhZly/z02lJ3W:z5MAeWjth71GhZA/zpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223506, "uuid": "d0dd7a26-f8fb-451e-861f-2bf93f408743", "value": 32731363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223506, "uuid": "7d15639e-a534-4a52-b2cc-680a19ea9989", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223506, "uuid": "917e5608-b47f-4d1b-95f6-589f6b558fdf", "value": "caching", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aa3be9-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180773, "uuid": "fe72ca1c-512c-44d2-b0e7-c0f489d02f9d", "comment": "Malware payload (Mirai)", "value": "54e35be655ba1f7915a24afc1de46e24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180773, "uuid": "39e79530-4696-42bf-afba-17ed360a6a2c", "comment": "Malware payload (Mirai)", "value": "7e5065ad29c77420c0af71a4a458b93287bfb0e7cb653d2aedd6d9dfa4a5e137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180773, "uuid": "229222d6-2044-42e5-a918-0a6b5ba08519", "comment": "Malware payload (Mirai)", "value": "2008372c1bf0575998535cc51c3480aa0d6ad128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180773, "uuid": "f78ed613-5b81-4ba5-8236-8830919f1cc6", "comment": "Malware payload (Mirai)", "value": "509c7f725e47735087ee46ab50317335b2babcdfef5c405655de303261134e5a693955cd656bdccd74f5475ecd5c6ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180773, "uuid": "2c6ec865-07e4-46e7-8ef6-b59f002db188", "value": "T1E9834AC18683E8F6E8080179A176F337A6B2ED750178FEE3F75496722411EE1B14A34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180773, "uuid": "7b8b928a-e200-4143-9954-ec884403f387", "value": "1536:zU1laMHKOtSkYITINf4+SJjg2WOzaZBRjq0jPcELAeRUYsnbz1dHViHb4I8P85Xg:zUT1HKOtVHU52jiOzaZBd1LAdnn1xE75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180773, "uuid": "daaa55d1-3831-4a4c-ab50-912a9e894495", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180773, "uuid": "4cbd92a7-3ab6-4f90-b04a-9891a7840021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180773, "uuid": "05c6c99e-fda2-4ab9-ba1c-32a6553e3835", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb97e1e-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214568, "uuid": "18298ec8-73cc-47ee-982e-b8bed6a18881", "comment": "Malware payload (Mirai)", "value": "7cd9d7d10cebc686f766c1cacf72490e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214568, "uuid": "2751b04d-3eb2-4ff3-a51f-491c207c1265", "comment": "Malware payload (Mirai)", "value": "7e7ab42ef473ce71e161dc0e303fba6e5d884df70cadee380449dfa9ca588c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214568, "uuid": "d5f40892-d209-4b27-9256-575b46f10b2f", "comment": "Malware payload (Mirai)", "value": "721fde4da4c432f77f2f32e88e08bc2977d4f35a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214568, "uuid": "8224d622-0d20-4fd8-a99b-784cd12f4d16", "comment": "Malware payload (Mirai)", "value": "2ec8f4ff79298586cc93bc4a23c4f0f0018b6258c35cda1e8a6c35ab7b938039ee9d9aee660f32eedbfa4c88ca2349a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214568, "uuid": "46e2cba0-49d4-4700-bc7c-3cc9785d983b", "value": "T1CAA3B65E6A674FBDF7AC863647B7DE10C248339223E1E145E0ACE9019E7034A785F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214568, "uuid": "c6f4675d-940e-40c4-a187-a67e8e9307b0", "value": "3072:aIvdQRNAMpHBl9cDAnV88htUmEqtCzfHR:aIvd0AMBBleDWV8FqtoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214568, "uuid": "98eae63d-19f5-4171-bd0d-d1717755e0f7", "value": 100320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214568, "uuid": "f10dfdba-3d01-4b0b-82c3-5d05f9e83608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214568, "uuid": "2a5ab6b8-a2fd-4255-8796-f9aea0dceef7", "value": "shadow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761eee75-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216726, "uuid": "21682708-c62b-4c34-96f7-4b923b590019", "comment": "Malware payload (Gafgyt)", "value": "3708c609faa058f6599fdb3ab296bc21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216726, "uuid": "cb5e4c38-3a29-4ef4-a940-efa2e07f7a1e", "comment": "Malware payload (Gafgyt)", "value": "7e9296cee4339badfbecc4d338a51cd08b24c0ddfaac54433595da973cd506d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216726, "uuid": "364dfa83-3243-4ce8-b526-7cd8e61a6a4f", "comment": "Malware payload (Gafgyt)", "value": "058fc41b34bb02992ef4a3bba5ab9704f0c6968e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216726, "uuid": "d05dfc4d-3130-41c8-b8be-4356fd0aabb8", "comment": "Malware payload (Gafgyt)", "value": "a5c29a1197b181bdcea9c003465eac558a7aefe669ff52099f475181bddffc8309c471e3f8ecd1e57ae2977f739297f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216726, "uuid": "4a8fd16f-1d70-46ec-b49a-799520d3aecf", "value": "T146B30A13532D0A83C8DB9A702DA72BF2879DBDB112A36141990FFF8453739B81167F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216726, "uuid": "4793a4c3-da31-490e-9083-e77d24bd7788", "value": "1536:aE12l+uDTKcmQem9adzv+P32B7nvXnIAqrJPtSomSgT/hQgKE:aA2ZDpmjGOhnvYtPtSom3T/ugKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216726, "uuid": "7df90ad8-5b2b-4912-b029-8a4b0d608938", "value": 111623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216726, "uuid": "56048f72-aca7-4d8a-af3e-c8e4d5c8eea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216726, "uuid": "16e0de1a-4b31-4760-81b0-073adc5c161b", "value": "a-r.m-7.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd6e167-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226486, "uuid": "6ccb76b4-6012-4e64-a5f1-a36eb32412c0", "comment": "Malware payload (Mirai)", "value": "fe3138f3bbc109f97801db46f6bd85b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226486, "uuid": "6241c2fd-ae4c-4ce0-86c9-094cde5b5529", "comment": "Malware payload (Mirai)", "value": "7f040bb3dd201f20047b786d3e4763045a4b36ee4177d53450a5610b21c00e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226486, "uuid": "896f8186-1139-4d8a-8300-dbdf4dede974", "comment": "Malware payload (Mirai)", "value": "31f71a1f04fa57801f8e90f188997f87c243b029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226486, "uuid": "df661474-5faf-476b-92ea-178fdda5bfad", "comment": "Malware payload (Mirai)", "value": "91cae0bc38a447ae1a2bc436b3b3b6226953229be1f893afbf2718c5f52e2d50113e15edf37d10c3a1c06d4381951108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226486, "uuid": "42316584-ccf2-4ad2-9432-ad54918de209", "value": "T18D73C60ABBB05EFBD85FDD3745AD4B4525CD860322A83B7A3574D428F24A18F4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226486, "uuid": "148502a6-10b2-4194-9503-63eb27b56a74", "value": "1536:jQLivf59P8TxZegcOIV8g6ttM2LIkBAcuTNaT2bVR:jpvhagAOcTT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226486, "uuid": "28f7b95f-6c58-4d5b-9be0-e10471181e3f", "value": 80684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226486, "uuid": "64486e2e-6b52-4ede-b8e1-1b8fb5398c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226486, "uuid": "5b6a6d2d-a077-4821-b940-39af346c8244", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bac656-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768212033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212033, "uuid": "b04a6b52-27d8-45d7-8e41-cd063f8f7e23", "comment": "Malware payload (Gafgyt)", "value": "2763139e2e578a0bea03a1163d2cdf2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212033, "uuid": "c2f60bb5-4364-4c6a-b604-b17bf66287cb", "comment": "Malware payload (Gafgyt)", "value": "7f044f231a82b4cd7477dfb309c84e8738abb75c51d8e8511033a4978505c01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212033, "uuid": "d28b4173-13a5-455d-b25d-4e5b65f301ea", "comment": "Malware payload (Gafgyt)", "value": "d0a7b9b614e156db5400dfbb7a595a8ece061394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212033, "uuid": "408ab311-0039-4362-8bbf-8c7264a3dda0", "comment": "Malware payload (Gafgyt)", "value": "3aae047b6fe37e8cc37444985e84f1c93a5945e33b03a8033298e85f3a8bdf3eb29f053f8b2aa351d4611de2f56ff258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212033, "uuid": "5ebc37a5-74e7-4da4-86e1-4206ef442605", "value": "T1A9F55B16D2010676DD957473C8AE49192BFB6267338353236B1D693839C32EDAF8E7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212033, "uuid": "4449df2b-ca06-4307-87fc-16ec91a403b9", "value": "24576:SZ8WzzcEVs8XXCfJytYUtK+L5gO8JhECE9mfnfQfoHb7f22aCL7KsAoAbzTYz23L:SZ1hVsSj2a1pnQEZoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212033, "uuid": "5872ed4d-8871-496b-a8d8-90c7ec2c9923", "value": 3645896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212033, "uuid": "5fd6706c-0d10-463d-9187-22a03e6863f9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212033, "uuid": "ff29a7e8-82a3-4201-9c76-29c6cad39cb8", "value": "client.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf24cc6-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231474, "uuid": "30cf9123-4130-4977-b78a-37298c82524e", "comment": "Malware payload", "value": "ff180f2b1e86f5dfacedbbfc9e679274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231474, "uuid": "f86b4ba2-fb34-469b-80c9-69ba666137a5", "comment": "Malware payload", "value": "7f2cf3a853b2e5abc5caa56fb503d726596cbb2fac680587b835e5e494d7f84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231474, "uuid": "97e7756a-6de0-489b-a93f-875e85828eef", "comment": "Malware payload", "value": "8b99aed424ddb0f9524fa8fe2c17f4d8197a28c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231474, "uuid": "16f75882-31b5-4842-9976-b907f6d0a9a4", "comment": "Malware payload", "value": "3bd9dea4ab0d9a3a8f5e6ea57fc4525cfb73ab157d45ab0f09129fc67dd5e32ceb68e83b305db68c2f5b67a047694c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231474, "uuid": "1dabdf75-d5d7-45e6-b96e-7fa20285348d", "value": "T1FDB1651196119864E8D161FAD3FB8AB9707C4711235C11CBA2BC29CA6330ADBFFB7D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231474, "uuid": "0102cd81-d785-4398-aa74-fcf25c6faf7e", "value": "96:LQ3tLwpF2/2A4Yn92wgmeB6qaXROuD2RgREw:L7o92wDIumgREw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231474, "uuid": "2fc81bd8-d537-4e4d-81e7-001ce828cdca", "value": 5174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231474, "uuid": "47d99229-ded3-4bf6-b24c-ffd2ce4638f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231474, "uuid": "c51bafde-7723-4c5a-8d00-d717b42b4755", "value": "ff180f2b1e86f5dfacedbbfc9e679274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a747935d-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216808, "uuid": "72e31f5c-e859-4e7d-8f9f-cd57c569f353", "comment": "Malware payload (Mirai)", "value": "14f57a50532fab5d09010c5d205d8b17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216808, "uuid": "c8a03079-b71d-4e41-b0f5-0392abaf3cd8", "comment": "Malware payload (Mirai)", "value": "7f9919bb5b839bc83ada6dd40400480f3c900a96dc8ed556445176e88628d9e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216808, "uuid": "9ac4db01-1021-4005-b74b-5356b02f0e70", "comment": "Malware payload (Mirai)", "value": "ae5ff9b587463674ea3a3ece97f66b31d587a9a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216808, "uuid": "3ad92db9-3a19-4db9-8e04-7c4cee3718b2", "comment": "Malware payload (Mirai)", "value": "eb3471a674cf92a46b4123133fca53fd57bf24c6595ee5a8015defd62011008075e501e53d2b0518c1ed756aa57bfce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216808, "uuid": "30d66318-4ba4-4a2a-9368-13559a69fc87", "value": "T17C834B0273480D43D1665EF02A3F37E5D3AFD59121F4FA89660E9B4A41B6EF2254AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216808, "uuid": "4ee0e759-b4d2-4763-a763-81975bd41472", "value": "1536:rFC0/7CPXuQeMQN5ApMOqFC+QmquYq3903UO:rFC07IQ4eF4m3gUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216808, "uuid": "bf07d486-1a90-431e-bfe9-f9fa2e941b61", "value": 87728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216808, "uuid": "e9732d41-3125-446e-a7ca-c7d4e65cb8f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216808, "uuid": "ffc1f410-3811-494a-b9f6-aefb8cc6e243", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8626e8ac-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212028, "uuid": "a5bfd2e6-947e-4c01-b294-e2dac1a8a701", "comment": "Malware payload", "value": "3cc2c894bfc63010799bc22a54a676bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212028, "uuid": "766b7e95-fc07-46c3-b733-47ff4690b5e9", "comment": "Malware payload", "value": "7fca5e0b777e7f987dba7b4f4adffd390a30c1d6e55038b454d6866abc9ad520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212028, "uuid": "00cc659a-8024-4ff7-9a99-03f143822a88", "comment": "Malware payload", "value": "cf17ad441b931559ec5a450fc0d77af1aa7b5486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212028, "uuid": "b116b26a-26a1-4490-9126-f052fb4cc5e6", "comment": "Malware payload", "value": "3453d9a0ec3d03e55f3550e5f5b7156a6bd2738228a9811b21e40dc34eb61ea1a2004f9ffbc00027cd0fe7d487046408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212028, "uuid": "152b931f-33c5-478f-bd8e-a75a4bced4f8", "value": "T116E43392F5F632DC1A39BC6BBB12F5653A99EC818BCD9C0C092A43B0E65DC7D72054E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212028, "uuid": "fa6ea492-324a-42d7-af73-3712b30d0cdc", "value": "12288:NYsCsilfCoHMyqMj0SI50bjE/S//FA27uzDPjMWQP0e2jTgazxnsnxHu:DxiJqDlgqS//t7AlHe2jTH1shu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212028, "uuid": "eda51cd6-1485-4b9b-b6e0-bc1b159da25a", "value": 720964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212028, "uuid": "bae32c1a-8fc4-48fc-9b8d-04da95b3bd3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212028, "uuid": "c845e363-a371-46a5-ad3c-e7c7701d43cc", "value": "client.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17b00ab-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223268, "uuid": "205e8b01-a8a8-4db3-9c70-e1a7b3923124", "comment": "Malware payload (Mirai)", "value": "c98611ef31ad6b8cac4d0377c1d9bca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223268, "uuid": "0bdcaa3e-c2ff-408a-9666-66a88ead3e62", "comment": "Malware payload (Mirai)", "value": "800b50301e22fee43a666b8f82aa28588c61bc4e80194de6bc1a9832424142af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223268, "uuid": "2bd57b3f-ab1c-483a-846b-6aa8bdfa563e", "comment": "Malware payload (Mirai)", "value": "faa330cd544a5c92e3e8cea27b07a0d6374ad303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223268, "uuid": "23428d55-b1ab-4638-947f-93d293ea1ae5", "comment": "Malware payload (Mirai)", "value": "0ad82913ea70752908c595749fa81429579abfad9476f48c6d49a3e2beca13cb370071bf472ab79f0fa9263263cd6800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223268, "uuid": "44886ac3-b772-4bdb-97dc-6eb83270c1a2", "value": "T198A33A21ED396C27C5C0713B51E34530E5B6539926BC9A5F7EB31D9CEF14220322FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223268, "uuid": "674028c8-cd1a-4b5b-9a26-c415e31db2a1", "value": "1536:NQ+lMSIEuUa6efhmCKTQ/HwbJlfNqzyZewOdFQtshzm7uhG:qXyDaRhSbfNqeAXrzmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223268, "uuid": "6d56ee87-532b-4f2e-84bc-c7e0bcbdeb9c", "value": 99900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223268, "uuid": "8accd73f-a0d5-4df0-b16c-bbf8e44457c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223268, "uuid": "ac1049c2-aede-474e-a835-0f4c99aa5d21", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6bef94-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255044, "uuid": "545d82c4-1fc9-4ab6-8009-b978fbd42eab", "comment": "Malware payload (Mirai)", "value": "8eec7e350fbe8664aae295ecc38c456f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255044, "uuid": "d1126f55-ed84-45e3-aacb-5761063bf474", "comment": "Malware payload (Mirai)", "value": "8030e5281c1e72014a3bc3e7068cc64a0530b4ba8362fb1969054e1e3a710ed3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255044, "uuid": "adf47404-42e1-45e5-883f-d79d92709aa0", "comment": "Malware payload (Mirai)", "value": "b386f7eab65c18ad58571959cf8d98cc51334bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255044, "uuid": "16d027b1-5cf4-48ea-b0d8-3002aaccf871", "comment": "Malware payload (Mirai)", "value": "1cf80aa362aeda6ba9d2e936d91c4849a4b7391ea62493a6de0a3943183083c65bbae78fe17911d19d3a0f5c0ce0897e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255044, "uuid": "1c5f45ae-be05-47fa-9b29-ddbca9f76980", "value": "T14403F9827D828F13C1D122B6F7AE018C3B117B7CA5EF3242E9227F91778689B1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255044, "uuid": "7dff0f6a-5c29-4b93-a615-74abe2f3427c", "value": "768:XsE/INu8Pom2hjIWj7GEHoFw1qzojrYqT1BGa:d/sfWjqS+w1WoXlga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255044, "uuid": "4eacf737-5de8-4fcc-b526-46be8abc1e2b", "value": 39720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255044, "uuid": "a5b9b78e-c3fd-4a6e-a1fe-b5774f09c06e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255044, "uuid": "21c26fff-6ddb-4b68-a017-75b5af000bbd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5a282d-ef55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768181142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181142, "uuid": "77fa1db2-5567-4a18-9d1e-0df911f8b704", "comment": "Malware payload", "value": "2c81978708953c298f015189ff573627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181142, "uuid": "b7a8b537-b933-4fee-9b18-0e493e9f24d3", "comment": "Malware payload", "value": "812c9036e28e7a70222a245a6dcd23fb940f7a6a8dcac5bcd76c53a5a0fdcef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181142, "uuid": "1d5c5f81-dfc0-448e-b637-58c337cf45da", "comment": "Malware payload", "value": "9ca1cabbfc19a3e9b3ff0c900d2a9770b5481d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181142, "uuid": "5ff25ad7-b0af-4cc3-ab85-98afec2a1281", "comment": "Malware payload", "value": "c6563792adeac0d30e3fc92aee8118221a1f3d3d13db3e3737925a8a935940001da4a798eaa88b441c04760258e86f77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181142, "uuid": "dfd214ae-1e3c-4f98-9c16-d829f2f29627", "value": "T1A3C6E75774E25252C4F63BB6A8BD809431271FFA67821B6A6C04FE387B7B4C90E39714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181142, "uuid": "b5ad0b89-23e5-4fb7-af57-dc68695d7ac7", "value": "98304:CftFhgCogZh9R+daXW+l2ALNTA6OsoOZH:CftNZPCOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181142, "uuid": "14037cc2-9fa5-433a-b2fd-7a3861c7c6c4", "value": 12255232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181142, "uuid": "19e63717-ca43-47a2-9e98-46cf80a9d8ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181142, "uuid": "6fb6f2ab-7fe7-490b-a386-8a9869f6610e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb082fdf-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768205755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205755, "uuid": "eea3c9ed-81b0-4bcf-a05f-20fb6052f85f", "comment": "Malware payload", "value": "bad6a6a8caa8eba6d30561e0b648ab98", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205755, "uuid": "acb743d1-4357-4c7a-8d25-bdfd949a4a39", "comment": "Malware payload", "value": "81c1e32e4cb09a7087440606a06625649d268e6159be794a5a2d6323265430ff", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205755, "uuid": "b9a73b58-2df0-4632-be54-ce930c473916", "comment": "Malware payload", "value": "94243c5dd1ce11b8a23342ef63c758af334cf195", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205755, "uuid": "e176bcf6-c291-4d0e-ac89-1d2c2f90438f", "comment": "Malware payload", "value": "3243ddbe8b283bd6362bd9e9b067811e24d7570af8a50fd7f0e33c97371b00eadde30e81cd9a2ebed2e968c39557bf5c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205755, "uuid": "4ce7013b-2969-4005-a2b2-27fbcb13d7a2", "value": "T12772133B965CDFF00B2F21F0428B7D042095D326E936896D98D6C0997F2AB554FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205755, "uuid": "4c29c01b-5f0e-42fa-9c26-9e7cfd651a6e", "value": "384:YOqEl8kOhpi9P5uVu3hekj9Ux7Nihn+flFfuiI0CRL:YOVGkcIhAuyf1I0CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205755, "uuid": "8dcc4d97-dfc8-4c09-9a8d-b9f62129301c", "value": 16077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205755, "uuid": "3ca9cedf-8792-43fb-a7b8-c91b0d1feeeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205755, "uuid": "f88c3aaa-3b32-4260-9de8-a462626b1360", "value": "Documented_Invoice_1302.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36f3763-efb6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768222815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222815, "uuid": "e262404f-9d41-4dc4-a756-d0ae524cb07e", "comment": "Malware payload (Mirai)", "value": "2959cc509271e00d6ed9fff070062d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222815, "uuid": "5edd5160-9423-425e-8616-4a391d2c21ed", "comment": "Malware payload (Mirai)", "value": "83a1ccab49a394f251694c934541c9268e886cec3708f7ec54814df8b0eca727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222815, "uuid": "746a9d1a-79ec-4672-bc8a-2f5014553d38", "comment": "Malware payload (Mirai)", "value": "d66a32af795b5bef527940ffc617932248f2a08b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222815, "uuid": "a0840b76-e2a9-4800-911e-8e58859491eb", "comment": "Malware payload (Mirai)", "value": "1aa68f45f1f56d194482bdc79fd37c0bccd28e2a608596af8b6aac4a97a14b9b992f26485883ad07f96f76cf53e09467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222815, "uuid": "d9b6e629-736b-464e-a56b-68d5babfd909", "value": "T1AC83F90AFFB11EBBE4ABCD3305A6074939AE550621B97B393974DC1CB21E58B45D3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222815, "uuid": "80899347-3d0e-4f0f-84bd-e9366be69478", "value": "1536:QvU2Sk/Xu8gun5/CGorgyJeGfx8QlM378CubZs81WMHt+LLRjmnZfqFX39wu7r8m:QclRgyYNm4fz1hhamnTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222815, "uuid": "e3a143ce-ea80-4064-85c3-e9b1581d0306", "value": 84736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222815, "uuid": "c392237a-3d6f-4e02-9481-1ad47bb7fc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222815, "uuid": "40d7e1f1-b99a-4812-9135-10a3d1f13ec2", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f619d6d2-f001-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768255166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255166, "uuid": "260ae314-a096-4867-a167-57c455f3c2d2", "comment": "Malware payload", "value": "0dccbf0633c01135b9b14343bdaad426", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255166, "uuid": "2dee939f-c318-411e-8640-c6b700a3e812", "comment": "Malware payload", "value": "860d8e949f7b486a81bcb7157b8df59cb29e9895ec1e214fef487d649c2aa6a2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255166, "uuid": "a308cabe-c450-4197-951a-0d1e980b0715", "comment": "Malware payload", "value": "2e3e5417ade1a99c1470168802c7d1dde53c5ed4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255166, "uuid": "90ae280f-c9c7-46f0-aeba-43ab566c619f", "comment": "Malware payload", "value": "73a6ceac818a3c036fd8cb533d1ea8839f62b8f3c3ccff008ad9672c2567fb5bd462b64d2491506073185ab21a1badb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255166, "uuid": "2df3f0df-8c6a-4d59-a647-8871b5498bb9", "value": "T1907601277D8AC969D96744B351C281536A2A0AD9E80BD03F22E44DC95E71FCB03D2FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255166, "uuid": "9aeb8946-d180-4983-9ca3-e2b4ff0ae350", "value": "98304:pO4HvUEQ5NPepaMRvDzUZ+dgLAWXluI2Tn/rhAnlNQclIeME8uVIhmSjJFhaJK+2:ptHvB2JAxvHCc2ln279shOZEFS1GK+J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255166, "uuid": "8d464958-a000-4323-bc8a-96e3bf020315", "value": 7523972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255166, "uuid": "de2e32d8-72fc-4d9d-8681-7047f3c34f1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255166, "uuid": "3dd04e36-b68c-411c-a9f2-ffabb63c0938", "value": "Module.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fffc0b-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205321, "uuid": "b3d52783-ca46-476f-bae6-dac00b254fff", "comment": "Malware payload (Mirai)", "value": "c479bc75546129d92409ca504fcd7a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205321, "uuid": "db09f360-2363-4942-9ca0-63415f273bf7", "comment": "Malware payload (Mirai)", "value": "8657e875e4b01a74535cad62aabaeea616faf7df6bf58f7cb83eeeb067341d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205321, "uuid": "a1972f32-7385-4c0e-8377-d61d8a16ec89", "comment": "Malware payload (Mirai)", "value": "852a6b945548d14d85b60ca32641ec539883f93b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205321, "uuid": "3e8cf94d-f719-4024-b20e-ac869f23d86b", "comment": "Malware payload (Mirai)", "value": "8065430a8012c1cb6249820500e60b6e22699d317730f3ce0028991b87d803e1ed1944f7849cbee2612e601c37dc8cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205321, "uuid": "1de76484-cb06-4c4a-8179-ce2dce3e497b", "value": "T11DA3FBD6BC81CB11D6C566BAFE0E218D33134B78E3FA72138E185B1D674A86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205321, "uuid": "ff7f14af-1e8a-42ed-be32-3a5a8b6b6466", "value": "3072:ZynWl/HHVEIBpgk3UMvUqTVLak5f2u+DET8JrT2:ZJf3gk3UMvPaUf2JDma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205321, "uuid": "0e49de0a-1387-4560-bc28-b96cecca5d21", "value": 99964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205321, "uuid": "69af33e7-0ce1-4d3e-95ce-2280ad7fc1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205321, "uuid": "4d628cc4-c7b5-44a7-b669-766f05b4f936", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040623d5-efca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768231137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231137, "uuid": "baef018c-9ddf-4fe2-9d48-64f514f15a63", "comment": "Malware payload (Mirai)", "value": "7f97f2a8b2bbceb3cb8eed654beead53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231137, "uuid": "56962525-682d-42fa-bf06-e840a8ba7bf6", "comment": "Malware payload (Mirai)", "value": "8751b7895a6f1b8b37e6024b7477fd5c979a351ee3d073ca415a7ded3387f786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231137, "uuid": "5ed168d1-b718-4942-bdce-a009d6477874", "comment": "Malware payload (Mirai)", "value": "8d540b7068a167dbde7719f29b2f5423ed635c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231137, "uuid": "d31bf9f7-7ab3-4079-996a-ec16c447f4c9", "comment": "Malware payload (Mirai)", "value": "658d9bde2744c9ba8177769204a4bc23648478c16fa93aa5a15382d188d7942c0fb39f465050a2ee2b9a1d84cef947f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231137, "uuid": "340cad94-0cf3-48dd-a432-784a0ae1b447", "value": "T19843961E2E219FFCFBAD863587F79E219648339226E1C584E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231137, "uuid": "bc234ed2-df93-40d3-be85-95ba909bf4d9", "value": "768:TDul5U9mAG5Y2zrEI/fEInwa05zNx8jMyOFy26OybGFjFp2gnAOxAWsFnkPDQP1:Y5smAG59zRqn5zNKlbGFjETCQP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231137, "uuid": "66214454-664b-44a9-9808-5f655c91febe", "value": 56672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231137, "uuid": "2ebfc2cf-3ea0-4f0b-8623-f400904269b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231137, "uuid": "b3829146-9885-4455-b7e4-9314eefc9ccf", "value": "SupplySrvmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5235d3f0-ef5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768183165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183165, "uuid": "dfa6ed27-ea6c-4643-8e22-37d77b05cb1f", "comment": "Malware payload (Mirai)", "value": "8327d1ec81386fa81a3fd103421ee00b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183165, "uuid": "79a13f4b-3e5f-45c1-ad9c-b78d0cd8ff5a", "comment": "Malware payload (Mirai)", "value": "875bfc5623de9ed3b91b88e7c65b88d08c09878dbcf81a55e13cc19b2d17aea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183165, "uuid": "6e15146c-bed2-44b2-a48b-4c94e51d24e7", "comment": "Malware payload (Mirai)", "value": "59aa0ea2600d971f356005ade70b6e52fd1efa06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183165, "uuid": "61ef484d-efa8-4c90-9a1f-5115fe98f13e", "comment": "Malware payload (Mirai)", "value": "1d8af134015c28b1955837282d3e0fae372b9c439d91f809985bc28111c1d2ef09b89ea5bf93e7f1d26448b15f904e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183165, "uuid": "985bf9ef-7776-4903-b182-6542e11fc34a", "value": "T1A7632A21BE766C27D5C4707B61E34235F1E6534B21BCCA2A7E620E9CBF14650221BAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183165, "uuid": "09bfcd48-e872-4ba1-bc9e-1945daa2fe77", "value": "1536:aLV59Z3qt4ZoHsPjsf8Dg3ECXRKZlyZepVj2FeT33/zm7uhh:4Rof8DJiOjYebzmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768183165, "uuid": "4ab31d3a-ac61-44ea-978f-63f499820cd7", "value": 66780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768183165, "uuid": "5ef96241-0d20-4307-ba90-976f589f12f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183165, "uuid": "beb400e1-ef81-4d8e-b8c2-6bd8992aac34", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca0876d-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1768226105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226105, "uuid": "51fcc33d-8ce0-4803-ac72-3ee1ea950856", "comment": "Malware payload (SVCStealer)", "value": "293e4a2c858d7b8b19ea8954e5e8fe27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226105, "uuid": "5ff8f4e8-05ca-4323-8f73-f930b3a15b10", "comment": "Malware payload (SVCStealer)", "value": "87b27ec9a27fccb63c23688277e50ed0d1afc598d981a6169ed4b14a21188452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226105, "uuid": "fc3cf808-3325-4b63-8afd-314cd53056f8", "comment": "Malware payload (SVCStealer)", "value": "6b28ca08a51252abac26b878f3395b5c5c57880a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226105, "uuid": "bbef44b6-bed0-45f9-91d4-3ad00e08989c", "comment": "Malware payload (SVCStealer)", "value": "3cdecf390040bfc78e41b64f762c138d898634649321cb5253768115aa62f5ea7af6fc3603b85a6dcea314b1d34d88ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226105, "uuid": "ed366403-703d-4f2d-b9b1-df0ba729b84d", "value": "T17D834901F250C035F0F700FACBB54B7A5EA9AF11536890DB57D855EAAB31AC1BA3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226105, "uuid": "7314f1dc-aee9-4849-b8c8-5a177d9c3ac2", "value": "3326b0ed8ca5d20f5013f8b3c04e7744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226105, "uuid": "ff01368f-2e8e-4c28-a5ee-05548f128ddd", "value": "1536:q148CrfdXNM840VhyGzirik7okuAhoB2y:q1zmM92yrCksB2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226105, "uuid": "1a4342bb-be3a-4354-a1c3-2dfb0f0bb31f", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226105, "uuid": "2737ac50-aae7-4ad4-9ab1-4c4b3d582b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226105, "uuid": "a31124f2-e481-4d43-a4c3-2364a62f5fae", "value": "8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1299efa-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230247, "uuid": "4b35a309-e17e-419a-bb78-82ce20525559", "comment": "Malware payload (Mirai)", "value": "fc566babe45ac03d85c3df44a2ab695a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230247, "uuid": "c12e957a-93e0-4bb9-a302-4bc75bec3152", "comment": "Malware payload (Mirai)", "value": "87c5c01b81da277261e81a3634e07c628558f90ac33dc89dd913413b7a605b3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230247, "uuid": "449d107b-6774-44d9-a853-4be99143cdfe", "comment": "Malware payload (Mirai)", "value": "f7f1859b075420e5c7952a6ce8f396209e2cbad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230247, "uuid": "1e21f661-40a1-4ba8-94d1-6ce576f2a890", "comment": "Malware payload (Mirai)", "value": "ecaab8b8fa53aff8fdb1d2f6031e54450268e4e701631baf880394ddf0df7557bff1ebb26f5cd37174694d30251d6840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230247, "uuid": "b5df5b92-2610-4c87-8f0c-b3e2c1959e5a", "value": "T179C4237362579C76EE9AB6BF6E0E6261A30C43E703F2185D0FF4862A867471524610FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230247, "uuid": "feca7778-a8a6-42da-8b21-673351e21af4", "value": "12288:P6AUl5gH2O4BKG+wMBo/77zapYeS+4e19kgPUDR7++rpy5TH+Aa:P6ngHh4BKNo2pYeS+4eZMU5z+Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230247, "uuid": "a50735cf-2c6b-46f5-af42-9714b9ae351f", "value": 543696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230247, "uuid": "399ccac7-32a9-45c4-980d-61b6bb92c2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230247, "uuid": "794c3ab1-7b6c-4f67-ac05-6f276f1a1986", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a474cfe0-efdb-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1768238708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238708, "uuid": "845bbe90-ae61-4436-8b62-0af7037af5db", "comment": "Malware payload (SVCStealer)", "value": "04487306fcce38f93434ffa5796b4f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238708, "uuid": "a67f33e9-a41d-4d6f-8baa-1616f5a7ec4d", "comment": "Malware payload (SVCStealer)", "value": "882c5a26b60517a4ce80c7f4449cad4232ce088772fa803407e20e6015f5489f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238708, "uuid": "c44f187a-c383-4972-9141-305ef0d7e2fe", "comment": "Malware payload (SVCStealer)", "value": "cb879ac373a0f7f71f09cc0fd3de2667649c573c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238708, "uuid": "58a47386-7b39-4c51-af68-457a1bd3650d", "comment": "Malware payload (SVCStealer)", "value": "9155e5ca1dd50e2d63ddfdcf3cd66d208f4b305beb08c1dc4ca6268447f64acbfc6eb0c04dd330a287c01cff385bef00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238708, "uuid": "7ec3b45e-4ab5-4419-9edf-d8b44c131007", "value": "T141538D93B7E2C032F06295B419248B634FBE7C1156B4C5AB2B8C0099AFB16DDDB39357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238708, "uuid": "62726aa9-bdd9-470a-9252-6bcfd988d308", "value": "55380ca6450e841d3d090c9d1307b680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238708, "uuid": "5f8f57a5-89f7-4a76-b61b-01532aa6dd79", "value": "768:nNCzfY0j15I02wNfEiMgQacRZidtvs0p0uv/uhPVmDa+kk0LEDUVnNAivwZCi3Aj:sY0jLIilDsH0hiYDa+kdV9AAhoB2yz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768238708, "uuid": "5115df5e-6ad9-4cb6-9456-3d9c154d2ab4", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768238708, "uuid": "c5b45653-f66e-4d49-88a5-8bc27373ec38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238708, "uuid": "806853ee-baed-46e9-840c-f98fd563c56c", "value": "x882c5a26b60517a4ce80c7f4449cad4232ce088772fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8405e7-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193542, "uuid": "82aaac48-e20a-42c5-aad9-d1b9a8574abc", "comment": "Malware payload (Mirai)", "value": "36ea0de814c241a6717115c49ea94745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193542, "uuid": "40524786-1f05-4e22-a5fd-c7c03be827cd", "comment": "Malware payload (Mirai)", "value": "8933a0f47cde6f2b40b2d79970a9233421de77db2897d09d6ee96f97945e0ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193542, "uuid": "054f823b-7541-4c22-bf8e-dbcf06452fee", "comment": "Malware payload (Mirai)", "value": "d45dd6e2af41ec1e50dcca9b93729545c3961d3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193542, "uuid": "9bd57e85-dcdb-4d9f-bbf6-4a6eac7e5266", "comment": "Malware payload (Mirai)", "value": "ff71bcb481e300faf6168e821354a1f520d3d42657a1f2a73f989035b90fb85d422e6715483b272d9c368ad3122accc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193542, "uuid": "a97f44cb-9ab3-4873-b290-b44f53ef8e70", "value": "T1F9D32A06BE905EEBC05ECE70052AC34321DD989AA2E6732E76BCDD4C7D7930649D399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193542, "uuid": "3372ab59-9737-4bd4-8f5e-010ee88da882", "value": "3072:/0UP0x1XNLg4yGYzmqFxKkVgdIuPxl71/c6EVLXYnCjDlzQzoHqhuj:cUGXNg4yGYzmqbKkVgWuPxl71/jE4CPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193542, "uuid": "e2bb2207-7af6-4370-b2bd-52250fb6f4fb", "value": 132532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193542, "uuid": "3fd3de2c-5529-4ca2-b1f6-2d585f7a5613", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193542, "uuid": "372e5d66-e0c5-4414-9b5a-7765600b2606", "value": "catgirl.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782a4fa9-efb9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224031, "uuid": "ad6a31d1-8a13-45ce-af21-524e66c1da69", "comment": "Malware payload (Mirai)", "value": "a9559719044b1a928a0716ca96fb916d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224031, "uuid": "81792f6d-fe2a-4ce1-8d08-ec65fe57162f", "comment": "Malware payload (Mirai)", "value": "898e3984d9d30894ebe033dbc2c9a010f845ca2541775bf76e1ff7ea769efedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224031, "uuid": "c29a494f-1b55-47c6-98bf-2573010e0b7c", "comment": "Malware payload (Mirai)", "value": "a0bb29b0596e57e80f0c4a73c8b8e6b989facde7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224031, "uuid": "d14d2627-75fe-4df9-89a6-9ea16307f87b", "comment": "Malware payload (Mirai)", "value": "cc91e38c596e7080f9e03dee414978603cd828b88471ca60437283c6e7736d8456cd8469f7e2846572f03fedeea33534", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224031, "uuid": "64a14fe7-268d-4d95-991f-ba199c489fe3", "value": "T1F9531AA9B810AC2EE81BE2B7C4830B59B12163E589427F277667FD53CE3D1746C12D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224031, "uuid": "f84f1b15-588d-446e-89f7-2756cfb77dcb", "value": "1536:Vj/dTK1kJ2AxbxSkRCZ4fi56mqkHz+TXiVbh8rvo:Vj/dTKbSVSkRC5N9EiVeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224031, "uuid": "7aafe110-8726-4d3e-9fe5-9c60ca07887e", "value": 64120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224031, "uuid": "02c0ae84-38d4-4592-a20d-06281253e554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224031, "uuid": "fa7edb03-49b6-4503-ba87-eb288677d346", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5163ac-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179373, "uuid": "28d759d9-d536-41b4-b6c3-3e8d6d8a7f78", "comment": "Malware payload (Mirai)", "value": "f65fb1e6509a4ce844b2930a6892b3d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179373, "uuid": "55647546-c980-43c5-bb4c-f37f20d7833f", "comment": "Malware payload (Mirai)", "value": "89dc95555f092d427044f3050bc9c899b99610f6aaf7406310334e03916d4eba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179373, "uuid": "0f828d16-9e44-4d4c-a668-6666885f2fed", "comment": "Malware payload (Mirai)", "value": "620490def1585cb877375609646097bfa65913d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179373, "uuid": "b4348b6d-e48a-4ca6-954c-183c4a651a31", "comment": "Malware payload (Mirai)", "value": "3ee3053a858b20230c3834302499403ef9ccada86490d70486f84f9c28b5c296d3be06c0463e0f51b1fd2af502ea6594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179373, "uuid": "8b872412-434b-4365-b31b-377e3d0c5206", "value": "T1F6247D91B95E7D7FE2A30F3FC54217097B7CEF124A02A926B05E615A1DFB1824F2620D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179373, "uuid": "4cebf081-a3a6-4bf0-b691-e1cc77c062c9", "value": "6144:7EBSMgGQIlhUkwVxjIJvZWo6/6jhlSJ8eBWT:77XGQ2hXQG/hw8eBWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179373, "uuid": "5fc7d327-f286-4ce4-87ed-0898e36cd81b", "value": 221436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179373, "uuid": "612c0d75-5636-43e9-9d36-92e39f335fbb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179373, "uuid": "4e0b4601-e8c2-4034-a6b3-f881948bab0f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5e4ebb-efde-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768239823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239823, "uuid": "a81ccc5c-013d-439d-80ae-aef9b5ecbc0f", "comment": "Malware payload (CoinMiner)", "value": "122ad8d82189a8d3dae18d945070d14b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239823, "uuid": "d65c38f1-afa9-4406-bf9c-5fd22186444d", "comment": "Malware payload (CoinMiner)", "value": "8a76c8182883729901d56c2ee0cc5f42d99ef804ff0da5323545af520a628de6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239823, "uuid": "92ecde6b-dce1-476f-9bc7-729cc9e070cc", "comment": "Malware payload (CoinMiner)", "value": "d9711d532663f9061d0a515b19b666efcae1524a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239823, "uuid": "ef823331-8c7d-4dc8-9105-a428759e4e4c", "comment": "Malware payload (CoinMiner)", "value": "39f47a78776ec1ac1793e0122433ab85f680874d6a59b70ae2dbdc061adadf71335982a16c5ca8d423f9f1e7f31d2a48", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239823, "uuid": "3b6d28b5-2bf1-4cea-a5e7-b0d6a310a1e0", "value": "T1E2220AC87BD411FA24E64842E3F3D37C9D8481ED69E78EBAE45848FD9AB0548E07DB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239823, "uuid": "56e98d58-4f78-463b-82b7-d6efc9ab9626", "value": "96:hiOfWVc1dZd4cjzlZ16EMvyK6tTVRei0E3aSl4h0C9Qa+yvhQzm8Kol7Upcu+ifv:hs9W7I1vVYTSPrCNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768239823, "uuid": "21ac048c-cd10-441b-8cd9-9dd36cf764ae", "value": 10876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768239823, "uuid": "f92ad6d6-5b3b-4645-9da3-f07edc9a4a44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239823, "uuid": "d6885f1f-518a-4821-9389-2ac8f595cbb4", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892190f6-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246393, "uuid": "245a2c55-2927-4c30-b605-b61e11c725db", "comment": "Malware payload (GLOBAL)", "value": "4df82e070cd499b59ae333fa0f91cbd3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246393, "uuid": "60381b60-0ea1-440c-8e66-b1014c8894d7", "comment": "Malware payload (GLOBAL)", "value": "8ae4a61d7dff97b03be346edad80a6f9dbf91d00a505e100fe5a27070c809ab7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246393, "uuid": "2723c82e-f77e-41f4-bd07-ece1bd867e88", "comment": "Malware payload (GLOBAL)", "value": "d2cb9c6c9abb0bb7d407b8a547de552cd1359468", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246393, "uuid": "91fd2efc-bd3a-4320-8f32-842c52efcaef", "comment": "Malware payload (GLOBAL)", "value": "722eeb3fdf65b9784499044d586e32dcf09ede90a9dd210038a5ed00266a7b03ec51209c91d5f68e2e41533db515569d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246393, "uuid": "5f50f9f9-509e-4558-beab-05e61878d5fe", "value": "T1DB347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246393, "uuid": "362716ff-b68a-4160-b911-d6edf3b96d53", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246393, "uuid": "84b4579a-f9cd-4880-90b5-c2fd3afecc1e", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246393, "uuid": "4498cb92-bd67-47ac-9fd0-0c735bfc2e90", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246393, "uuid": "0cd259ab-ed88-412e-814a-436a3d7ff169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246393, "uuid": "eea5f96d-9456-4836-ba84-8885b00e7e27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72a7640-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223277, "uuid": "483813a6-fb10-4682-8101-25935fedbf6b", "comment": "Malware payload (Mirai)", "value": "c06c4d5995e4947749c4ff5f73173b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223277, "uuid": "18c47ba2-73ec-4db6-8fe7-bdfda199b3de", "comment": "Malware payload (Mirai)", "value": "8b5ddc9b610d5717c3f40e4722795efacebb9ad08e2e9a84f128e303d0a287ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223277, "uuid": "15796eb7-7124-4144-8c7f-d0b92c7a6387", "comment": "Malware payload (Mirai)", "value": "29217767db2b686b651f4c01aaf7399812f36ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223277, "uuid": "b2f50721-8855-49ba-9678-3c6b1486c459", "comment": "Malware payload (Mirai)", "value": "8b789e6502704883b68ead9edfc7b05d677c50f488c25b10e8d8e4c482809b27c20c260453bab3e69b0e0e62a19f4b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223277, "uuid": "7b42576f-8a49-4fef-8069-50afa0bf6f5a", "value": "T107A31A8ABCC5C602C6E071B6BB1F51DD375643B8E3EAB107CD18AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223277, "uuid": "0f11d608-168d-451f-96ab-43d6779b8975", "value": "3072:bphBKZafCJdmgpNyzZTfRsWocBy9XPtGT2:3Bcaf0dmCN8rsVcByh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223277, "uuid": "72df4115-b5dd-4d39-9d80-4adbaec2cdaa", "value": 99540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223277, "uuid": "cb6c9243-52f7-4c39-83d1-fdb17e447105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223277, "uuid": "ede0dc16-2c50-4f40-ab9b-e25d31b60d6c", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32521035-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206304, "uuid": "b03c8423-00f3-4dbd-a10b-e16461b14d24", "comment": "Malware payload (Mirai)", "value": "7c2be0e3a337c3c6f961bfeddf50a808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206304, "uuid": "2f9c5663-089c-49c8-be48-534fa3be15d9", "comment": "Malware payload (Mirai)", "value": "8b6d822b7c621c47c43d3ee97aea03605b9fbd5934b68652b744e3b75c9f6295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206304, "uuid": "53f20873-0176-4b17-bbb8-295a80022515", "comment": "Malware payload (Mirai)", "value": "79d1da69abb28c0500f75339a20e2e49052d820a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206304, "uuid": "d2cde5dc-5860-4a76-b5e6-2a37f30f8a6b", "comment": "Malware payload (Mirai)", "value": "edc329fb733cd8521175ea4d7780b21af147d26b2f7c6cdd780f491e94e5b544e79376225c31c954667ef2210d8d6c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206304, "uuid": "c47468d1-87a7-4988-b79d-5153925ad227", "value": "T1DD930AD6BC81CB11C6C566BAFE0E618D33134B78D3EE72138D189B2D678A8670A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206304, "uuid": "0120c66c-ed9c-4d5e-ab80-f0026fab8472", "value": "1536:X9nPNqgpSKFes/HJvx1LWEz1lf+vOIhmAFmNBspMfk+H3T30ezCRAj2kaWtlb+M+:3qgpSqNpvTLWEzTumNB0+707xm9r7lq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206304, "uuid": "b5650f65-cc5e-4f61-aa68-6c7084dd4d3a", "value": 95436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206304, "uuid": "da33b6b0-3e2e-4f99-a0e1-c28adbef5ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206304, "uuid": "8ca6a01f-e33e-4575-96b1-fe40b71920e5", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c3c1b8-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231139, "uuid": "717ffbba-2f6b-487d-83cc-af9f0db9bdbf", "comment": "Malware payload", "value": "7e0af60786abf2498a1db80fc5074d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231139, "uuid": "aa98c301-2ac0-4022-9972-8b73d1a61240", "comment": "Malware payload", "value": "8ba46030874e46aaa2e5fb21fa05d786cfb24d41f439076271f3d96c1dcb27ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231139, "uuid": "20bc933c-b9c7-4fe5-878b-f8761550c622", "comment": "Malware payload", "value": "99e50b4606b0b9dd4174f051a54e7feceaf03700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231139, "uuid": "69bd6c1c-0838-4153-9351-3e8a65f94e21", "comment": "Malware payload", "value": "28cf54d263fceb36857f072d833b867ac6756dc727379a39b86ac2957be24695006954604439352e2ae9661e852910ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231139, "uuid": "af658664-8197-4175-bda7-f76ecfe72f49", "value": "T1ADB36B8FE683C5F1E16E02F5207A1B3A6A72F43600154C41DBF5BA71FCA9902FA5976C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231139, "uuid": "eb4dffc1-f842-40de-aac1-b9df9df64055", "value": "3072:Yqz6GY827JvZLmQJ5AC+9+/rCKnUIdJj:Y4o82yU/r+I3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231139, "uuid": "0fb03efe-861b-45be-a314-bf5b1b2b0676", "value": 114732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231139, "uuid": "f7cb1b95-851f-465e-8a22-ba7fac6049ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231139, "uuid": "8b1e2a8d-f4ec-47d7-bd44-303f882a673d", "value": "rondo.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1fda57-efdd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768239442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239442, "uuid": "06fca6c3-ff7b-4e57-a0fb-bd675377a605", "comment": "Malware payload (Mirai)", "value": "36204572cad4da10f9f331807bd8932a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239442, "uuid": "42e28fa8-28c0-4e53-bb25-873381952325", "comment": "Malware payload (Mirai)", "value": "8c70324d189ce5bf13a4c2db3d90355bd6fc812c8d2d50f708ff6bd1cd3f3f76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239442, "uuid": "5dda3182-8d91-444f-aa87-1d8b5440ad02", "comment": "Malware payload (Mirai)", "value": "a24fda230ec6cce8eba13b4e0d5afc28b5eaa0ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768239442, "uuid": "292ce2f5-e553-43e7-9af9-7d50f861f585", "comment": "Malware payload (Mirai)", "value": "27d409f7b7175fc4396f20ba1aa4593243527a3a5d66dcce66b638a1912c2ef5b01de8cf55f5cbf11efdb1c52df8239b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239442, "uuid": "601f8f05-f165-4f1e-8ba4-4588d9fa9f7b", "value": "T133A36D06B7080A43E1736DB43F3F2BD2D3DA999122F4A289255FBB49D072A325546FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239442, "uuid": "86884f31-7409-43a2-8f87-f55220d5d5ed", "value": "1536:Spd/14cU3gA8I395w4IWip5RbbokR0dSzkgNNk6RDKyovjGW42uVdrHIr:Sav8+HvUHJ0dt0ReynWLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768239442, "uuid": "e6a2775a-a6a7-49a5-a80e-4e6a102e5399", "value": 99636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768239442, "uuid": "662ef5e8-a6a9-4963-8a1a-3580d06616c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768239442, "uuid": "1fa56921-934a-4603-841c-3074c97c1911", "value": "powerpc.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094eed52-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225133, "uuid": "2075fb70-3c32-4b6e-bb18-efaadde33ec0", "comment": "Malware payload (Mirai)", "value": "b166c1f99a920b9f12dc2d02b7dc1a57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225133, "uuid": "7c2577fb-55d5-40fd-bf1a-9d158595a1b0", "comment": "Malware payload (Mirai)", "value": "8c8aa2affd33a64f3df91df43da74e4041f78cc9f493c0c05aac80ab02f8d65a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225133, "uuid": "f87180bf-1605-4be5-bea4-d6e647daa927", "comment": "Malware payload (Mirai)", "value": "dbdf2397de4edad513d33ade5d4997ad9f4a3a6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225133, "uuid": "7b8b79f6-82ee-4170-897b-e24eabc5149a", "comment": "Malware payload (Mirai)", "value": "d65b6b96aa3e4bafd732a9af893c7d9beff2ad9efdb4cee2cd82d08da327651c97685af3fcd4d804a56f7768a864c059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225133, "uuid": "76b977b0-1cbc-4493-b693-f05af14fc13e", "value": "T17BA31BC6BC81CB11D6C166BAFE0E518D33134B78E3FA72138E189B2D674A8670E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225133, "uuid": "65fd4f06-463b-4274-8b8c-0289dd8d5ba3", "value": "3072:kdxjbvE6bV/Ewsflj10E7yvN7aIU5ZHoTA:Ub32jkvN+Ikt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225133, "uuid": "ae10730d-7fed-49b1-a240-a6c3fa03d0ed", "value": 99532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225133, "uuid": "bdf9667d-c883-4849-a36e-094d75548f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225133, "uuid": "969e7fb6-7488-4410-8be7-262fc13673ab", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6ee733-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246377, "uuid": "207daf36-45ed-48ff-9dc6-e95d8490c636", "comment": "Malware payload (GLOBAL)", "value": "58c0fcbcae41dbf74116aa418ebffe0a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246377, "uuid": "625a1d18-6636-4aa0-9ae2-56fadd03695d", "comment": "Malware payload (GLOBAL)", "value": "8d49e40a0d85cb05aeaa152977bcd5e34e9219e3cf4b1a25e1e968888616aadb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246377, "uuid": "9dd9aff6-8ddd-4226-b762-248d3df5d6ff", "comment": "Malware payload (GLOBAL)", "value": "76e4cfb5450e8da56f02695b2567e1886026197c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246377, "uuid": "67ab0bc8-ed01-481d-8848-974653022352", "comment": "Malware payload (GLOBAL)", "value": "e4974d34ff666a9172b25679562cf4a49c8d5bfd4cf7915c93bf04d4c0f9473145349760cb637c09507b62a1131b1636", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246377, "uuid": "d3959a49-7dd6-445d-8125-7d81b39e43d4", "value": "T15C347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246377, "uuid": "88710a6a-5bdc-4a72-b66b-bb490db899dd", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246377, "uuid": "c78214b7-6a89-47f8-aa20-d32c2d7b1777", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246377, "uuid": "f0c7c7e4-9c18-4011-a678-b5f9e645ec40", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246377, "uuid": "27f2fd6e-9fe4-4c43-b239-b48e9890e85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246377, "uuid": "aac8c4d8-3e40-4bee-a2ab-b1c704baedc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6423e661-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214548, "uuid": "cd46073b-dedb-4c96-88c6-84bbe7da9506", "comment": "Malware payload (Mirai)", "value": "37778d1c30309063cd4be240009587bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214548, "uuid": "79b48d38-cad7-48ee-90ab-dd9a33259864", "comment": "Malware payload (Mirai)", "value": "8d561c973cf04c925391959457df4c0f67ed85037802b85d29178db13d0e8a72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214548, "uuid": "41e4cb83-7581-4071-8c93-f67f6760c4f2", "comment": "Malware payload (Mirai)", "value": "21161d87186f2fcd3b690727ff020ac75356a8ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214548, "uuid": "0afd032b-150d-4c0b-b0e5-4f81e81a5ee1", "comment": "Malware payload (Mirai)", "value": "1bdbd169e098cc09966a8b01db7a63591dd86c4bea1ed8f0867308d6ac99f412c074fc168d5ecf33c197d25c85f85728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214548, "uuid": "fe918fd3-c19a-4821-b457-1de316b97001", "value": "T1ED638DC2732DBFAAD5971E3E814387567F1DDF2499061062606A72875EFB2A21F331C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214548, "uuid": "dc86581d-44af-4119-a4fe-bf2f8cba343c", "value": "1536:dAlRJheZN3V4eQBaxO48i7mt7EvteOnRPJ0mS4/fyCSaYQrAhY:dAlRJheZN3HxO46tQvtfnZI4/VYoAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214548, "uuid": "01d49a84-1e86-48a4-a210-006cda29e996", "value": 67408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214548, "uuid": "5bfdc260-fc38-4c1c-8ac5-7bdfedacb3bb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214548, "uuid": "3bf3dd0d-ff60-4ee8-be71-225610df0a07", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17135f3-ef7e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768198787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768198787, "uuid": "adfc26d7-6dcc-4a8c-b857-01c73e3fead5", "comment": "Malware payload", "value": "b8196b432abea5369c5b5fc7ed5d9c7c", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768198787, "uuid": "a405be2d-dc45-4d12-8a5c-ccf8bb658998", "comment": "Malware payload", "value": "8da4a781790e692b3d292fdfb19e0cdd29b76e814c4bcceb702424cc8e1a3253", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768198787, "uuid": "4e5dd8a0-83ee-4a71-8502-186ca8df3e26", "comment": "Malware payload", "value": "701415ae0e3e5d706698a0db57be689739cedd08", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768198787, "uuid": "4b293222-b081-45a4-befc-966ab1fa79e5", "comment": "Malware payload", "value": "c3437836774e8b1ced43bcf3c1474b44dda38e5fe4f36ee73540afb503f8bad9fc61a07870db2a4ed9d7fb625030ce36", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768198787, "uuid": "3c6bd1da-9664-42b3-bb1f-dc33c671de82", "value": "T15AD52907ACB048F4C09E93318D629A96BB71BC450F3123D73E51B6782EB27D46E76B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768198787, "uuid": "aaca1876-6223-40b7-abd2-82c549a87fe5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768198787, "uuid": "2c4655b6-cb6c-43f8-b048-67f5d19cb831", "value": "24576:3jxh0Ze59umTXK0pLg3OBHQezh8WwwQCkE9NQzR+z4JL1cAn5Hg6z6eleXq9DXKr:3jx6g59lX3U3OBHQ6hnwwdnyzR+zKtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768198787, "uuid": "d97b5f75-5673-4a79-b4b3-c0733595a3cf", "value": 2790912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768198787, "uuid": "55d1f485-6bf0-4788-bd76-78433e456457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768198787, "uuid": "6302d650-7527-43b9-a35d-9677cbd5b079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1d8388-efb8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223633, "uuid": "c073458b-537d-4cbd-90a7-413eea2ef7ac", "comment": "Malware payload (Mirai)", "value": "5ed302f94716f65f49e097c0f899de2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223633, "uuid": "7c0c195f-412e-41aa-8d2a-a6a67ab78dc6", "comment": "Malware payload (Mirai)", "value": "8dc62037a90d00333367e45733a6f56a3b1cf7ec518b1eb35073d3f6cbe235dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223633, "uuid": "895ea783-5d07-4722-92f2-41705d7a876b", "comment": "Malware payload (Mirai)", "value": "b603b61ab56b6638a89e0efdedcca7a92e21f514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223633, "uuid": "8e27584c-c87d-4507-92af-b5b6a3fd32ad", "comment": "Malware payload (Mirai)", "value": "1ce331d5a5307d07436267165856ba9aa26f848431d9da06edcb03addffefe8ba1d8343ae8c1b6b1424ef4f8421257c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223633, "uuid": "3afafdb2-ec95-4425-a8c1-87ae8f24e57a", "value": "T1B3B30ACABC819B11D5D566BAFE0F518D33134B78E3FA7103DE149B2D278A86B0A3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223633, "uuid": "58c36e50-81b1-4bb7-b954-3f21213fb1ec", "value": "3072:rASHWBEsydZfEvsfFc6M92nvkrG0FhpNFzVUj2hBATAv:1d0GcOvkrG0FrNdVw2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223633, "uuid": "04cd30be-39e2-4258-a3bf-77a61c33c3df", "value": 111988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223633, "uuid": "24c02076-d071-4da1-9619-eca701b76a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223633, "uuid": "255dfcf4-104e-46a3-9318-25422828ab11", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81ed258-efc3-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768228406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228406, "uuid": "227c6fe4-dd14-4e63-be29-2fa72a8fbaca", "comment": "Malware payload (Vidar)", "value": "55b197ed70210dbdc9daf83acb21b85f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228406, "uuid": "25bff8c7-f840-4d58-95f9-b249a872ee25", "comment": "Malware payload (Vidar)", "value": "8e865d2d963d907fcf95533636b20215d783da14258fd1e5a9b3c16bb2692432", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228406, "uuid": "6c504437-f761-4c22-b318-10024cc05148", "comment": "Malware payload (Vidar)", "value": "13d6480b78105c0d2be7f41b0418b4e4d4c3c66e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768228406, "uuid": "5358f29c-1864-4acc-8ccd-f0cce64b4cd9", "comment": "Malware payload (Vidar)", "value": "aeaf47157849f5c87b21ffc584d6e62936b4767813cb4b3c789a67d81a9645d34a05edd1b27733402f97e3576fd0e020", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228406, "uuid": "482fc5e2-7ce6-4d8c-93e1-5ebb52a366fe", "value": "T12B856B8B78C0157DE5AAD33089A161913B70F85A1F2277C72A4172B93FB7AD04E39778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228406, "uuid": "16f9994d-3493-403c-8a10-c70db241f0ca", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228406, "uuid": "50f655a7-57ea-4066-8185-6679414e7f51", "value": "49152:RupUYZyPZSrb/TXvO90d7HjmAFd4A64nsfJXY01SARidYIfIdbGzRzk5xXu/oZXU:BZnY01SARidYIfIdbGzRzk5xXu/oZXbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768228406, "uuid": "66e34125-8ad0-4fe1-8588-443212dff326", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768228406, "uuid": "f813ea60-da02-42ea-ae45-4f25e82b1882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768228406, "uuid": "15c30cc4-0d1c-4358-bce1-7292932d95c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db94ab1d-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179100, "uuid": "1ced3d04-e485-4964-99dd-d68413783522", "comment": "Malware payload (Mirai)", "value": "46c85c5641bcd81c04c0ababb4cac052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179100, "uuid": "ef93930a-adc0-4cbb-abb4-9dfdd8314dd6", "comment": "Malware payload (Mirai)", "value": "8f0d530cc484a2bfa91a2b34dbaf50e57e5321e9804f284de55d416fd25e3587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179100, "uuid": "6b16a7eb-ded5-4ca1-b58a-b2add742ee76", "comment": "Malware payload (Mirai)", "value": "96fef54ddfc5be13f8a92a5fd37fb169547dd9b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179100, "uuid": "06288f50-29fb-495d-bdf0-b88c86150484", "comment": "Malware payload (Mirai)", "value": "277d02149dc5d91455bdf90559a5bf9ff1bfed5fefd4b04c9d934cfa4b1d9f92c60b8595aff8b39f64e532fe90459756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179100, "uuid": "b468816b-84b2-4295-870a-2401d642784f", "value": "T1F4933B4173544547F7AB0CB1283F7BF197AFD59021E0A286695EDB8B8272E32148AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179100, "uuid": "5e33aeb9-4667-4d85-bb63-fb7780f8fd8c", "value": "1536:C30qfbjiWdERkrLYIHiv2rk4RmJ0OYBzRiVgO5kshagaHFr4T2bVRf:C30qTZEv4RweRmz5XAeT2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179100, "uuid": "98672fd1-8132-4158-af61-74708909e790", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179100, "uuid": "dcdf82bc-055e-4d4d-b858-ab48dc4eaa1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179100, "uuid": "00a1176e-3bd5-4db9-b394-963215c1f93c", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97470de3-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229666, "uuid": "7f78abb6-0a96-4c84-acac-0df891bd5f65", "comment": "Malware payload (Mirai)", "value": "ace15bcef18871671c29e9a67041a501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229666, "uuid": "105d057d-7f4c-4d31-93dc-80c4307821e5", "comment": "Malware payload (Mirai)", "value": "8f5f2809ac78b555f023c8a7658f0140a888e24125be7aa4422739cd14fa561b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229666, "uuid": "db7eea83-4657-4262-9488-d4b7ab1bc178", "comment": "Malware payload (Mirai)", "value": "8771e59739b0d483bb2edde6b27dfdb370698a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229666, "uuid": "a95c302a-b730-4589-af3e-88542740106c", "comment": "Malware payload (Mirai)", "value": "722e803d96c90adc0c0b2a19fc239a5a9cf4e767635e7324211f5b1d6d01291189d95bda1d1b265078080a983de2fdb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229666, "uuid": "1479d7b1-7e97-41aa-b373-b69b63eca63b", "value": "T164D3124D3D4A10D7C362EAACB7E30B8B959C2CEA1C3E5282144752A777C83465B6E71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229666, "uuid": "b03de55b-7003-46e3-bbc7-7b1f12c9af65", "value": "3072:Q3hNsLXimHTX7F4rrI41Y5dIqqQ9HgTZJBuxy1GNv:I0LXJRoI4S+/2Hb41GNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229666, "uuid": "0d91a5d1-a342-441b-a30d-448a8a4c031d", "value": 132956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229666, "uuid": "ed3a0c58-f718-4d36-881e-c007fa1c45f2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229666, "uuid": "8e220736-8421-44e6-9981-571a145a3ad9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f992b1-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216717, "uuid": "4a800ec6-8639-43b1-8c00-22fdc0c343d2", "comment": "Malware payload (Gafgyt)", "value": "cdbd79dbdb100ddbef8cd60bbdad7a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216717, "uuid": "a37c766c-ca72-4ceb-a43c-83e21698c956", "comment": "Malware payload (Gafgyt)", "value": "8f63467913134275f64e621550fa5fdb9427c3a8a4560812dbe4a31d7f290497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216717, "uuid": "61757b37-1dbb-4612-b1e3-bd757ce3f25e", "comment": "Malware payload (Gafgyt)", "value": "f0897e230799b3a89377044e1b5fac59978575ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216717, "uuid": "fc2c93a0-2ba1-43d8-aad3-3d9d8ff9186d", "comment": "Malware payload (Gafgyt)", "value": "a8284827db7226362e422b863b8e5bc57cdba9a08e40a9c2e7096e4da34ab69465a2d32a9c108413442c0979d11d8c96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216717, "uuid": "b6e8ee57-f43c-4084-934f-9eae4834de6a", "value": "T121C32A05F5548367C3D327BAFB9E439C77362A6453DB33115938AFB41BC2B982E2A160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216717, "uuid": "3fc99882-a773-4711-9a0c-9bd85e10bee0", "value": "3072:OFztpWMt55uvy9OrFFwFukX93gCrwKcGrwd8fm4QnNJXS7E:6WSwvIJvX93guwKcGEom4QnNNS7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216717, "uuid": "7b367bfb-29f0-428c-b1e9-2cd66321fec0", "value": 124557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216717, "uuid": "f76c48f2-668b-488f-acac-e4eba8bec015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216717, "uuid": "c2b1be0b-38ee-43eb-846b-cd8bdc1e5fa7", "value": "p-p.c-.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422c5fa2-efd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234678, "uuid": "95db3f78-a81d-4164-8301-776df430ebfc", "comment": "Malware payload (Mirai)", "value": "311b0929f095fee95fa57045d3807746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234678, "uuid": "d05b30f9-8af1-4faf-9796-910b8a1448b4", "comment": "Malware payload (Mirai)", "value": "926b8850f747f2d9e1733d487b7a6fab5eb0c47922ac23467c6db60dde5ee937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234678, "uuid": "eb4aa78b-1d00-4a5d-a814-3e896952bcaa", "comment": "Malware payload (Mirai)", "value": "c62357838cb1b662fce3e19f9e5d7aac8d4e248f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234678, "uuid": "853adfba-bc4f-416a-9bbe-e8f21fe8d826", "comment": "Malware payload (Mirai)", "value": "d1c5c3554ff57a1400add3191d7ea95be09fc39e972ce4e5b6af6b8a14babdef489d8211c5e6582471ff281b25dbba40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234678, "uuid": "ed572d0b-2c86-4ca5-85a6-8e93f5d082f4", "value": "T108C45C59F8409F91CAC529B6F65D929C33070B79C3EAB20799245B343BD78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234678, "uuid": "93507c2e-ee48-402b-b2ef-a0f91628e118", "value": "6144:usP0dlHCnn5Xvxy+q2QpMFEQ1Isf8fv78oxonoeyV9Js6+b3LhgOgpZ/mCK:usGC5kImY7Us6+zfgpZ/mCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234678, "uuid": "74253312-e23e-4781-b2fa-dc352f8237c7", "value": 558468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234678, "uuid": "3c95907e-60a0-4a2b-b3d8-89e1611469b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234678, "uuid": "adf5fd53-b816-49b6-ac04-7a64113abff0", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334f9f61-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218761, "uuid": "55e4e4f1-9849-4350-a0ee-752b328fb05c", "comment": "Malware payload (Mirai)", "value": "702ec97f85b006684cfc561c224c048a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218761, "uuid": "00f28cc0-112b-43d2-8802-eb60af4720ac", "comment": "Malware payload (Mirai)", "value": "92a90530011ab157a946a16fee2c3760e86169f7986785e0dd0d42f95671f833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218761, "uuid": "1fb1f59e-8d0c-47a3-a233-30adef38008b", "comment": "Malware payload (Mirai)", "value": "5b78849c33828995561e302ac03bc027b8beeada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218761, "uuid": "2a7a7f52-8c0b-40f3-a66d-17c8f7bc1f7d", "comment": "Malware payload (Mirai)", "value": "8511b1dc3bd77334c696eebdb2176ef39bc43a5be8cb62ff908a316cc00a1b0afd0c4ab836a80d69aaac356953b02380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218761, "uuid": "0dcf18d1-5b0a-4fce-989d-92d1c15bc8d9", "value": "T1C8837DC5EAC3C8F5ED2209351272BB275AB2D03E2268EA83C3A5D975EC125C0F557B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218761, "uuid": "77cae588-7179-4fbe-ad9d-c9de28e2e38e", "value": "1536:pWOLMM5Md2joRye67qbqC3tAjw19KHVdxYQ5PB3:nLxMd2X7wqYti+9IYQFB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218761, "uuid": "cabd8cb7-c62c-4112-9964-91f31843cea8", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218761, "uuid": "4560628e-98ab-4542-a69d-10ea4b91e026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218761, "uuid": "19637127-3e86-415e-b1bd-12b2fdf10737", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe6fde9-efef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768247263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247263, "uuid": "46f5467e-d514-4f5e-8721-810a42f095a9", "comment": "Malware payload", "value": "98a453d816af4ea21a2915864d9d3545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247263, "uuid": "d3773536-359a-419a-a195-93400a9049de", "comment": "Malware payload", "value": "93780b78b373bf7496cb7a64846d89d68acc0d0d83789c8c49145d2199dbab00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247263, "uuid": "397a253d-de38-41b7-a46b-8b0818a1e649", "comment": "Malware payload", "value": "58c8813377bbf2ceaa78a69614d4d81ccc3047cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247263, "uuid": "7a76b547-fa5b-4645-8f26-60e2a3d55299", "comment": "Malware payload", "value": "5b2d3e1c2d98ec6e6cebbfc1afb5fe4f2e57a135f940c93b6d6211000d4af705c8b2af3c9eab5e710f987b1b00fc3e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247263, "uuid": "d1f50752-65af-49b7-84a6-02d803d36a36", "value": "T17BC42349589E93B7FE8D857CDBB50BC5FC2E51B0122C40EC0C79252C8AE7D97A15E8B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247263, "uuid": "51bd891a-ae5d-435e-928e-fabef141d68c", "value": "12288:aLmITlpPzLodbbF9N2lKseK+IKkqprTDmefhkBQY:aLmIzLYN9ElKKlKkqJPlhkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768247263, "uuid": "8cd8959e-cfd0-44f9-b540-9edaa219354f", "value": 574375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768247263, "uuid": "a3de160b-ed73-469c-9c76-d73db91ef34f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247263, "uuid": "b5aa100c-af28-4af0-bf10-dc97809d10c9", "value": "bizy.arm8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b1990b-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204570, "uuid": "f3a4cd6d-980e-49e0-89a6-ef401e0c60f1", "comment": "Malware payload (Mirai)", "value": "86d3eaea0711a6707ce7aa67158283e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204570, "uuid": "e7de46c4-a4a7-4971-8ea0-6375da8e4077", "comment": "Malware payload (Mirai)", "value": "93aeb42de9e8036f159b6684fbe07562439a1e65710e1ec73df5b7bc5513d2c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204570, "uuid": "8d16044f-f783-4040-8896-b0176c8a95d2", "comment": "Malware payload (Mirai)", "value": "fc8e575e582de2d15f8b4cdc08bb9d1cf2e2483c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204570, "uuid": "1140f152-a9ef-4bd6-9f90-889235fcee41", "comment": "Malware payload (Mirai)", "value": "4940abff79388908599f15ee9994c38013ab12c6cd9e069f76db8a5730d6611352a1b561895a292b134a2799004cfe83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204570, "uuid": "22ed3035-d22b-4cfe-8c6d-e65f46a9c016", "value": "T1866309CABC848B11D5D525B9FE0E254E33234B78E3FE7113CE185B2E678A8670A37915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204570, "uuid": "7d656904-5881-486f-a3d2-f16c01a63e3d", "value": "1536:T9n4ERuxJCc9t/H1RwDHEXBXLu7hwLlFudGsR4cESbqMkiHjY9VwDT:pRuxJDLVRKHEXBPuQejY9VwDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204570, "uuid": "eb81436f-c107-4bea-95b4-c4adb50fc5ec", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204570, "uuid": "2050970d-da29-4157-9ed2-a6dbaec225bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204570, "uuid": "de787b2a-9a60-4004-94b9-57693156619a", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b01a23-efe7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768243726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243726, "uuid": "8e78c5b2-bf0e-44d6-9938-db7f47821855", "comment": "Malware payload (Mirai)", "value": "3cc09e424264e67edc8320c18fe7fcad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243726, "uuid": "90b6c5b3-6e93-4dd2-9012-bea70d081a81", "comment": "Malware payload (Mirai)", "value": "93f922d3495ffb12da609219c3deecaa43fdf58dde5d7a1cc9fe376432c1426b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243726, "uuid": "58622c79-e1e0-4bab-8bfc-dea2fc9cb4d9", "comment": "Malware payload (Mirai)", "value": "a34371a6dfec1789c543d85e27db62d77edd6be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243726, "uuid": "79e98091-4b94-479f-ad90-464a03f47382", "comment": "Malware payload (Mirai)", "value": "52a7c31cc958e003831a66ae3964cab937aac0ef4f5f8de2823ebdeef21f8f6b8504a1a7fc787ea26b816de697efece8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243726, "uuid": "1bc1ea77-c6c8-431d-a723-a12ad32bfaf0", "value": "T114D33851B9829A27C5E523BBFA2E018D332563E4D2DF72178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243726, "uuid": "5b460657-d763-49cd-9a4d-8bbe463906c6", "value": "3072:cnFif7apx6XS+kUgpjWXEkSMQsWd5ZapzyQSX:cn8ZS+dQWXEkSNz5KeQSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768243726, "uuid": "7eaa396c-074b-4154-a8f2-54f905d4038f", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768243726, "uuid": "ae477420-8f2d-4afd-98a1-e1d54c38f425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243726, "uuid": "38a85aa9-1e97-4a45-bfbf-944144855257", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5535544-efa7-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1768216510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216510, "uuid": "f9946c14-405b-40e6-8c0b-b5b5e75b5946", "comment": "Malware payload (HijackLoader)", "value": "3428e376fc56f0ccdab410a7101c01a3", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216510, "uuid": "7acb08ff-9b98-4b8e-a7d1-699b044a36aa", "comment": "Malware payload (HijackLoader)", "value": "94307191dba3962e5dc121fa2a984a784a951af0c0fc9229571898667e320578", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216510, "uuid": "c4b07335-eb46-468c-b093-8b417ffde3a9", "comment": "Malware payload (HijackLoader)", "value": "e58dd9f45f78d5af0670784105e91db9dc79af81", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216510, "uuid": "10a6d11b-bc5b-48fa-ba9e-47cde8a61263", "comment": "Malware payload (HijackLoader)", "value": "a25cce0c747065d2f3b9fd517f1d6482c8209bd06c996aafaba6579661f27309d26ee04a6065f88a7f5bddd61544e370", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216510, "uuid": "bed139a0-4c1c-42f9-8ab1-07f5af89c947", "value": "T1FD1633812DBE4AA3E71A28781019E3C903DAFFE57F9AF28E218637014CFC759257556C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216510, "uuid": "ce2b761b-5558-445c-b63c-124a19954352", "value": "98304:j43ukWzGl/ZrKPpE7x0SCGIMYQOSemKSLKGA:UtxZ/IMYQOSJ+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216510, "uuid": "1acc702a-72f0-4b3d-91f7-7fe7e989593c", "value": 4136960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216510, "uuid": "2cda9f2b-0a87-4af7-9e56-1549a13b3a6a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216510, "uuid": "9ae767e4-4896-4e44-a2cf-8caf1e79f449", "value": "KeePass_2.60_x86_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf470b60-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180771, "uuid": "c22384f3-e6a4-4895-bcb0-28ec27d716d8", "comment": "Malware payload (Mirai)", "value": "d7095bd0a2304bc81da429a279a1df84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180771, "uuid": "146d1b97-67bc-4138-9cd2-550952dba04b", "comment": "Malware payload (Mirai)", "value": "94839661c1f24c293902eb3abe210f90eb4161553557bf7310d2cc4fbe810888", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180771, "uuid": "84e6c354-1aa0-472a-812a-28e6ab7b8f78", "comment": "Malware payload (Mirai)", "value": "89c8bc4a73264e3ae84b14ea724c90e7c3bb074a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180771, "uuid": "e4925676-5c5d-469c-a1c8-1a820f9ba87e", "comment": "Malware payload (Mirai)", "value": "ac03879cc819304e66a4e6516a59c373ab083ce41dffeca01041be2d93efcfac8c491508a09fef06362673379b9e2e85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180771, "uuid": "0095dcbd-e028-4ffe-accf-28f0fd8e5c26", "value": "T110931A86BCC5C612C6E0B1B6BB0F52DD371643B8E3E6B1078D1DAB19674B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180771, "uuid": "88dd1783-dd16-4005-8462-de59d5c84704", "value": "1536:A0rgfGMvwc/My67LTnxmd/C3A6TfZYSF62t/BctpxSWgXT2bVR:AEg+MvP/UVmd/+A6Tf7F6o/BctfS7XT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180771, "uuid": "9d567031-d87c-4913-adc4-0ce5d62fb5da", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180771, "uuid": "cdfff4e2-6190-4bb9-aef1-0a5d94023684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180771, "uuid": "42358f9a-6ccd-408f-af01-e527868454a7", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7a8f8e-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179639, "uuid": "a7c79b6e-e791-4ed7-9d00-b48bc19e2b48", "comment": "Malware payload (Mirai)", "value": "6455fc66cedb35e32d490c268ecc0747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179639, "uuid": "1be12a73-7f1f-4d8c-a696-baf675af7842", "comment": "Malware payload (Mirai)", "value": "9543848a6b5e7fad7a6466408569775cbfd97253c0efd6b118244a3dfc66faaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179639, "uuid": "ef75289f-2aa2-4b43-9608-3022218dce4f", "comment": "Malware payload (Mirai)", "value": "b722117dc71499149d707059bf9598ab1a156690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179639, "uuid": "21cb5088-45e6-4e83-a641-59f997477b30", "comment": "Malware payload (Mirai)", "value": "ff2b4d53d7291cedb1a1a50053a8b7fd9de0331b1136f33f839cb743c38c77ff91272e3fe7f9b82de5234a1781480022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179639, "uuid": "9a4362a7-1a8c-472a-87ec-c8a232a0c1f5", "value": "T1D6931A86BCC5C612C6E0A1B6BB0F52DD371643B8E3E6B1079D18AF19774B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179639, "uuid": "1f1c1225-37a4-49ad-a118-ae42315bafbe", "value": "1536:HlnddK2xw3yxjf9cAxybxIoQ+w/xO+BA3yQ9/zvFT2bVR:HlnddKowcfybHQ+kO+BA3pDFT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179639, "uuid": "0c3936c6-c909-4cc1-8935-9ae997cec222", "value": 97040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179639, "uuid": "2d2c141c-7981-4a23-8b87-f4a08c9a1a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179639, "uuid": "f4afecb9-5d08-4171-b59f-9c1d6ef8b661", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a85530-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204781, "uuid": "2b97aa1e-d731-445c-9508-cacfb4dc9aa3", "comment": "Malware payload (Mirai)", "value": "04b824e65b925ac50316757b45d3569e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204781, "uuid": "8df15e2d-9cac-43a8-b71c-6a18cd09c992", "comment": "Malware payload (Mirai)", "value": "962cbb6bfaa652a5abab1d8874ad1eb53cab9e964303b5775752fefafd9984a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204781, "uuid": "4cb93dfd-23a9-4b44-b2dc-a6e1c4cb304b", "comment": "Malware payload (Mirai)", "value": "cffd66a647334c6fab3b7e74c2a519898f9ab54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204781, "uuid": "45b1def1-1ac4-4fbd-9a29-f72b28829791", "comment": "Malware payload (Mirai)", "value": "c33e7393535ba2312b7a4199d2e0b6b504a2b62a76106d866d18d4c2e8cae0c9c741d3ddce5017f790dd8bb17476d51a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204781, "uuid": "455110ee-65c7-4efb-8176-bb069e3322a5", "value": "T1FB931A86BCC5C612C6E0A1B6BB0F52DD371743B8E3E6B1079D18AB19374B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204781, "uuid": "706114ac-9ad4-42af-b589-255f25e2ddc7", "value": "1536:dSOvJQULQyu5GW4xiCoIQ+wldQ2tLEuGiX+W/Iv9T2bVR:dSOvJLLvliCBQ+WQgQuju9T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204781, "uuid": "81035149-4938-42c6-98c8-ae52006b9744", "value": 97072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204781, "uuid": "7e3d1d37-1b9d-46ba-86f4-0f8b581aa9b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204781, "uuid": "b99b6dde-593e-4660-b257-79d7f8974f4c", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f37965-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223279, "uuid": "52dbca5e-de6a-47a1-ad06-4ebc7316b882", "comment": "Malware payload (Mirai)", "value": "4bff0b8fa99073d4fded28c72007d51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223279, "uuid": "9a1d4ee8-da1a-4288-bb06-a9a16c99768e", "comment": "Malware payload (Mirai)", "value": "962cfbad99a313cfa0989ce638f9f4473404e439f41302c269e2abf4962d33cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223279, "uuid": "87991008-00bc-4066-abce-9bd87c71f698", "comment": "Malware payload (Mirai)", "value": "c5374a4f07b0ae1ecc7b0ef97908631d5eda87ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223279, "uuid": "0c54b242-1f62-4051-9cb5-e8db22243f6f", "comment": "Malware payload (Mirai)", "value": "899403c2e1f5f4d0177bd2dce746277c629a41ff3529062d2e35054e9abf47997edb43740e184e8c290404a4ee5c8449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223279, "uuid": "9eed6c4a-af59-4545-a4eb-a0b949a65aa6", "value": "T1276307CABCC4C602C5F060B6BB0F618E376643B8E3E2B157DD19AB19670F8670A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223279, "uuid": "61ebcfdd-5466-4d0d-87ad-39b333459063", "value": "768:GsHr53zoZxWzN3DR26SNBuSS1qpuW18gSRcO+rl8F+Rz++9ndbjx4stBzBrthifz:bJhS6IWqAXapQpfSY+n4AZg+ocFPCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223279, "uuid": "8e693a07-97b1-4f0f-86bf-6899c45e5119", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223279, "uuid": "1434d76b-8e3b-410d-abbb-8888df07d624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223279, "uuid": "f3bab7fd-91d1-4980-ada7-2448654d72cd", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2751dfb2-ef7b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768197266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197266, "uuid": "ba2ebb2c-1abd-4f2f-b3ab-7cecf3ff85f1", "comment": "Malware payload (AsyncRAT)", "value": "adb98586adfa2ce8451babb0970acda3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197266, "uuid": "ec7fb222-14ea-4b0e-8315-95f60192c3b8", "comment": "Malware payload (AsyncRAT)", "value": "9633c76bfcfd0b4cdf45a3a051f7c47958fa461abcffc9ceb02b65c805d02d50", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197266, "uuid": "00d2b9ef-08fe-448e-9f27-dfc50758df71", "comment": "Malware payload (AsyncRAT)", "value": "c75968fe7ecc64756f900972828754b14977eb82", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768197266, "uuid": "47fffed8-1155-4122-adbd-d7e3f864cd1f", "comment": "Malware payload (AsyncRAT)", "value": "cf2f47b827802dc6718c26fb0c769ac6b99ffacccd09066dcc562345e49cd3c5b24494e0fa438d2f6b6fb88794db4732", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197266, "uuid": "3e01b6a6-a1db-4837-a7ab-ac0f59968cb1", "value": "T110C21B0473F48262D1ED4BBE48329600D375E68B5D53DB9F6EC495AD2A337CD8A20BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197266, "uuid": "01ca3903-a772-4dc4-8542-3483ed03663c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197266, "uuid": "aa55ce1a-9192-4547-a374-54fc911a5c3e", "value": "384:JQ4K4Rt1zgeLsQk5wMymrJhxYHqqbuUsJQxnCJf+BWfXWD/Pu+:JQlst1ERQkSMyCJhx+FbHBFBfu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768197266, "uuid": "b6f31d3f-382a-4014-a533-1991f59a91ea", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768197266, "uuid": "948f8704-ce30-4c47-af1e-e0995e54d13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768197266, "uuid": "769cd493-9142-4bc3-9f82-071614f903c7", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7418ee78-ef55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768181074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181074, "uuid": "edbc037e-f744-44ae-bd4f-2d4dbe25171a", "comment": "Malware payload", "value": "0af46cec6e156542fc0d154945060631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181074, "uuid": "f339bb1c-1db0-46fc-80e2-798a58686b37", "comment": "Malware payload", "value": "968521cfb36aed34e85ff61bd158ee22fdc1dc6e22b86fb0d0ebacdbdc7b194c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181074, "uuid": "dd8a5543-1354-43e3-b395-63a940ba5c42", "comment": "Malware payload", "value": "c5687758691b93e3a3ef7b8d8460a75c5a5bcd47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181074, "uuid": "36a6a302-ba10-4130-9685-cbdbad2ff99a", "comment": "Malware payload", "value": "594f5cf1b4292a18f7058040647691f98dec5f953909bf3ed263a07d26c80333a4f0a26a1e370570b5de2971a279f1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181074, "uuid": "0e73309d-7fd5-4d0e-b154-2b5346fe6b17", "value": "T17D16333D5610AD3533D34B6BC7EA182D936A53B936060D00373B06E8B6E95B7D36398B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181074, "uuid": "e835fc5e-10e2-4392-b2e5-e49640e3f830", "value": "98304:ARGGAqdjlZEPUzY+GEAC9HMXfJo6Lj3yQgQT:gGGJugY+GgsG6X3yQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181074, "uuid": "2368bc31-8acc-49d2-a578-93a31c05ac3e", "value": 4108312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181074, "uuid": "5da15596-24d8-4ee1-8959-2347ef2236c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181074, "uuid": "29389d96-c3d1-4b6a-aa11-ea7712ee06aa", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308ea66d-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226488, "uuid": "7207207d-9b3b-49f2-9e1e-319d11429dc5", "comment": "Malware payload (Mirai)", "value": "976b0d903c551699bcbc9ef6e3072d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226488, "uuid": "009bd86e-7f9a-418c-89ad-acee32349f72", "comment": "Malware payload (Mirai)", "value": "96d5da954ef0f2a57054abd4845d9a133d10b228a2445258650fab1199f8ca1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226488, "uuid": "842cedad-e2ee-482d-a31e-2d47047a564a", "comment": "Malware payload (Mirai)", "value": "9256201441e84ee9e5e705bbc0eccff4dc72b67c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226488, "uuid": "c30ed730-dee2-4c40-8c41-b56d48ee705d", "comment": "Malware payload (Mirai)", "value": "7c6367f7493275c815ff5a098bcd87127795e21e13878f1638574d7b5936e9a8887f7af517417e5c14615b5a78adc09c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226488, "uuid": "322e9a3e-6346-4f4d-afbb-8aa0a895af08", "value": "T19E83E7C9BC848B10D5D526BAFE0E618D33539B78E3FA7113DE185B2E638AC5B0A37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226488, "uuid": "24bf3814-2e0c-4750-be03-3972a2954fd9", "value": "1536:/WdnGIRKvhN2KLctVmDXHNEyMYfcFKs/HJg4JViszT92v2lsfiIL/Z7PTMQ:/WKv/dQtoDXHNEyNfGKwa4JViszTyFL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226488, "uuid": "36e137d2-f29c-4757-99f8-f700a4cfbcaa", "value": 87412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226488, "uuid": "f84cdd44-4b17-4905-b790-fd78e41fd5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226488, "uuid": "ad8bbd21-1171-4921-b04e-1207bbca13fd", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4860800f-ef7f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768199040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199040, "uuid": "46121964-52c7-41c0-bf77-8de407d3722f", "comment": "Malware payload (Mirai)", "value": "2bb97460902c6d08b7f80c9202e6c042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199040, "uuid": "c46e1db4-3442-41e2-873d-4dc3220fd959", "comment": "Malware payload (Mirai)", "value": "98a4037e6453fd8b6348792e7b21df75ab23231b9e61d603a379d36fd0e00080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199040, "uuid": "a7365beb-0ce0-438e-b7fa-80e51aafd5c0", "comment": "Malware payload (Mirai)", "value": "ad679abecb3f8fc1c0b46953f0c148b66cecaa5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199040, "uuid": "5a80fe5d-b0a4-4456-b04d-3ad71211a750", "comment": "Malware payload (Mirai)", "value": "4dc71d2d21cb3e1d5705df6bd0e5eb6cbc0fbf8e5a9301278c88ea53e975cf7469bcf255025972e7104eb6544ae852d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199040, "uuid": "2f11bbdc-8ac6-42b8-a8ba-b16443bea939", "value": "T1DF732802B59284FED056C9B44A9FC667FA317C6522143A6F7784BB343E32F316B4D622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199040, "uuid": "e79c3f1b-6873-40e0-93e2-48a8aea3e41c", "value": "1536:2qpZIgROeeGWI4sl2B2ROreHOOEnorNQ:vZiTN2Me6QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768199040, "uuid": "68d4e7d3-2610-4a25-aa36-51dbe35fd290", "value": 79824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768199040, "uuid": "4fd7f16f-7213-487b-9510-03fff45c6339", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199040, "uuid": "26543179-d893-4e65-8ef3-0952b97792e4", "value": "SecuriteInfo.com.Linux.Mirai.9724.12126.23647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9480c281-efd4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768235675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235675, "uuid": "c172db45-4403-45db-b2a6-2eb545fb780d", "comment": "Malware payload (AsyncRAT)", "value": "fa86baa8fab965f7f6da6d034588cbf9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235675, "uuid": "ee307e0b-902e-4cd4-9f2a-86df7b8545dc", "comment": "Malware payload (AsyncRAT)", "value": "990efe0fc1a620150945117317430a7965f760935c71b1537e73cf210eecfef8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235675, "uuid": "8f92d9d3-a6e7-442e-b846-e39bba0e77de", "comment": "Malware payload (AsyncRAT)", "value": "17b267c3367de1ffb032d3f17f331d5b449feee5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235675, "uuid": "2b67a8a7-a459-43ec-a03f-faee89f12c2a", "comment": "Malware payload (AsyncRAT)", "value": "ee10e1585f1c6bc25aff28a2c820d5e792e7fe56ff50019003844067b9084921cd333b8fdfa54ab08762ff55c3083d72", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235675, "uuid": "6d5f276b-e455-43a1-95cc-0b1ec59af6b3", "value": "T113736C002798C965E2BD8AB4ADF2960146B5D5732102DB5EBCC404DF6B9FFC64A132FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235675, "uuid": "9a74d3c5-a990-4cc9-89cc-f2266a00c9c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235675, "uuid": "f95e65a9-9653-495d-b545-e7f4aa603243", "value": "1536:v9gHhkwLZRWq1GbbFwYiGkNDyZGBh70kIfeVclN:vShkwFEKGbbF3iGkNDy2h7MEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768235675, "uuid": "20c25ac7-abaa-440b-8a86-420a1a13f123", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768235675, "uuid": "8c718025-108c-4079-8ca6-f9678697d21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235675, "uuid": "cec8ec0f-8ef5-4395-8cb8-0e008c6780c5", "value": "TelegramDesktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136ea32f-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180483, "uuid": "a2aa9648-5f8b-438d-9372-2e73cce872b6", "comment": "Malware payload (Mirai)", "value": "9114268efc93d21795c593aa4773ca27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180483, "uuid": "6a2d4b5f-d7f2-4241-bf59-ed8b07c784ad", "comment": "Malware payload (Mirai)", "value": "99fac41bdf2285f0e7864e706fb325f553a353a1a7368adc9015a3224417aad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180483, "uuid": "727496e9-619c-4bf2-ae53-4b4f3fcb107e", "comment": "Malware payload (Mirai)", "value": "6e667c7ad7cdbda42af6d878fda693d3cd38f44d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180483, "uuid": "e14b5b06-f5c9-4472-a7a0-77f48a9c78ce", "comment": "Malware payload (Mirai)", "value": "1089cb6d895513e8d1a92b0873f71a53c6a429837c7dba3d0f949e02c5b032f948ed4bb470902a66126babbae902264b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180483, "uuid": "fea3b6be-8479-4ba5-8a35-9329d4e8b672", "value": "T1BA334AC59A83D4FBEC5D057118B7E3321672E53710B8EB82E7A4D931B82E106F646B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180483, "uuid": "e48d83f5-886d-475c-b119-096634aaa6c8", "value": "768:ONFDKb/dY+IhB8SUC8xVYSv/z+9M+0AqeTPGgYmcbJvj9xP+nicXRR:uFDKb/6+IhB5WYYQqeb3YmcbRP/cXRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180483, "uuid": "c1047b7f-8e2e-407c-9c9e-5e5f7125ca48", "value": 54512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180483, "uuid": "065f3520-65b3-4fe3-8d36-fbd90dcedcfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180483, "uuid": "0b34c25e-f33f-42ba-a5d2-3771dbd82c78", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e474a3-efd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234679, "uuid": "8581c012-ecb4-404b-a70e-73aaeea9308f", "comment": "Malware payload (Mirai)", "value": "676303525a92fcda17b815a735991533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234679, "uuid": "b2841172-0bb4-4156-8205-bce33f452c85", "comment": "Malware payload (Mirai)", "value": "9a36e170952fc2a5e199d18c7c5ff91c7d272eaf00a93f7e4085895933b42b0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234679, "uuid": "c131cc31-b8da-4be7-833a-0d31bb61420b", "comment": "Malware payload (Mirai)", "value": "02d49252c2b2695f4c8960b27ea2eb21da569886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234679, "uuid": "023a2175-e0ed-4b54-a199-e1c9de39d2ab", "comment": "Malware payload (Mirai)", "value": "93a75fe35cd176d978e8814d2a97ac518fda1d0b6840438e33ade868b15c0f4117ac963ccf7432bf2888435050898ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234679, "uuid": "47bddc7e-33f1-46f5-ba70-282f8a95b08f", "value": "T1A40429D7F800DDBAF80AE33748530905B630B7E604929B337267756BEC3A1991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234679, "uuid": "282beb18-babb-42dc-8d5d-22dcf0b9daf2", "value": "3072:q6cnuTAOZ8aoG5/LJcBw5Yt+Apy0jfdVNjbiOLLLEIyaeAyuh/F5QC9/:JKB+Y55jf/LvEIya0qQCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234679, "uuid": "1d12a065-fb95-436d-9afe-a39c46e3fec3", "value": 173312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234679, "uuid": "57e35e51-2c40-42fb-b121-ddf9ae18abdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234679, "uuid": "832f544d-2601-47b6-ac9e-e62154329c61", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f44f1ed-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218701, "uuid": "8fdb6bdd-5627-4cb4-838e-cc0dc891a354", "comment": "Malware payload (Mirai)", "value": "23bcda3564bc2adba4713f6ada1ea2a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218701, "uuid": "09163308-8fa2-402f-9e94-f9a4b2aa52a7", "comment": "Malware payload (Mirai)", "value": "9a5b41814e1a4caf5c42ae7622316ed49dc10060ab189f68fa33ef4ac459abe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218701, "uuid": "9520d69a-63bf-455f-911f-3f5283a701d4", "comment": "Malware payload (Mirai)", "value": "aa70b36f5ea73521d8c6cc59254fac2649df7d00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218701, "uuid": "f77659cd-0fe8-4861-bb7a-ffdad082fdb5", "comment": "Malware payload (Mirai)", "value": "0d43a7147564e3e343af56328ba079678100043379a5a9f38b308a08c34ddbd8f89f1c9578247caba7277fb9ea043008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218701, "uuid": "77c065fc-2601-4da7-814b-e09717c434d0", "value": "T16B13F1613A6F6D30E874D5B0F768C1912A8321F1D3EE20367614A5A5409AE4B3BFE58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218701, "uuid": "51bc9dad-8467-4ef2-acac-1fd10b469d9c", "value": "768:+t7bV6m0zw86qK9JGRgbUzrskZYIHZke+CkFWjq9yLE/9S2m2J4CJEs3Uozs:+T30N6/JGNz38P/WqYElSI4CJhzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218701, "uuid": "db23f507-385e-4036-973c-c21a203ccf83", "value": 41628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218701, "uuid": "5ba05772-1066-4d00-bdc5-080bfa82e4c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218701, "uuid": "8d64b9e8-a57b-4e64-8959-427951423310", "value": "johen.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7701fc-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212015, "uuid": "2e8c4e19-e5be-4223-9738-0516bdf0aeba", "comment": "Malware payload", "value": "3d49bddb95676f9b121c6682e49bf63d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212015, "uuid": "1b990f84-d2b6-4f83-9405-8207d7c0b5b9", "comment": "Malware payload", "value": "9c65de316028883dac9c2188cc6952ca4ced3d264f41d445849672af1991350a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212015, "uuid": "2b54cd73-df8e-4a28-be09-f6c2f2976808", "comment": "Malware payload", "value": "63ae65f555a12c8b82b77e1e4820a24df1bb20f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212015, "uuid": "85d8374e-4678-41c9-884d-969d580844d1", "comment": "Malware payload", "value": "d71012dcbb1dada0d1cfeb21f10a9fc32e4941fedc0effa8efe83cb762b8f8bfd8f6e62975db9dd202d7127c5748ec30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212015, "uuid": "33ad4d7f-583c-4e16-919d-2473667ce547", "value": "T1810523E67DBA0D3FBEDC8CD7453514CB88D4B971FE5250B47A44A82C1C18E44AB2AA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212015, "uuid": "609d880c-a429-4858-af21-ee4c93e31fd3", "value": "24576:I2hNpD1n23wNvUlRxwwpnquAraiTSVAIOHobULFZi:LbnjclRxwJWgpU4Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212015, "uuid": "fa869e7e-6e00-48b8-a97a-7d2bbdc2cb3f", "value": 829764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212015, "uuid": "a7a2c2a8-a076-48c1-bcb4-50668459063b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212015, "uuid": "408b4914-973b-4b73-bc95-4ebf079dbbe8", "value": "client.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ff75a4-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768246259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246259, "uuid": "02063c02-8527-49eb-bdac-48c459676633", "comment": "Malware payload (Mirai)", "value": "0a1b0aa5a1c076a84eb58efb60380331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246259, "uuid": "de64a1c8-f201-4ff4-8d1f-2c0bf919b1db", "comment": "Malware payload (Mirai)", "value": "9c9a40d96c3dcca7ced7ce23145f3571e97ec07d9bf016000ac7c7128473aaf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246259, "uuid": "ea5f2e70-5199-46e8-a057-ec0a9829a35d", "comment": "Malware payload (Mirai)", "value": "8334bfe14215068de26389b8c6f295058d8183c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246259, "uuid": "77675a46-e65b-4380-bbfc-7769494b5d39", "comment": "Malware payload (Mirai)", "value": "22a141d85dd4d3b332951c330656f444b1049566ea7cc1cfda71685c7d1825ed71c35f72a783e88a73612e7f8bc3a499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246259, "uuid": "526ecc9e-efa4-44ce-ab65-a864c7d75ae1", "value": "T1E7F47D63B7318F94E365D67005F386155AA822A70AF380C1937DC6147A60BAE2C5FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246259, "uuid": "10ffde34-aa64-42eb-856d-b7d3d7c20e4f", "value": "12288:1JhVym9KrNx1u5XPr3SWgOesEgpZYdLsK6:1J7ymsrTqr3Sbl7lsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246259, "uuid": "572a5e3f-873b-4354-8070-67e07fdca8bc", "value": 731944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246259, "uuid": "b893d73e-3c9a-4f8b-8442-38186989707e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246259, "uuid": "e4439629-bfdc-4370-9941-bab3b8793527", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cb9f07-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218764, "uuid": "62827c41-7f10-4423-800b-470a81432b01", "comment": "Malware payload (Mirai)", "value": "3dcaaf28a41b0cb5b50c07996113e73b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218764, "uuid": "fb59ce3e-b1dc-40ec-a50e-0077db00cd83", "comment": "Malware payload (Mirai)", "value": "9ca3eac9866e0c3d0803caa4a3199b4eea98d54436653ce0727a78b67cba8f5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218764, "uuid": "49f04bc9-dc65-458a-a400-85bcd604fca1", "comment": "Malware payload (Mirai)", "value": "3712927ac34f156c1551f274a718def1f4c90860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218764, "uuid": "eefbf638-24dd-47f6-8f04-a31ad3605d4e", "comment": "Malware payload (Mirai)", "value": "151831cce28c83ad39043c6533a21bc52bc22e33f24e2570810f84db316ae22f1c0cdbd862f9a7302d650bbdbf63e46e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218764, "uuid": "46775da9-ceb5-4935-a010-0df935fc10d0", "value": "T1B1B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218764, "uuid": "df74303d-0a83-4d7d-9244-e143255b07b9", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4datc9BWZ6nak7+TeVedVPneQBZN01Y6L:gni50poFEa69BWO7+Te0dVPZ01Y6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218764, "uuid": "28d8632a-d705-4cdc-9468-4c1653b8a752", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218764, "uuid": "f8e7024a-cd75-404e-9482-23b323864e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218764, "uuid": "d0372d31-ddb1-4c1a-a7ac-17ec40e04058", "value": "johen.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847f8c17-efe3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768242090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242090, "uuid": "983d015b-2d61-4fac-b1e1-0b4c1e3428b2", "comment": "Malware payload (Mirai)", "value": "1143f762df3c479862b706d65a7f4a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242090, "uuid": "15c8a975-bd93-4eec-8f41-fcedcedd787a", "comment": "Malware payload (Mirai)", "value": "9d58f973f2a04cbd470862a2d663be1cc543ddb7903328196f63a81c5d0875ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242090, "uuid": "76432578-d931-4fe5-ae52-c2f7e44110d7", "comment": "Malware payload (Mirai)", "value": "91d967081a6dd8f2ab8f7f3dcb627b427fb23a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242090, "uuid": "e178fc03-cfbb-4d72-82a4-6aecb4a3d018", "comment": "Malware payload (Mirai)", "value": "504ebbc49d693bce3069ec53ad7508413c86a9e0b9f529fe81ebe880ba80c9038fb7d62a5aed4db43d0aa017bbbfc848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242090, "uuid": "da9824d2-4947-44f7-b70d-1805be27544e", "value": "T169F32B06B31C0947D1672EF03A3F2BE1E3EF9A9121E0F641751FAA8991B1D360686DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242090, "uuid": "cef5fa3c-0db6-49fc-a50c-0d1c351634ff", "value": "1536:vkDs4zhsuXVZuvlSbxObC3kXUQseGGvonUknVHE/Zq0LqXwRRAdAWfCIgkqPqHnr:8D5bNxRUXUQsVmy7+L6hh1pw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768242090, "uuid": "3dc85ec7-e6d8-4a00-9614-5093d6544c20", "value": 161988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768242090, "uuid": "806df28b-4732-4c9a-bbb3-1e7bd6c36139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242090, "uuid": "faa02bda-4d18-4f26-9495-4fc58b8501ee", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4f48c2-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768206344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206344, "uuid": "402e6313-e657-40dd-b386-93459c49ff23", "comment": "Malware payload", "value": "92a2eb113fb08b48275b67df7940b49b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206344, "uuid": "dca9b5f2-88e0-4221-b06b-d6be314afaec", "comment": "Malware payload", "value": "9d8b9090972ec013f3ad0236f5210bd70fe4ba87402fdefeac399cf11dba2efe", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206344, "uuid": "90743c6a-d902-4b69-b8b4-b4ca94f8d962", "comment": "Malware payload", "value": "96d4a3f100c3f620a4f6093d981d871269e49938", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206344, "uuid": "d3a96c6e-89bc-47cc-a3dd-4ff403e9006f", "comment": "Malware payload", "value": "8d51113523d31483f1e3d20cc82ca86ef1a5d970fcd3ffa50cb8c782cd10e94d78eed48c72cb5eefc01665f734da789e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206344, "uuid": "67d73bd1-fc7a-4c07-a75b-945bb1548b58", "value": "T11356E1611E9E6B08F1F761B397404AA6D42FF3781444A8ED70A0DECBB5CFB9661093B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206344, "uuid": "e1eb9091-5df3-4a9a-a3fa-221fe57da6a5", "value": "98304:fokgP52/Zp+6kiTWOgeurUQtd6MApD27RQGhq316YNBr:fCwbkiToDD6W1atr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206344, "uuid": "c67c9c6e-cf58-48aa-b393-e46a512de095", "value": 6313728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206344, "uuid": "3f58b372-7fbd-451e-8eac-b6cfcf727f0a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206344, "uuid": "6827dead-d1ef-4823-9a17-0783b196b1e8", "value": "Google Chrome Docs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec977ae-ef91-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206808, "uuid": "c914d9b7-b927-4f43-ae5b-94aab925333a", "comment": "Malware payload (Mirai)", "value": "7f466c0e173a3014cffb6c8e3c20668a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206808, "uuid": "b9eae18c-3b82-41cc-89c7-69be7353c8ea", "comment": "Malware payload (Mirai)", "value": "9db9f149f7fffb938ba90d4eac73700841a6df7f2855b168e06ea85f1701611e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206808, "uuid": "af19587e-2c76-45a2-820c-ab6a593d1499", "comment": "Malware payload (Mirai)", "value": "120d03f6d569b42cb7b797549ee935f84f0c3fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206808, "uuid": "d4a342b5-2ca0-4282-9a3a-3af204d64f1b", "comment": "Malware payload (Mirai)", "value": "08361a675e12708c1901c6b3edb951fe90ab55d738be3917d9bde6a7bab317386264eda36c3fd763b86c2d3510f5a17b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206808, "uuid": "a1014986-e476-4daa-bcf2-1fe7e67128f5", "value": "T1B4B3F90ABFB11EFBE8AEDE33456A4709389D450621B93B7A3974D80CF21A18F45D7C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206808, "uuid": "ec087064-f9c2-45c6-b6df-833805c9a046", "value": "1536:ivR8ERD2s9JgYP+LOqZSP0mrvJYCf4NJccXavEHNW9krJis1MIY+Uj6UQM0RN8VZ:i58ENJgYPSOeMV+fst+guO2TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206808, "uuid": "2b341458-ed1d-40c4-9591-4d3947b7ce37", "value": 113384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206808, "uuid": "2b3efc30-8e97-420b-b33c-53a7fa97c66a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206808, "uuid": "9a0a7150-1aa7-4c08-ab76-ce559ee0d8fa", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cc3d68-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230520, "uuid": "acca0639-50cf-4ffe-a464-3151d7de1a6c", "comment": "Malware payload (Mirai)", "value": "ced041e1f53ddf52000defd47401a218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230520, "uuid": "bf09e22a-3a63-4991-8487-f30864eef823", "comment": "Malware payload (Mirai)", "value": "9e6ff7589882cd157b40656e1cdac28b7317f3082292b1c0aea09fa59da95d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230520, "uuid": "7edbe1c3-4337-43e6-88e0-344c49333503", "comment": "Malware payload (Mirai)", "value": "b50f232a6b86b0593c654fdee16bb20e39a661af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230520, "uuid": "8b008468-0d9e-4db0-890b-a8bccabfded1", "comment": "Malware payload (Mirai)", "value": "30c60c58f4ee3791183b3cb3d3c8c3ba07e78f0c5c96e3ac75bbf463d999fe8abe98dfc97c227344a0ea213c5d8db942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230520, "uuid": "2d68f5d6-0354-4ae1-bcda-1d6c687d89b5", "value": "T101D312AE172F457DFC152C30654BBA255092D14ECE98338FC61ACF916A5F583C284AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230520, "uuid": "be6ce6c9-d435-4433-8f9f-299fcbd9bef7", "value": "3072:r3qa/tUQl5TJteFYYwOW7icEQnuwTKEDHN7vuaaYEBqdIG:r6Ytx7TJIFYavcSEFx7WBVqdIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230520, "uuid": "37eb3995-477e-40c5-9a30-cbaf981667a6", "value": 134188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230520, "uuid": "195f5470-02f8-408b-baf9-7d585fd69114", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230520, "uuid": "ed191df2-9311-4a05-93f3-a805910a332f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c109b6a0-efa2-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1768214275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214275, "uuid": "0dc4be7d-5716-43f2-ace7-16925eb51180", "comment": "Malware payload (SantaStealer)", "value": "5a677fc9dfe8659864f00f9e855d9e7c", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214275, "uuid": "8e84f6e0-2024-44f2-85d3-7784ed0f47dc", "comment": "Malware payload (SantaStealer)", "value": "9ee175475b0dfafc0a5467dfaa1c7df3a33c5508ee6f7fa6e7e8230e5eac9c02", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214275, "uuid": "8548abea-a6be-499b-a7b4-6af772954dd8", "comment": "Malware payload (SantaStealer)", "value": "8635c3d6912bf40a8a21c0cfa583b67b72f2ea8c", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214275, "uuid": "a3d02dc6-28a3-4c1e-b936-1edd7523b77e", "comment": "Malware payload (SantaStealer)", "value": "90ae7e7427878ceacb39503311eadde68595c81a62e2998e55171ae044844f529d4a02138bed72960e5a673f49ad81b8", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214275, "uuid": "77b3c706-cfdf-4484-97d1-bfe239c710aa", "value": "T12A66C0CAD16B40D6CC067FF598142BC39B3096324A340468367BBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214275, "uuid": "07394dfa-789c-4d18-805d-68a8de9f6d65", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214275, "uuid": "43830be0-149e-4599-a347-d29130034863", "value": "24576:iJcXmr7y3fre/AZBJ4c9+XlkM+FeiRNKdLMM12nHProzFUMnxXvyq0Sze6Jcr+BB:WBLpsNEs060kYoH14Npvoo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214275, "uuid": "4541531d-115f-4ec6-a12b-6e8770d01a93", "value": 7082496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214275, "uuid": "e876aa71-971c-4576-b5f4-2a0f7d8c7254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214275, "uuid": "0918f51d-54d5-4271-997d-e69e64f7956c", "value": "2U71QC5443AR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efae30f-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179375, "uuid": "6e374fd9-02ae-4fca-81fc-262ebc66fb14", "comment": "Malware payload (Mirai)", "value": "76dcf7ea3454e2c28d8cd6b3e630704a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179375, "uuid": "e4377576-dc3c-4c7c-9f0a-947b45084235", "comment": "Malware payload (Mirai)", "value": "9f41ee1f56e2184ddb57ac291aacc81f10ac458596203a72439efa2caf97821d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179375, "uuid": "a309948a-4a74-4efd-a2fd-060ee1d120dc", "comment": "Malware payload (Mirai)", "value": "13c47c679c829de21bb9fd09ae87370c0952bc0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179375, "uuid": "48a480c6-9e01-428e-9f9a-1ba8256517c7", "comment": "Malware payload (Mirai)", "value": "b68e39cbf46aeef4117a1505ec5eb1c2537f61c8ae5391dc5da3630afa8faf339e13cc14fea752bed181bd937431a6ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179375, "uuid": "496355a2-e3d5-46e3-a9c5-74fc037d2c2d", "value": "T1B873A50A6E319FBEF67C863587B74A209B5963D533E1C685E26CE9040E7034E642F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179375, "uuid": "3f7f5547-2553-4b22-bfa6-3ce3098b8975", "value": "1536:RayBayiRyr0TX69W4jyK8Y1WRyc1iXydP7MITOkorE48T2bVRi:uTq9JyK8Y1WRyc1VZd9SE48T2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179375, "uuid": "f9b8fdbe-c091-4a0a-a55d-0f54fbdaab97", "value": 80672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179375, "uuid": "018eb9d0-e0c8-4a7f-a9ff-349665685dda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179375, "uuid": "95635048-0336-468f-9769-883c8aec9882", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6ea88b-ef4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768177758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177758, "uuid": "ceac077a-9ff4-4d95-a3ea-99bc5bc0c35e", "comment": "Malware payload (Mirai)", "value": "2fa9c896683e42e44b8466b61eee1665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177758, "uuid": "95a52ab9-8064-4d1b-864e-b1a45f438126", "comment": "Malware payload (Mirai)", "value": "9f9b7b8b2c1012f3d7fb8d72682c5245b2627e988ce8ebfb4258c1d13ae15937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177758, "uuid": "9755f0e4-3a7a-43a8-a163-ad21a9088510", "comment": "Malware payload (Mirai)", "value": "10e12a49414d500c9a11188eb57e1f7f045b6056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768177758, "uuid": "6eba9c49-7e10-49be-a504-8e70719ed816", "comment": "Malware payload (Mirai)", "value": "b7819e6c314d0e37399cdfa982a9ad32c26b85f7b9a7d196168a61a0bc00312b4554102c039a933b5f8f8982fadb9cd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177758, "uuid": "f95535c7-29c2-40a1-94e9-90b25a56394f", "value": "T151931986BCC5C612C6E0A1B6BB0F52DD371643B8E3E6B107DD18AB19774B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177758, "uuid": "2a10d836-ae47-4c81-becb-c7c4d47db756", "value": "1536:HlnddK2xw3yxjf9cAxybxIoQ+w/x15BA3yQ9/zvFT2bVR:HlnddKowcfybHQ+k15BA3pDFT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768177758, "uuid": "bae5a578-a612-43f6-a43e-a1919db23764", "value": 97040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768177758, "uuid": "f07b0bd2-0044-4be1-bf7d-33c5a1a48daf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768177758, "uuid": "2197c646-b889-4017-a6e6-3846e2454882", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a68ea42-ef7f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768199043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199043, "uuid": "39d5cea1-d74c-4069-b236-b97ab7d0771a", "comment": "Malware payload (Mirai)", "value": "78913aadc535e55e6abe950a6653dd8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199043, "uuid": "12a3db39-338e-4937-aaa6-09df62c0bf2a", "comment": "Malware payload (Mirai)", "value": "9fa99639ed864c11f1746049210a278db59e2886488d8486b864ca36589cbaaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199043, "uuid": "bc21a38e-d0c1-4563-83a7-949de2d3f9f0", "comment": "Malware payload (Mirai)", "value": "8cfb5a124d72b000517cd8600e8921af48ba5bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768199043, "uuid": "c9195f10-2a9c-4b04-9c3f-a15a6cf1f585", "comment": "Malware payload (Mirai)", "value": "c297bacb5c1e98f01aeeb1b773a42b19a57f04be3eca7cc5eb8ab48a6a603980daa78c8ee9e8f1fed911446f1dee88de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199043, "uuid": "c6438997-9036-4781-9685-2ce1bf0d011c", "value": "T15534751A6A22DF7FF66C82314BB38920579936D626E0D644F26CD34C1F3125E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199043, "uuid": "5fd84c27-94c1-41b1-85b9-b3864fcf1b26", "value": "3072:VNGaEJ+mQuaWOB8etzBONe4NWICA9A9/FzP/uE5dPSdzU:VhfqRAOe4NFCkA3zP2GmzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768199043, "uuid": "639697f7-2f1b-4135-9f36-eb75a36ed3a0", "value": 241688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768199043, "uuid": "06bf681a-0b69-4a78-8bc4-e81e0c29aa8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768199043, "uuid": "f6c003b9-56dc-4546-9c48-32dddad9181a", "value": "SecuriteInfo.com.Linux.Mirai.9724.9534.1981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd2ecfb-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212018, "uuid": "244e048f-4f14-4853-8a14-513984380870", "comment": "Malware payload", "value": "92cf4befb05af93657bfaabf1ef3b926", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212018, "uuid": "d9c929dc-7818-4349-ac2c-f1814b4781c0", "comment": "Malware payload", "value": "9fbd4a0351bcd33a5dcf4d6c408a9f36b6aead4944eccf8891a7c7a141e159b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212018, "uuid": "b1d1aeac-08fe-4d59-a317-8711c31bbf77", "comment": "Malware payload", "value": "7d906bfcd24b2b9d94b6c21e8da3b1b45c0eaa30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212018, "uuid": "bc1385c7-16c9-4036-b1cc-c95b590be2f4", "comment": "Malware payload", "value": "ca95ccbb826ff3fc0c7323191de61e8bc4f107ff36accfc4a5e341091416c9a7084e06db887fc160a363dc45975769be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212018, "uuid": "5a77a9e8-8763-4217-8724-76870a6440bb", "value": "T145F423F8A591BA60D4E57DD4CB36688D4C8BE85B3C1BE4BB115EA745C133C427892EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212018, "uuid": "077bb167-00d3-451c-928a-23eae2190acb", "value": "12288:xcsIGklC37fR8Rl4W+hXz86PjKjWxHFaaaoZmUt9Qi7i72YaqP7OopZ6ohQJ:LIG3fqR+J26PjKjWZTRNW72YaqP7OGs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212018, "uuid": "f12b1721-1feb-4416-a1f2-2503acc83727", "value": 741780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212018, "uuid": "affa93a6-709c-4442-8910-e65328749a98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212018, "uuid": "4978a1db-bfc9-4a7d-838f-72e81060dad5", "value": "client.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da5e1e9-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246347, "uuid": "8c55ffa6-1eb1-48fd-8641-5d198de2e4e8", "comment": "Malware payload (GLOBAL)", "value": "6ffbad02cf6f1392eea86b4f134c9de6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246347, "uuid": "52d523c6-92ca-41af-97bf-4120386c486b", "comment": "Malware payload (GLOBAL)", "value": "a0d8032ea8d64e4a7bb6ff292b236955d8239c5826fdcc76b32dbf96cb824acc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246347, "uuid": "f93b0152-47f7-4807-bcc0-4edd6fa6b7ab", "comment": "Malware payload (GLOBAL)", "value": "d67860e5a554b427c767949b9ed59ac156c51174", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246347, "uuid": "8e787fb2-25dc-4513-8fc2-580791bf665d", "comment": "Malware payload (GLOBAL)", "value": "4757c4338ae32268394c0297e1e810a5f99132fa71227bcce2de65639e8ecf6c1ee0e6a2668fabc86bb5aae3c8a38e7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246347, "uuid": "ccd25a7b-2fbf-4bca-b612-dbba2871b500", "value": "T152347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246347, "uuid": "997ab835-ffd7-4842-80ef-547ee1ff318c", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246347, "uuid": "2e8dc537-0c41-4b7b-b5a7-9a8459861c0f", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246347, "uuid": "db5883d2-83b5-4f71-ba74-0afd6b9bbe05", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246347, "uuid": "c99a59b0-dab0-411b-8c91-d4a3f64965e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246347, "uuid": "248ebdb5-99cf-4ec6-ae9d-2236b930c639", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71406e7a-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224449, "uuid": "0dff56d1-c80b-4240-8f84-d6e4c0322d60", "comment": "Malware payload (Mirai)", "value": "1337fec9faba53ef4bdeabd62a083a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224449, "uuid": "6ccb5b1e-1677-4db1-847e-39e0857984b1", "comment": "Malware payload (Mirai)", "value": "a0f2a7920a2d6094f20865725403b07f49680905f26cec7634e4716f74aea291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224449, "uuid": "e76d5458-0521-4181-9036-ac2fd86f1dd4", "comment": "Malware payload (Mirai)", "value": "d4925977be589e57b386aa3acb36faf77e5a8f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224449, "uuid": "4f648fa9-4d62-4de5-9753-3ee4dff71b33", "comment": "Malware payload (Mirai)", "value": "1ce942ddbd014f68744d6813de334fb09f8ddf9d9232b67dcba710aef1017107758e489e1cbd64d1c9f87f7918d24a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224449, "uuid": "541c1443-cf77-478a-85be-755e1e3d0429", "value": "T139334AC59A83D4F6FC1D197208BBA7721672E53A10B4EA92E7B4E9317C1E115F50A38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224449, "uuid": "9410a810-bfeb-4552-bf6c-0cb23f96cc36", "value": "1536:SGGdkkPF1BO2/y99KuUK8Zm8bxv8hXRR:SG6k6hOay9wuJ8Iq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224449, "uuid": "3b6f1f04-426b-4941-8e01-82676de2634e", "value": 54544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224449, "uuid": "11dbf80f-3fd9-4643-924f-aa70e85f4238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224449, "uuid": "5270d6e5-a40e-47a4-b41f-63b466a03bc2", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824f8564-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216746, "uuid": "403778e6-7687-43c4-9202-18ca30f7a126", "comment": "Malware payload (Mirai)", "value": "0843dea1438ce9be1739a9e0ef5fbe08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216746, "uuid": "36220740-be9a-4bbc-9474-8fc700e8bf33", "comment": "Malware payload (Mirai)", "value": "a16884f22c23b1eaf3cf4592db352d6059a8a7cb755bd99f5843bcaa77950d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216746, "uuid": "27821db2-77a5-4f3b-8dce-94ae1abfd331", "comment": "Malware payload (Mirai)", "value": "2398b99d37fd94165b3ba9e12d59d221c08f6c75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216746, "uuid": "cd155f2d-bc8b-4ea6-8a9c-144580fd8322", "comment": "Malware payload (Mirai)", "value": "9b7e399c24c01f5a94cdfeb76fbba198feb966ba5862817f45dbf212c33a30dd4aebe61cf2d322e7f0d2103c81963e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216746, "uuid": "46dca6e6-06e0-4c9d-8767-507013204db2", "value": "T16B13E1A7210FD7F8D4B317B9181E16E09D14B61323448ABF4436BA7EFCB8AB51D15A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216746, "uuid": "ef117324-158c-4be5-8f7a-383916fc8f4b", "value": "768:ghTPjCYZOih2sCqbK0msgYawaIh2osRKyrIc0aIC1uNki3Q/OBx05b:ghTzOitvlcDw57OKyrIc00TiA/SAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216746, "uuid": "c24cba1e-0037-4842-98c1-9d176cbf74b2", "value": 42020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216746, "uuid": "1f7dd415-ee33-4dd5-b097-8d27dfcbc07a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216746, "uuid": "0f8ac753-f7a7-4d6e-b97a-208d4d19d1b6", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a16a8-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216731, "uuid": "757cbf66-dbb2-402e-8400-30efec540601", "comment": "Malware payload (Mirai)", "value": "cdb5c55a70b7c276134b411695764d27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216731, "uuid": "bec4e9d0-0c42-463d-9177-ea2c4c664f23", "comment": "Malware payload (Mirai)", "value": "a1bb22f212902bebe68dfd700ec35da759169060b9ff62bac552037dde65d728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216731, "uuid": "ba719037-3673-4e93-90e1-c1626da6b494", "comment": "Malware payload (Mirai)", "value": "b7be8f9060cf45646a67526e444e9aa61f890fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216731, "uuid": "2d9b2835-0812-4e22-af46-7f218e7025a8", "comment": "Malware payload (Mirai)", "value": "c6e7b40f17f5396e90564c766fe3d7dba206325031a381dc987546ff227236fa8a2dd8d4bb7326a101be32f4326f1666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216731, "uuid": "98265637-7661-41ad-8aa0-d3fb9d5a24c3", "value": "T17B13F13A4AEE7DA2CB361C31F66A5F8636878FADD161343EB95E113C1A4224665F8103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216731, "uuid": "4f906bd5-16b9-41f5-a6df-5407f18812d3", "value": "768:8iifDEdlpr8S3nuzKg+t452i37d1ywo9y+dS/m3tU+7UejVJHAcIvs3UozS:eDQVq1xkt4O9U+7VVlArizS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216731, "uuid": "8bcd6773-5a28-450c-8872-878c342a17ae", "value": 41636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216731, "uuid": "2689beee-d5d4-4824-94a9-d9e47f1d9be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216731, "uuid": "a77a9681-b53f-44ae-846a-e4b296d1b46d", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5484ea09-efee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768246734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246734, "uuid": "e0e8917f-f6d1-403f-9cdf-20df5890df23", "comment": "Malware payload (Mirai)", "value": "bceb73c370422a93b4a5ea086c4eb6e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246734, "uuid": "cfa56ff2-8c89-45b4-98b0-7231a716c8f6", "comment": "Malware payload (Mirai)", "value": "a22da1d4612d40341e19294ada8de0e399d56de4da6d2ae5bdb62d228072861b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246734, "uuid": "74ecce0a-42f3-4f2b-b155-ba659d2b58a0", "comment": "Malware payload (Mirai)", "value": "1bc44d89dfb4cd3f1c26681019367b5cfb707236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246734, "uuid": "7a03a00a-05e1-4254-a0ed-c47e12dc5dd2", "comment": "Malware payload (Mirai)", "value": "f6369dc2301ac2dcaa94e0c3c6636e58452ea543528e32fc7f9fbad2db9c709e54856c96b1261f4bf6b6b443f373af44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246734, "uuid": "159e49e4-a258-4c80-b0a3-9a22c1b97984", "value": "T1E9C27EBAD069E9D4C5610B38DC79C5B81F52B10183613DFA9FC449E7508BAB8FF0A365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246734, "uuid": "75eefbec-e459-4435-abff-751fcb36af7f", "value": "384:Matat810Ef2wtYOt4vqSYLDLDrk+zh4MeebSuD6ZuWbi0pb6N+DQ1rbC6L:MaFf2wtYwNSKvPnveeddMi0EN+D2rbCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246734, "uuid": "72e8e187-448f-444f-a45e-45cda65ce697", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246734, "uuid": "1333ae30-7623-49e2-898c-505c5dc44b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246734, "uuid": "54578541-8d29-405a-91bc-16f372e5c196", "value": "SupplySrvsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df158406-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179106, "uuid": "dcc02bb4-1579-4e2c-a79b-c810228a19a0", "comment": "Malware payload (Mirai)", "value": "8dbfe9b45adc2029275db89bcb057954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179106, "uuid": "68eee2ca-cafb-4801-a2f5-6ce5d31ff5d8", "comment": "Malware payload (Mirai)", "value": "a342eeec1d6c37177b9114f03065e815768cbed903d79b55dda7e2e1560fb807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179106, "uuid": "99a72b75-e1fe-497b-abcd-d832f7d54327", "comment": "Malware payload (Mirai)", "value": "43bedfe117e0793ac77c822ffd57c6ded83df77a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179106, "uuid": "d635a094-8053-4c8d-8a6f-9704f09a2757", "comment": "Malware payload (Mirai)", "value": "3a05274ee24acd50163d11f05e8bd91d7249ef5dbc89326f7efaf2c4cf124d3c3e6948ba491d9f530885f1bcd3d23400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179106, "uuid": "a7a14c57-3e33-42a6-9af9-986807462844", "value": "T11FA34A12ED796D27C5C4313B51E34531E0B653A916BCCA1A7EB32D5CEF18720312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179106, "uuid": "c7b43ebd-4c25-4626-8588-e42f85653470", "value": "1536:UlpEIsXmjImsKFyn02O9EQ0rHn9WrfrMTyZewfIO4zXkzm7uhi:QdN4vnO5rfrM+5XDzm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179106, "uuid": "c4ccbfdf-2722-4191-b07d-333313283b3c", "value": 99548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179106, "uuid": "6a955481-3b17-4c36-9c10-394d852a0f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179106, "uuid": "2ae326ec-1a69-46bd-a737-ecf073f9e8f8", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf2e37f-f009-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768258372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768258372, "uuid": "9ba5b66e-0548-41b6-b6aa-b5d5b6a39b84", "comment": "Malware payload", "value": "5435097633142c024232266e013b3f93", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768258372, "uuid": "2b9e24d0-5b81-4c8a-ab91-b52ee804849d", "comment": "Malware payload", "value": "a41c616645ff071160638b58bd04eca6a0c67fe9cca9289062ae874df99e13e9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768258372, "uuid": "c6700603-a75d-4600-b1e5-8df0f2899c23", "comment": "Malware payload", "value": "de2110d6882c428ec0780dd4a86458d1a2af98bf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768258372, "uuid": "ba7cad93-fbee-4f31-8892-5dcf2b0272e3", "comment": "Malware payload", "value": "477348dce7278946f08d18e43045029d2f8b426c494cdda359306c89ecc2769c2748b23b7830c7948a0d467a663cd0de", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768258372, "uuid": "932e5974-f2e7-49a1-9989-c7ae5c619ef2", "value": "T16A2702C6A33B21F9E449D83FF47727D1632C9E24A09F71BD858904BEB964B5A2470F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768258372, "uuid": "49acfad2-9b1e-4723-b2e4-3a9ddb8119f3", "value": "49152:A00000000000000000000000000000000000000000000000000000000000000n:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768258372, "uuid": "e33794bd-5ddb-4e69-806f-bc782b98cc55", "value": 22158685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768258372, "uuid": "070dba31-41b7-4d63-abaa-ba3e8c5adc3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768258372, "uuid": "7203a3d2-8d5b-4c17-93d0-692765d2ded7", "value": "[Forge 1.21.5-1.21.10] SexMine.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7910f498-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768230904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230904, "uuid": "13194b84-7460-4f01-a939-a5f870dcd8b1", "comment": "Malware payload", "value": "17dc3ad572ba5b275e545e7498ee129b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230904, "uuid": "e2ca60de-7a90-4275-8077-76acf9e0e410", "comment": "Malware payload", "value": "a4fa32bb75a4bbcc82c398591a1de5a76ef93cedaffd719f43972ce3105f2892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230904, "uuid": "b960d227-2a2c-45f1-9563-4b26dda8e591", "comment": "Malware payload", "value": "5d8d9ce63d63f5d89b3774215830751de6efced2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230904, "uuid": "8478def6-bcce-469f-bd81-6c8ab8ebb2d2", "comment": "Malware payload", "value": "69d256dcab6e124650be935b27b1012fb07f96acd96560dcab87c67cf6dd00bf3cfae1aa0e69038788672fde43deacff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230904, "uuid": "aaf7a054-f15a-4fb0-a4db-7441fed5b334", "value": "T1F6047C15B39514FDE067E178CA561A02EB7274120B619AEF03A443BAEF6B3D05F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230904, "uuid": "6ef2640f-2df2-4672-bf81-7900cd330b26", "value": "c886fc7ef022b881d9520d4053e9b6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230904, "uuid": "01498638-a3ee-4477-aad8-988f20dca32d", "value": "3072:JN32Va0OpPLek2e3QrbMxZW8LBJ2Y6+PtDmcboZz/LyXXV31fgbNz:JJqADcbMxjPT3FDcaXl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230904, "uuid": "cc289144-5099-4fec-ac5b-13729221ff2f", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230904, "uuid": "ea25ea8a-f6cc-4689-9977-3754a2b0af7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230904, "uuid": "0baf95e7-aae0-4037-b306-842f0555ebd2", "value": "17dc3ad572ba5b275e545e7498ee129b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec03ed78-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181705, "uuid": "0b3881dd-6af3-494e-a59a-8e746628d967", "comment": "Malware payload (Mirai)", "value": "6ed209d402724619a71e212a1057114c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181705, "uuid": "3c7dd935-9de4-4c61-8ace-56a1a0826f0c", "comment": "Malware payload (Mirai)", "value": "a650d2d6c317316be5b94fdc98f51f9b09e109fd51d66aa4815411252adb0a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181705, "uuid": "0724cc20-ff04-4d94-a0f9-2b5e0904df9b", "comment": "Malware payload (Mirai)", "value": "309d2293b834dd22624302e45d199d7b97c3f194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181705, "uuid": "6f38d01f-9fd9-4ba4-863c-938e77f3655d", "comment": "Malware payload (Mirai)", "value": "5f4640667f94a1c0afdde1a3bcaf44a4068f7b6fa9b9efdf9f0ca68833d925703396c989c994ba21453346f954b240e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181705, "uuid": "90652fa2-81af-44d8-86c3-e8581e20d7f1", "value": "T1F0B3E70B6E629F7DF36C82354FB78B25AB55239133E0D585E2ACE9005D6038E5C2FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181705, "uuid": "386d5048-8ded-490c-b73a-723a9179a0a3", "value": "1536:ENywxjiDvRDvFdv6atiswaC8YN95Of6+KZI8uixDt4haTAbVR2JY:EwwwoswaC8YN95Of6fI8khaTAuJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181705, "uuid": "4d20c713-d840-4027-90a1-8b338ad21dcf", "value": 109284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181705, "uuid": "c5d0831c-2902-4ae3-83e9-c86de447b4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181705, "uuid": "13397838-bc9d-40de-afa8-70acfbb3dd70", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeec97b4-efb4-11f0-a129-42010a9c0007", "comment": "Malware payload (SilentStealer)", "timestamp": 1768221975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221975, "uuid": "f4494886-f9cf-4ec2-a3af-ddaa1b5571aa", "comment": "Malware payload (SilentStealer)", "value": "bec335c5cc13736ce8365950e6d58e0e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221975, "uuid": "0d67133c-23e6-4167-94a9-ac7dbe267826", "comment": "Malware payload (SilentStealer)", "value": "a6c2070f34bb5ad83a2e6e26afd106b6309ae4652b08ccee5d210f39402bafad", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221975, "uuid": "9f83db9e-2115-4b66-bd0d-b7960625a241", "comment": "Malware payload (SilentStealer)", "value": "d2c25ad9b8173c06b4e78c484753afc345fd34be", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221975, "uuid": "26504ea4-225e-4030-9168-1189c9cfe9d5", "comment": "Malware payload (SilentStealer)", "value": "0ccad7a3ddff498534201791049c596a18b469c2a25216dcf465165bc1e1ee74e2a37fcfd85abfef0f20ecb922335a50", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221975, "uuid": "dd4602b5-744f-4464-9784-06178466ef8f", "value": "T1A528338BFC451273CC1A1DB744BF0381D5666E79C9A2086B105232B9FCF0BD3A9E6AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221975, "uuid": "05ef6393-4e22-44dd-af45-149cfc28ad03", "value": "1572864:0K9MEHqCtZqB0uV/NTnhaUn94u/U3E1HhMwPyXfbNApNJoqit/:T9JFMBFVnhaTudNS2DJoJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768221975, "uuid": "4ae7a88e-2f26-400b-a512-1291b5bd1b23", "value": 93937249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768221975, "uuid": "2c0e4915-c596-4cba-9f2b-becc98573c3c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221975, "uuid": "f9e53f50-76f0-4fca-b88d-7f3bd815d0b5", "value": "XaynePackSetup 4.5.9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b0f31e-efe8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768244193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244193, "uuid": "aa899f8b-e401-4e51-a1a6-f996199c0eca", "comment": "Malware payload (Mirai)", "value": "0a7679370cfb55ed70bc0801e50d9da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244193, "uuid": "dc289ee0-c755-45fe-a760-fc655fc9b46b", "comment": "Malware payload (Mirai)", "value": "a78f8c90eea0183dbf8d64bd03f34696159980cf3a24937138d50be267865c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244193, "uuid": "1379e4b6-3025-4f2c-a3f9-3b6146520908", "comment": "Malware payload (Mirai)", "value": "5da90b45aff2afd6c5c89abd7e1145e33a830737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244193, "uuid": "af717eea-9fc6-4278-9eb3-a74025c56cd2", "comment": "Malware payload (Mirai)", "value": "879c6c5301437abbeff0133718dc5560f6beb952e62ca587f402f3f010bf7b94bf5d7fedab7199a3600b0d526afbac4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244193, "uuid": "e38a50a2-e72d-4e9c-bfe0-1fabc55e7406", "value": "T1B4D33A82B701EF7CFC0AD33B4517095BB639AA6471914AB3612B6C67BD311E64C3EE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244193, "uuid": "a1387075-4124-4630-a2b8-bbb29019514b", "value": "3072:P4jQgx/GhFefV80RR0hody7G/Bp3sLC4D1/J8hjH:AMg92efqOy7WBpcLx/JAjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768244193, "uuid": "b0f9fdec-73b5-4f6f-9c2e-02dc6230a648", "value": 136312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768244193, "uuid": "e445e654-49f4-4a84-92a9-7474cb84db91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244193, "uuid": "2677b682-0209-4e0e-b0b1-40e40a93452e", "value": "rondo.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28030d37-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181376, "uuid": "d7feca06-5449-4db6-b979-1af654ef5440", "comment": "Malware payload (Mirai)", "value": "0a49cdf1f563217d5cf43ee44e36a2b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181376, "uuid": "3a53a672-964a-43c2-aae7-7a1b0365028b", "comment": "Malware payload (Mirai)", "value": "a81cc73d764986c262ec9b66cfca9b54165a9211c9dbe7b41f449ee4346f212c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181376, "uuid": "5fa33dc9-c5fd-49c2-8eec-2b84f51f7449", "comment": "Malware payload (Mirai)", "value": "3b311b9bec340d50cadfdb194cb7303ef9153a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181376, "uuid": "e8895ace-6f51-49a8-baa4-b92258d33ea6", "comment": "Malware payload (Mirai)", "value": "817df6223b5b326e3b6f435f8cea36c144fec917154c70be8785ff06e84c27fe8a3cabf788717e9bd9ba65af0d9137da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181376, "uuid": "7129eb04-0231-4a5f-8253-ff25916286b3", "value": "T172536D128C645D98F06A7D3020388AFB9753B549AD1BACFB7D478225001F69CF5E7BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181376, "uuid": "82f1d7b7-505b-4cda-ac22-a5e6bde21a42", "value": "768:NA9kLVTP4TX0uwpjF2trAbdo/Z3WEiMinH/qQUIjZ1rRa1WcnoT7xC98T:N/hP442w83iM8H/x3R41WJ3xC98T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181376, "uuid": "a7c8c251-0274-49da-a7c4-8b92ed597988", "value": 62664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181376, "uuid": "f264b6ae-b167-40d3-ba24-6621bc025c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181376, "uuid": "a4f24499-4c9c-4760-a17e-3d42f698464d", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cb109e-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223280, "uuid": "df780fc0-b89b-4c88-a7fd-e966cd0bc836", "comment": "Malware payload (Mirai)", "value": "3fcff418312a19feadfbe2e84e977f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223280, "uuid": "a7176e5a-853d-4c02-a029-a88a82445532", "comment": "Malware payload (Mirai)", "value": "a932e9b7a7df2980ceb9cd61ef94e576b97b125cf55e01c1ad7b1b2907b8e065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223280, "uuid": "4db4b683-e454-4958-8ed9-ff3f3e212d62", "comment": "Malware payload (Mirai)", "value": "0ff46a1ad5c4da2aef7c642d8725d0ab2585d37e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223280, "uuid": "2aefe63f-2660-4929-a685-b990222253ed", "comment": "Malware payload (Mirai)", "value": "cf908cccad199d1c3e266b983e49d2c254ada988ecff3b524f4046d36374c8e69bfe58bd8ee4bba61d221e0f74ecfd67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223280, "uuid": "d338dafd-4f51-4ee3-b82b-32ac61c3a30a", "value": "T182937D12CCB49DECF03A6E3010B5DB764B13B549A94B6CF73D8682255017A88F5AAFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223280, "uuid": "9261e2a3-4f61-402d-9d71-9da2d96593dc", "value": "1536:tJp4mPVm2EV+6Mth45jLlyn2+lfmvJXjKONLYMdvCH3c0CT2bVR:tJpRPYx+6Mt65jkdpQXHdvWMtT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223280, "uuid": "f99bf70d-5a1c-4eb4-b7c5-0e11afd9cb93", "value": 91616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223280, "uuid": "4e979c1f-1b40-459c-a496-69091ad7007e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223280, "uuid": "2fd95f51-e8ea-4b5b-b048-f0ad6b500f4d", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7706cb09-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246363, "uuid": "6db495cf-4965-4ac4-b590-b9d12e606594", "comment": "Malware payload (GLOBAL)", "value": "a2a8b3094d18604c41fef7ebc48e9049", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246363, "uuid": "81c06d92-f13d-448b-9aa7-79422a5c8120", "comment": "Malware payload (GLOBAL)", "value": "a950a8fdd0d8f7f6e86bd475c3f71381ef4536539e7c50e2aeb6304ae56570e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246363, "uuid": "e975995c-d201-4c17-829c-8e6b2868828a", "comment": "Malware payload (GLOBAL)", "value": "60006d941f6e32c99b7695e911a5a05a5310556e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246363, "uuid": "0bf66dc8-a006-40ab-ba61-ce8f768b2c1c", "comment": "Malware payload (GLOBAL)", "value": "12799a6e6731496166f8c25d78ede5ae50a00123a0738379a0c3c6ce5a61ae71c25de81e42f11c008855e454f1b3667b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246363, "uuid": "bd3e04ca-bc82-44cf-b43f-c3a361aedbbf", "value": "T14E347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246363, "uuid": "4db2cabe-f882-41fc-8b67-5ce423fc041d", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246363, "uuid": "9d62836a-da39-41ff-94a3-1caf3bf16045", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246363, "uuid": "d90a2a12-5330-4e6f-b06e-8d28a8cca8da", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246363, "uuid": "7336b35c-4733-49dc-98e8-cff18f9ce108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246363, "uuid": "5fbad520-1847-40d1-98a8-d0a502ab80f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c79078e-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768205382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205382, "uuid": "3dc3cc69-0231-4241-a5c9-a9f345eafe59", "comment": "Malware payload (Sliver)", "value": "aa0774298948285650351bd29d63a082", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205382, "uuid": "722e390c-2729-4b6b-8b8c-3775c4472147", "comment": "Malware payload (Sliver)", "value": "a9dd0787628a24221273ae22084337d6ed9107207708d50af1db26141f81ca12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205382, "uuid": "38cd02f7-2db0-4872-9bbe-695f8dde17d0", "comment": "Malware payload (Sliver)", "value": "f146424ae220c31c2b11695d1153c81fcf449f85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205382, "uuid": "42111ac3-671f-4589-8ad2-f12772671138", "comment": "Malware payload (Sliver)", "value": "4b1abc8313da5abfa1e2795f6fb25f4b14c573bcbe2dcf12cdad1f96f514f26fbefe69720bddb731de190ca336ef5f55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205382, "uuid": "fbe7d826-d359-40b5-a67b-0992f03c1217", "value": "T1B6C60A03F8965195C4F9D1B489214262FA707C5C0B7863DB2BA1F7B82B327F09EB6791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205382, "uuid": "fedba9b1-bb49-4101-a13f-21901ca3fdb2", "value": "98304:iOZe8SWJMEYibh9q8B0zy7gYauExmyngdsK:xZm+FbhIS0+7gYaLx3gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205382, "uuid": "28ee9a9e-1260-4449-bbdd-4ec4029bbcdb", "value": 12509184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205382, "uuid": "2f713e6c-2f36-47f5-948d-91d9dd6d2ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205382, "uuid": "63e7edb8-c0cb-4a43-8225-055824b49182", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf74638f-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231452, "uuid": "7c2c61a9-6633-4709-9b4b-5ac84909f46f", "comment": "Malware payload", "value": "1faad43f3015a285b7864b5f47d87bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231452, "uuid": "27fe9cff-a20c-4918-9e49-d12521de280c", "comment": "Malware payload", "value": "aae718316a1a954ed097395658365b32daed2f8ee1a8aad440317b943201170a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231452, "uuid": "2d8a3b4d-c3bb-451c-910b-fd1673cb4604", "comment": "Malware payload", "value": "7ae4868ab90005111cc61dafb8c99aef846348e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231452, "uuid": "96093989-db10-40ec-ba41-fdd5216993c9", "comment": "Malware payload", "value": "3f431613b68a405fde14c82fdda61cfc6587ad0e4ac6948a2b3d45f7bdffada97e4d2399e6e2f05c674b6c65e6f1bb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231452, "uuid": "7899baf6-adac-440c-96fb-507873f360a2", "value": "T16D5218129ED12461DAD102B583FEAA72E17C6702174810D353BD28896F706D7FE36F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231452, "uuid": "aac826e6-314d-4696-8cd5-03e1a64b7d83", "value": "384:3o4wDTyysCTBIRJBAQy4gk+QhTFfsveuFD:3o4wnRsCTB+JBAQy4zd+1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231452, "uuid": "26bfe173-d69f-476f-96ec-ab3e5ffd8a68", "value": 13298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231452, "uuid": "92cfbc82-ad80-4a90-b782-927eb5abe11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231452, "uuid": "ef2aa9fd-aba6-48de-9333-fc72d98fcfb1", "value": "1faad43f3015a285b7864b5f47d87bdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ccccf-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229431, "uuid": "173ebf9b-36eb-4a66-b088-ef5638b0a898", "comment": "Malware payload (Mirai)", "value": "54ef5febeb53156d927b2a10f321b2bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229431, "uuid": "a0a909cd-a8f5-4b80-a40a-73aa7ea223eb", "comment": "Malware payload (Mirai)", "value": "ab386e5573cd458e1b126bd817bcaf6af6389f93a9e00eb78e30acf6a75eb490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229431, "uuid": "8918ee37-cf18-45c4-93e6-b74106ac269c", "comment": "Malware payload (Mirai)", "value": "ccfcc2966cf17db672f90f1233030c4ee36abe6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229431, "uuid": "3d51afa7-6994-4da5-8680-c9046438af4d", "comment": "Malware payload (Mirai)", "value": "d8f7464ca7e52f9ec5b30bd7767768009bab468a8fae831411cf45f74cd757fa836a618d4ddeb510394a21770f158e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229431, "uuid": "e02b05b9-d6b5-4820-996b-cf9146defe14", "value": "T1DB34095DF880D77ACBC0217AFA5602CD33735F64EBEE320589356B383BD6A15993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229431, "uuid": "7ef87688-caf6-4523-8970-dd715cdd7555", "value": "6144:qbbWcadupyhlHc3SRpapifArZgN7ZN/heY5XIU1tMBYRq+TzXfLwOldik:yWSrZgN7JtWYR3MMdik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229431, "uuid": "61dede4e-f747-4e82-820a-4e45429c036e", "value": 248600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229431, "uuid": "f7347e7b-08ea-4bb1-ab75-5bfba1e469e3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229431, "uuid": "b02e203c-b9be-4f40-8e03-3d011c851eed", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80da39d-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204784, "uuid": "d8dfeb99-d17c-45ef-8ecb-e451a94e4b93", "comment": "Malware payload (Mirai)", "value": "db2f52ccf3f4c732a776d130bd3bffa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204784, "uuid": "4c097ffc-f99d-4fc5-87e4-9f08cf85961b", "comment": "Malware payload (Mirai)", "value": "ab5efd1824a9605b9d0dbe3f95fca458198ecd8759e70f93849a13a1322b80af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204784, "uuid": "40e720b7-775b-4dbc-917d-2c44c3e26591", "comment": "Malware payload (Mirai)", "value": "ca1d0bc2f521ab31f3c338237f9fca0d61384f7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204784, "uuid": "760e298c-493b-4668-a39e-52d9ceba8cfc", "comment": "Malware payload (Mirai)", "value": "89e4ab20d1f157d3fbfbe7748ff93305c851e6426b0f263219e8d07698b80acaf6a27236743a2f5e03fb91125b8da173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204784, "uuid": "13a91e57-605c-4489-92b6-898969280fbd", "value": "T168932A577000DD7EF85FE2B382570A06B1257BE54F122F67BA22FE63DA2D1A41C1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204784, "uuid": "08953bb8-72dd-42e9-8105-328412aac876", "value": "1536:19O4A4KfUVPyJgPcZ24zrcP0bqMHVg6HDcn/+QMGIIEqlvO8XiFtV7GPX5/tU83H:19TPKEPyJgkZ7zrD/WsIxI4lvOptZGPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204784, "uuid": "4959f932-d857-426a-9e7c-e932cfe07f7a", "value": 91388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204784, "uuid": "edd98a91-0266-4515-8288-f709f8bd8470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204784, "uuid": "bd2a6eaa-26ca-47b3-a000-b8927a1333ff", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0b5835-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205326, "uuid": "9b85edd7-81d7-4591-852e-04277ed5d8f1", "comment": "Malware payload (Mirai)", "value": "f386ffed7209122c0a27e55580becd6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205326, "uuid": "f582d070-feec-44a9-ad84-427862b66d3a", "comment": "Malware payload (Mirai)", "value": "ab90c8e36b8ae0cb795f53a9ad38e4c89e0298e381a5e9f2120f4da4ecc535a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205326, "uuid": "02033ffc-615c-4cb5-b0c0-ccba4c575f20", "comment": "Malware payload (Mirai)", "value": "af41c80ef89ed102f3c83babeb0affe9442d3b4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205326, "uuid": "2e8cef7e-0ed4-4eb0-af8b-d26174d03db1", "comment": "Malware payload (Mirai)", "value": "d5f0440e8e4bc4e3e70e5cd1a2b3413379ab90afce83c84dab5b05b1544dc45f86267d41689ba070b1861f78fd55d38b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205326, "uuid": "f6578b6b-988b-4775-a9a0-7d6ced825db8", "value": "T166931A86BCC5C612C6E0A1B6BB0F52DD371743B8E3E6B1079D18AB19774B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205326, "uuid": "4de794a3-b706-4e87-bd3f-4e3bd497bf84", "value": "1536:dSOvJQULQyu5GW4xiCoIQ+wldfSeLEuGiX+W/Iv9T2bVR:dSOvJLLvliCBQ+Wf7Quju9T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205326, "uuid": "3792538d-4b94-4471-9142-e352fcf47244", "value": 97072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205326, "uuid": "6ac18b48-cb44-49d7-b65e-c79cde9738d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205326, "uuid": "e9ed62e4-75c3-4e5e-9ebb-71cf57849439", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5608baa7-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217531, "uuid": "c1987115-5ead-416a-a225-fefb6125a74f", "comment": "Malware payload (Mirai)", "value": "e0e04e777350906395108300927da6c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217531, "uuid": "11886744-f354-4cc7-925f-96ba7217e213", "comment": "Malware payload (Mirai)", "value": "abc2ee7309545922860260f71adfc03e4922d6f709de7e7ff54c2acf0b52ee4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217531, "uuid": "c0f9612b-60fc-4fd9-9007-27c2a3f6562c", "comment": "Malware payload (Mirai)", "value": "504615434c64f794b7e13209898b3acf6ab6ff32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217531, "uuid": "e466b38a-7653-48eb-93d1-c9238c58e8e1", "comment": "Malware payload (Mirai)", "value": "9d937f7b9528f1541a918ed9ae2dc0663802655e91938e7b093204c6789c012d231d1d235452d16b7243150e11a2de64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217531, "uuid": "9be0fb62-56db-4c05-bd38-226c28009611", "value": "T169D35C0677180E17D5A34AB0263F1BE083FED5D021F4BA89291F9B5A4672E3B1586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217531, "uuid": "9fe328a7-4da1-45fa-945b-c9f14f410c34", "value": "3072:m9Fszma9Zh8XJSQ2ibJ3LmUGvtcozML9ZgLIn:Tv9IOU9LmUGmozMLTkIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217531, "uuid": "f9d1601b-1078-41ce-8bf1-56fe2fdefeec", "value": 134344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217531, "uuid": "feca55af-e503-4bc2-bf2b-4085d6bc8c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217531, "uuid": "4b4c1c05-07b8-44aa-903f-d80906af5eb3", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94c4766-eff9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768251708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251708, "uuid": "fa0d397e-4a62-4d4c-be1d-6269e4cc7d8c", "comment": "Malware payload (Mirai)", "value": "1ea5aa3e955f7252842d4ce765784ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251708, "uuid": "184c1f5c-124f-4b28-9870-6655b7499b9c", "comment": "Malware payload (Mirai)", "value": "ac4cfd34e2876ab19b329c93ec3f1e0601bc5e4c2c8ee03528c42ba46782fa2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251708, "uuid": "27248332-30bd-490f-b2aa-7795ee1f1eb9", "comment": "Malware payload (Mirai)", "value": "7dfcdf02347505d048c99b3bdc1369a6cc47cdbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251708, "uuid": "36be730a-230c-46ad-88f3-b63606f66e6b", "comment": "Malware payload (Mirai)", "value": "beb4ec0427672b46db4e14c183225107a73a0bb693a8c3c8f14050a75351366a5b5558a62ec044ca881f4d7da89dd0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251708, "uuid": "93cba870-f6fe-406d-a0ee-5bd15c5e9095", "value": "T131057C9DE786E0E1F62300F1025FDBF64634A12A5023F6F6EF55266374327616F1A22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251708, "uuid": "357c3f49-7d17-4f6a-951b-35cd849caa8e", "value": "12288:+5JOpr9gh6Yh+Lp8kgxWOcmiSBAJ044w13L6SBN8V93yPyMDisdrH6jLu:+ipWh6YhVkAgmrMr4w13lKV9iisdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768251708, "uuid": "2f38c633-77ec-4545-ad5d-d7eab6eb4a60", "value": 865880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768251708, "uuid": "ccca5749-0e4b-4623-a6de-709a6137d7b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251708, "uuid": "faa5a952-69d9-40b2-90d2-a4a43ca3a955", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919da446-efef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768247266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247266, "uuid": "67d60375-f815-4623-972d-a3caddc2f243", "comment": "Malware payload (Mirai)", "value": "a207453bf264ec5884df9cd1b420b219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247266, "uuid": "c5802def-d7ce-4fe5-809e-fca9bd87802e", "comment": "Malware payload (Mirai)", "value": "ac4f365af13dcc41837a89b371e0126f7d98a868fb46d532a4bcb12797284037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247266, "uuid": "8d9b8c4a-9d96-468f-99d2-0ed72e6fd6e6", "comment": "Malware payload (Mirai)", "value": "9cff7d7d0bd57fa864456c2f9271f9459c6e896c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768247266, "uuid": "264cd5fa-63e5-43f0-b15f-632ec497ed3e", "comment": "Malware payload (Mirai)", "value": "0b069f5748354ef14cb731d3ff8e6dac87a27021e3ebab1789d2873b09e67ddc75607b6169b517f7376b51395d1064f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247266, "uuid": "cf774e62-1ede-4e0a-9735-ce7c1203f484", "value": "T1DA147B16F68150FFE89AC33852EEA632D9B1B82C1239369D67C5FF153C58A20373DA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247266, "uuid": "63527706-22d9-4977-9aa5-0aa7f13b6b0a", "value": "3072:Xq0zGr2Pu2xR592uJBnk9H70KQ1m9I8SwSw6J0rMeRV:60NPuoZ2uJBnk9o35Ejf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768247266, "uuid": "6bc05a8d-aaa4-4aa7-8996-077c4b04da3d", "value": 194352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768247266, "uuid": "6ed97fd1-5d61-48e3-90ad-62cc01fac172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768247266, "uuid": "ac46c665-7020-4fb0-852f-aa2da42f2b1c", "value": "nigga", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba72471f-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216841, "uuid": "8324fdf4-9e79-45e3-a03a-c4efadf0cf18", "comment": "Malware payload (Mirai)", "value": "c185be33f4015ec9c299d146d9385de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216841, "uuid": "97d0085a-766b-4f6b-a00e-70cc2c71b48f", "comment": "Malware payload (Mirai)", "value": "ad21dac5752d485775ec55f34a2cd7cf54857391f8238a1364d0d59a47c8aa4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216841, "uuid": "8647d90f-b3ab-419b-89ee-ae2555854ad4", "comment": "Malware payload (Mirai)", "value": "39fa1df6d440320a6cbba1a524ed9376730340d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216841, "uuid": "24388f5b-750d-4241-9d0e-6e0913c9f991", "comment": "Malware payload (Mirai)", "value": "d04903d58038413fa34e477a502d8377e7c0154dd27b7f6d640000d54e5ca1ffaff399b1e107471b5d8f6c61d67a7332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216841, "uuid": "01cdd74f-6fb2-411c-9690-c056bf66c3e0", "value": "T17B832A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216841, "uuid": "f3be61ec-65b2-4b4e-92fd-406c6ec79b0c", "value": "1536:Mqbd7IdAcsgBY+T4AALkCkj6Rv3U8GbdGrAyvQ7ol:Td74AcsgBR4lkCdRvAbdGrXQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216841, "uuid": "6b70aa16-8671-4f4d-b757-87100fe73fc1", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216841, "uuid": "4f34064c-bc35-4cbf-bb27-9ea0afc0919b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216841, "uuid": "cc2573b8-68fa-4063-b459-fdfed76a2aa4", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c01d6-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216793, "uuid": "4701cb9f-7c1c-4f38-bfea-4be1b21e27ae", "comment": "Malware payload (Mirai)", "value": "404e07ed333fd04db57b628884447773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216793, "uuid": "d51e3b27-15d7-4d02-9c30-756937f146f9", "comment": "Malware payload (Mirai)", "value": "ada3488700c1af5afce6151225a41ac99be9c6adf1a5833ab57bf3bf859491d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216793, "uuid": "d814e51f-b3b5-42da-a23b-2a3af0bad515", "comment": "Malware payload (Mirai)", "value": "dda2259375d001f62bee2ffa53d46f49c5f78ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216793, "uuid": "0cbbe624-1910-46e1-bc9b-dab0fec7dd0f", "comment": "Malware payload (Mirai)", "value": "cdad6f67503ea752f21b70287d511e954816f6798f50ae81b7e74929d0d35fb13fe8c96ed72d97ceb553fb11bac9f7c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216793, "uuid": "eecb82ff-b7f2-4b40-9244-e409027bdcc7", "value": "T1F6933A45FC919A12C6D5137BFB2E228E372663A4E2DA3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216793, "uuid": "b5ed20e3-4698-4ee2-aefe-5ac5d2dc890a", "value": "1536:9Ot4/NGRVrAFcqyJwXb86PVLIzAX5iXffdXLamvtI:9Ot4/OVEWNB6PZIzhPjtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216793, "uuid": "d8d64634-d4bf-46c9-af02-d42f99ddec02", "value": 92240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216793, "uuid": "8a98d9ad-d4a7-4602-bede-dffc89df147e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216793, "uuid": "2e65ab43-8925-49b6-92fb-b0e2fa534ec6", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204ef0f5-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179645, "uuid": "00f22694-c91b-4dcd-9dd5-c64ae1d8f78a", "comment": "Malware payload (Mirai)", "value": "d27c80bcb036aab1fc908248349ca98e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179645, "uuid": "a68cebb8-baa2-48e4-bd41-d5b6c4dc0646", "comment": "Malware payload (Mirai)", "value": "adea35fb6a67861e320c2d2b410e5f44d1a221dc3c4769d992e395c1d57c9d8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179645, "uuid": "9c57e397-7a08-4151-9fe2-585fa74d2755", "comment": "Malware payload (Mirai)", "value": "c6aadcd04e4b71004913faae9f66fc1c7b71de90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179645, "uuid": "5a379f40-0b62-4635-b215-b01d4cc9dee4", "comment": "Malware payload (Mirai)", "value": "20ec19b2cba8000c9f0099807312828315c6202580e33aa7175fe6417fc9896c627445f5fb389be596f2bd5c38858aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179645, "uuid": "d74fa27c-bec9-444a-ae15-6c438176795e", "value": "T1DE932B52B400DD7EF85FE2B380574B06B12477D54E122B2B7A26FEA3DA6D0A41C1ED47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179645, "uuid": "59dd5381-306d-41dd-8b5f-4644699b6ca0", "value": "1536:4GHuJzAhMf4/0JIA3ZfUEs6q/Gnf7oPuMg3AuBGxEX9PO/XPFPYl5Hpvb8uYEETZ:4cuVmMA/0JIKZsEs6qIMGTGI9POVPa5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179645, "uuid": "ea446c2e-f408-47e3-ab6a-20f3708a6afa", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179645, "uuid": "60c51e40-089f-4128-aca8-b7022539e886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179645, "uuid": "ab07a88a-5fb0-4d4a-b57a-7e23310e3962", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2001c9-efb4-11f0-a129-42010a9c0007", "comment": "Malware payload (SilentStealer)", "timestamp": 1768221887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221887, "uuid": "bcc342df-2370-4a27-be54-a990855fe143", "comment": "Malware payload (SilentStealer)", "value": "4e72be1328a3b98e7f8c408a668ef868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221887, "uuid": "7dd2036e-e16d-4554-8972-536960c69887", "comment": "Malware payload (SilentStealer)", "value": "ae64d67a31fbc00fef0d6321023e0dba494598e00494d5115ca999100d61c421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221887, "uuid": "07aa5caa-8e44-45fe-a364-1b63ed0034aa", "comment": "Malware payload (SilentStealer)", "value": "7b6e64f9e34606293c4724edf759eedf49eda744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221887, "uuid": "70389950-f3fb-4599-8ced-7ff45eedf036", "comment": "Malware payload (SilentStealer)", "value": "dea9a5f8a05a9b8d60409f4e3180d3f37df18c06d3309f5a85364bf142d3276f5d2c8f150a733cb407e25cd30907f468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221887, "uuid": "6e1184cd-64d9-4f31-9c66-7a4498419640", "value": "T19FE73331902FDE6EC2359777B01E03E152D9DDCA13831DBAB58B53BA460E1B1CFA9618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221887, "uuid": "5a2e904c-ca07-4229-b5d9-ce55b985989d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221887, "uuid": "c4ebf979-07a8-483c-bc11-89fc3ae1bfac", "value": "1572864:dE2sy1Hw4AUtw1VbCzcxX+hz3OrrPj+zrcHLsAbkQGnq8g:dE2sy1HdAUu5CzwjXGrcrFQQG5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768221887, "uuid": "0a38f7b7-b902-4e8b-b938-c17f42b3e90c", "value": 69541365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768221887, "uuid": "7d0963f4-b13b-432f-83be-ab4a485b6bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221887, "uuid": "dce777f9-6e23-4871-8d49-b6d8d3650a9c", "value": "XaynePackInstallerSetup-6.9.0-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6744d06a-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214553, "uuid": "929daf44-b6cf-40d0-9de2-701a7f5bee49", "comment": "Malware payload (Mirai)", "value": "60512c6540536899ae68a15d4f994086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214553, "uuid": "deffe745-1dcd-4b8a-88ef-31126e3e8947", "comment": "Malware payload (Mirai)", "value": "ae9b9db9c17f595b544a2eb61902c738a51f0d307b84faf894a94138105efe84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214553, "uuid": "b76dfbd5-afed-48f0-b20b-aeae9624a09a", "comment": "Malware payload (Mirai)", "value": "71c00f19a51333ff4fddf750abb319f26f5cdb0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214553, "uuid": "72afc52e-a31e-4511-a856-9be89f110b90", "comment": "Malware payload (Mirai)", "value": "26f0ee2866f75925ce6f268ed13bcbf676ec6908ebe948726c527023879a93379dc1d3f77b4236ec9eb843513195a49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214553, "uuid": "f1e13ead-85f4-4ffe-9a1a-e9107b6c9fcc", "value": "T1A7435C03F69290FDD08AC274479FC6A6FA32BC9523207AAB3B98B9311F35E51171A751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214553, "uuid": "afed1146-2bf8-443c-a588-c08a95a50e2a", "value": "1536:MX0tROOszF30NngelEwZ48mrdWkMudCX/FwjXIfQWOC0or+:MX0tROOszF30Nn0x8C0budrj4fPOm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214553, "uuid": "068e5bba-9bc9-438a-b67c-77e02a27ee9a", "value": 59360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214553, "uuid": "3df1ab17-6ea1-48f2-9834-fac8fa5c2caf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214553, "uuid": "8902518f-9a05-46f5-a5a4-b60b35a3711a", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411ab11a-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182277, "uuid": "08843812-095f-44b8-99c0-22bed3e69dbd", "comment": "Malware payload (Mirai)", "value": "4029f67e87ccb7e1af1451d67cf79e42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182277, "uuid": "c208c27c-33c2-456d-ae57-fd2dc6331aaf", "comment": "Malware payload (Mirai)", "value": "aec6c005b2976017c0b8655aa3ff28dffb4d616c2dd9c132186f7b3e5bd51598", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182277, "uuid": "acc62710-cc79-4f6c-acb4-99c5c6acf331", "comment": "Malware payload (Mirai)", "value": "32498ce68c51631b3ccbff6e38aff7935cddbde6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182277, "uuid": "3bca8170-7695-43c0-8efe-2ad8ad6d95ce", "comment": "Malware payload (Mirai)", "value": "e53110cfbc7fb34cd9be784bdf9325cfe30d0b882ce024113e5900e502577eb41c38ae0f1457951d64f2b7f777de6cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182277, "uuid": "c8b33de1-b7d0-4339-b58c-b735089ea587", "value": "T1B7A31235AB62C8D4C2D3D4F93418607F536AEFEEB84194ABF44621C67C46464A3B1EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182277, "uuid": "10696a76-4234-4ae4-a965-0db7af15aefe", "value": "1536:yp4OnkI9oaJa72ykErJKRnGXSasDESTws4mPsxu3Wf51ea6lP++sisb7uoUQx+f:yp4OkI072y1oNDES9ou3WfHWPcnulb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182277, "uuid": "735744a1-4a58-48e9-bce5-b3ae46fee92d", "value": 100588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182277, "uuid": "f09f5080-7dc7-43d2-a236-1e74e33e138e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182277, "uuid": "23840138-2248-4843-8b7e-8f9e4b3e0dac", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dbf9f4-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217532, "uuid": "4bf30c5d-5f27-4a0a-aff4-6173f4ffbf38", "comment": "Malware payload (Mirai)", "value": "822996f07265feb448de8d53e691b566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217532, "uuid": "92474d0f-aee3-4d27-94a1-b1cafad6e4b7", "comment": "Malware payload (Mirai)", "value": "aec9c57a383a95c3b90a4ced5b6a0e5d4a73d4a7b8291eba84d4917283452b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217532, "uuid": "768a944c-44aa-46b5-89d8-a1da07a82311", "comment": "Malware payload (Mirai)", "value": "09414b0259f38ecb1bfd0cdac2d74812134a4ac7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217532, "uuid": "d43908bb-65f2-48de-8d6f-f416be156502", "comment": "Malware payload (Mirai)", "value": "abf5c42fe28ee9513d4e2ae6eb3320665c827436fbd62f1013acea02becc8eac90b0dd0108b7009f7c1a841b7309ca90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217532, "uuid": "8a6e5691-ca96-4f8c-ac0c-8c9bdd6745b1", "value": "T13473AE70D0285CF0C6880A38A5E99E781713F804965B5EF15E5A87F6A8179FCB60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217532, "uuid": "c914ab25-db87-4dbc-8b1c-5e90ccf7e93f", "value": "1536:9/VtsH6hhPEwtA7mDqYREcs3IEfErZuEfjg+FXCq+Om:99tsazPE77mrRBrrZuEfjg+FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217532, "uuid": "d2e3e34f-1468-429f-b320-527882ad947f", "value": 75484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217532, "uuid": "268a7369-3587-40d0-a717-fc60f4bd0fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217532, "uuid": "a41626fa-cbe8-4fba-863c-9ffca9309e5f", "value": "db0fa4b8db0333367e9bda3ab68b8042.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b8c8a0-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180218, "uuid": "35899dec-8a50-400f-b272-bd1442d2fef3", "comment": "Malware payload (Mirai)", "value": "a93051e6c04a5a1b6317578927d5e42f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180218, "uuid": "1767be5f-d28c-4d0f-8cbb-9e5c483de138", "comment": "Malware payload (Mirai)", "value": "aef494ba07bbab80386b05ae1f9abcb3d47eb136902785c4b0d61b986ee85a3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180218, "uuid": "729ee43e-6a25-46b4-823c-8421d252a66e", "comment": "Malware payload (Mirai)", "value": "f9f1582089ac2c6850e898999fcb50e3ee2369a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180218, "uuid": "c7dc9b01-8d84-4456-b718-f5078013915e", "comment": "Malware payload (Mirai)", "value": "fe7267044ab489610344ed27d1a03f3abb492199f72521e612e02e0540ce45d4b34c2031d931ab0d9f06584aba0b0241", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180218, "uuid": "572faed5-c121-4433-b1b6-e8eb4761e768", "value": "T1EAB3F80ABFB11EFBE8AFDD3345AA4709289D450621B93B793A74D81CF21A18F05D7C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180218, "uuid": "46799a8d-59b4-457b-8d77-abde96a84f2d", "value": "1536:CvR8ERD2s9JgYP+LOqZSP0mrvJYCf4NJccXavEHNW9krJis1MIY+Uj6UQM0RN85a:C58ENJgYPSOeM5XiXe82/xufTAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180218, "uuid": "25116e4b-a720-4f1c-a345-62c1bde1dfcc", "value": 113384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180218, "uuid": "2933b550-dad9-44e7-b1a4-a8895db7a289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180218, "uuid": "ca96b301-b397-4dad-b3e6-8966de4936f0", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5884b896-ef5f-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1768185323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185323, "uuid": "6d087766-1a0c-46e3-9bc7-03d1934956fd", "comment": "Malware payload (NetSupport)", "value": "49c735e62d081cf81d3a1755eb338532", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185323, "uuid": "5202dc3a-794b-4d23-ab38-09543c65eedf", "comment": "Malware payload (NetSupport)", "value": "af2b4b3c5f8da63a98e0e428544919a76d43a8ecfd316cd3c8fbd60913cc4ea2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185323, "uuid": "8c7e8e67-a5ba-4850-8099-ea4b2352e4d0", "comment": "Malware payload (NetSupport)", "value": "d5ebc236db0690e04dfe2c42698a283f492b9708", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185323, "uuid": "bd07f9a5-c7a0-458d-81f7-28c03c6b842e", "comment": "Malware payload (NetSupport)", "value": "a508f7920b0b2ef8a5a622c36646c45d856c8169463830e79e3cd35aaaac1f64e6913a38c1231bebc8a6644b19d5b082", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185323, "uuid": "0fc313c0-1a35-4dda-9fc5-167067bffeb1", "value": "T170768C9EE622C205FC1E1C751C756C8C2CA421A862E1FEDD4AB4380D55B1E7F4AFD29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185323, "uuid": "3b074b91-3f21-4afb-800b-785facda9d82", "value": "9db8fb801c5bd8b1a1aa19f58cc65475", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185323, "uuid": "83d593fb-7d69-454b-bd75-7bb324b3d475", "value": "49152:uD4S51XuWoDlGJlV7qrYUd5ylUZLa6a2SoVUuy7TFtcKVRso1Xon5nLOKOHR+veI:uDWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185323, "uuid": "3b372afa-4831-423f-80fe-24b849292f06", "value": 7752712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185323, "uuid": "08af38cd-d7ad-4837-b54d-ad54a994d7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185323, "uuid": "e8c56971-cb89-4f3e-9e91-5c189af40a77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00571aec-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230272, "uuid": "65e2bc7a-2b21-4107-8f19-d72ac5747363", "comment": "Malware payload (Mirai)", "value": "3fc0c61a0843e6e10731a0d56704ce4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230272, "uuid": "e72c7e62-a8e0-49db-8c06-480c3ab7c919", "comment": "Malware payload (Mirai)", "value": "af97f623c9b765c5d83cf01d6db4d99962e82bcaaae7b1f627e11579e4322e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230272, "uuid": "aa923cbe-914a-4100-b9bd-5117fbb92432", "comment": "Malware payload (Mirai)", "value": "0e2a1e22417766b58333c0a8425e0faa6aacb6f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230272, "uuid": "9c49de99-6e50-48cb-ba05-91af4a66dda4", "comment": "Malware payload (Mirai)", "value": "da7dea32650e6b4b6c96833974a3b62381a669be3d978ee3a711eb25f908553f2df2ba5f3b9f589a752bec1ce238d023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230272, "uuid": "fe538b2e-33f1-43dd-8fec-d0bacf38db4c", "value": "T10744F95DF880977ACBD0217EFA9602CD33334F64EBDE320589356A3837D6B25993A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230272, "uuid": "57f3cf01-0017-4273-9812-4926199ae29e", "value": "6144:q1Qe5ul8PqyYqyxvPqryP3pnS3W5839eJVJNWjNEJ2Sb+DJhjIt+ZQFnAHyZd0E:/rAW58390AFjCdAHod0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230272, "uuid": "3d71c61d-967c-400b-823d-af648d4cf197", "value": 262012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230272, "uuid": "fe989b3f-e079-4539-89d8-ed45bbd0de47", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230272, "uuid": "101f3261-5b18-4178-8e8f-93abb91147ae", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6362f2bc-efcd-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768232586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232586, "uuid": "b2233bf3-9849-45e8-b9ab-b07fcabfde65", "comment": "Malware payload (ScarfaceStealer)", "value": "fde8897ad3ef88a07f3715e8195a92a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232586, "uuid": "070e9dec-9324-4f17-b61d-f27114181c42", "comment": "Malware payload (ScarfaceStealer)", "value": "b05c0314c964c03e0e6cfae4cb70d376d4032ba9127b72ed4c133e701ba93d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232586, "uuid": "7c21bd2b-81d2-4bd1-b6b9-537f2b522251", "comment": "Malware payload (ScarfaceStealer)", "value": "7c417be5393898d7037e3ef0a6190e0640d2902d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232586, "uuid": "cf57a9da-e836-41d2-95b6-09db0c71db3a", "comment": "Malware payload (ScarfaceStealer)", "value": "b1b45fb55180925a7bef6418c9519c33c3dd523632dd47bf6f9cfd8751a4d76d9690cb416f2ac9ce5e0f815470086d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232586, "uuid": "9a7f893a-4d93-44b2-9537-426522be1dee", "value": "T118086B4666EA04D4F9F79A749AE66213C673BC063F30D5CF3208172A1F736E0997A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232586, "uuid": "778a2cc1-8127-4b31-bd8e-551b38476daa", "value": "04397e0bcb7648e70cf6570253f46feb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232586, "uuid": "8c8954c3-630e-4d3b-89c8-1a1555145ba0", "value": "393216:2FmNYSYZXCpixyZbvJVANEEgC/Kyxf663DQu58EASEhoIaE2lShBujCm5w1PN3hR:2rHx8iQJhYWuhvYvxOOxe5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768232586, "uuid": "ecc54be4-f73e-4886-8549-adbe535bed85", "value": 82537454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768232586, "uuid": "7ee8dd47-65ec-43f6-a016-d9a2c3491466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232586, "uuid": "69963923-671c-4c2a-a713-eeeaac570025", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97188f5d-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181992, "uuid": "467fda04-e81e-4478-84f0-f1c3f7e1f5c5", "comment": "Malware payload (Mirai)", "value": "64930bbd8e1c5a26e9aaff19cae3a2f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181992, "uuid": "a70e1ddd-fd32-47a2-a0cc-428c69f18a04", "comment": "Malware payload (Mirai)", "value": "b06ac6a2d85b006a7fb944fff022c5dc6c52386c02b041c3aa8ec10447916e7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181992, "uuid": "1a27fe71-f8ab-4445-b670-65b988bff5b0", "comment": "Malware payload (Mirai)", "value": "b2a879ba8add655295af15e59f31790d9ea5b3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181992, "uuid": "deb9aa06-3fb1-492d-9c12-e1e67121905c", "comment": "Malware payload (Mirai)", "value": "34279742dae97ce1cbc3e467e02ec7a6b6809bd743e9270816cc4f26180bd6196d808d3c8ba523add8a582acc372fc52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181992, "uuid": "74908227-e47d-4060-ae4e-9c039e2e8cd4", "value": "T13C337B72DAAA9E54E61C52B078308F7A4B835500978B2EF696D9C675D003D8CF18D3FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181992, "uuid": "56c97147-596a-48d0-b95d-e277f9b97329", "value": "1536:7hXgo2SnyiiJ2jziNadAC42iICAT2bVR:7O+yX2ldA5T4T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181992, "uuid": "26a2bdf5-0f30-4e48-bad4-d3ece0acc3f3", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181992, "uuid": "dde4fddc-fdd0-4a20-9c83-7963f5ae916c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181992, "uuid": "0f451a77-4fc4-477d-ab33-c74a9145b627", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37529666-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218768, "uuid": "214d5737-6029-418f-ade0-4633a691d9d9", "comment": "Malware payload (Mirai)", "value": "8b3cfa0cb3350d972a23f4ccd4743e1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218768, "uuid": "d747f8e3-5def-42d6-8ce2-20f234d4438c", "comment": "Malware payload (Mirai)", "value": "b0c4bc916bd9dbb1fa47f75c00ef316585683ec7239a3ffc7848d71f3a5f2230", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218768, "uuid": "41dbce6a-0a7b-4dfd-a15b-fdb05a31d5b3", "comment": "Malware payload (Mirai)", "value": "fb2ab740f6a4aaec0b612e4b1d728e0a4805a0ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218768, "uuid": "e3029566-94bb-41e3-886b-45b9f2fec2f6", "comment": "Malware payload (Mirai)", "value": "c1b110f00781a7ab780372fc74b87fbce4301214c5676ecdd55fa3871590b46d7fa1d024d0411e3487591105d1bb2f53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218768, "uuid": "7f7c352e-37ce-42fd-9d3e-d99dc2eb96b7", "value": "T1F6044C46EB814A13C4D62779B69F524633239B64D3EB33069918BFB43F827DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218768, "uuid": "36fde038-4630-4551-92e7-871ab024f06f", "value": "3072:lBPR0atTo8saehF/h9XRpgBcAwjCK9RUd4PyoWAM/9ukDm1M:lBGCPsaehF/h9hpwp6CcR04PyodM/9uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218768, "uuid": "8ed768ef-935e-4813-a1e7-96a5026ba343", "value": 176523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218768, "uuid": "5202fb81-ef6d-4c4e-837a-8a7c904c906b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218768, "uuid": "2d3f8859-cbb6-4af7-9e46-9a1ab7d0654f", "value": "johen.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cea4f7-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230275, "uuid": "4d21d06d-869b-4c35-aadd-234bd5c45aa4", "comment": "Malware payload (Mirai)", "value": "beb5b78f0097e7d94f8de65a24b48fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230275, "uuid": "062aceda-c01e-4a21-81f8-d1f12a466189", "comment": "Malware payload (Mirai)", "value": "b0d7e822db7dfb13a8c4c6456b0e7b3f0230d59b39e29533a4f69dd4b76b997c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230275, "uuid": "da2bd0be-b4bd-4441-bbc5-36905561a70f", "comment": "Malware payload (Mirai)", "value": "998b912997784a994ede51881c5cf0921d3070ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230275, "uuid": "6f88ec9f-1979-4f09-9dd7-8f61c942be1b", "comment": "Malware payload (Mirai)", "value": "c0e41fcf418a0a044b62a70ab9071a610c0787f55d2894312c3ed8736efb8e1fd8e3472fe742b1445a012d2e39b5cae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230275, "uuid": "9127d860-b0e8-4e26-86cd-d7375c495613", "value": "T105556C2AB2F2E66CD007C03497DBC6A14521F0752A323D7B3784DB352EBADE55359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230275, "uuid": "91b55c56-1204-4121-b6eb-f572128ede5c", "value": "24576:jvPOXBNguN5NzEnIbAXgggh7NcbmCav9EtZLQ6dOLY:jvPABNgyAIbggh7n31gLQhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230275, "uuid": "a00e2ca3-4f14-4dc0-a66e-5265801aed05", "value": 1314544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230275, "uuid": "5dcdb301-5e99-4c97-b9aa-b52bb1877c76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230275, "uuid": "523aa5d4-80e4-42ac-811f-43a2567fcf3a", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0af4e2-efb4-11f0-a129-42010a9c0007", "comment": "Malware payload (SilentStealer)", "timestamp": 1768222053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222053, "uuid": "a5a04f37-6639-4ddd-8164-45e769f359bc", "comment": "Malware payload (SilentStealer)", "value": "328af41e6aac5df70e9611d4584e8b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222053, "uuid": "203cff33-653c-46ab-beef-df34d36d6f93", "comment": "Malware payload (SilentStealer)", "value": "b16e6b56b4adaa070de1da74f9c6f16469182397f80d2587c5dba3229fdf1898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222053, "uuid": "1458b361-2030-4583-8a15-b6ab4f9f0c8d", "comment": "Malware payload (SilentStealer)", "value": "5b99a297ded651f86a29a74404213e85ede32be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222053, "uuid": "896e2fcf-ee04-4633-b839-99cec5b629de", "comment": "Malware payload (SilentStealer)", "value": "7b8f71fadbc4416d8d9f339743291f62d78179b0c8e38edf7541fd05642af2c6e25348676c997c0f130f098688b91c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222053, "uuid": "734da050-db25-4370-bc44-8aa18f0c7167", "value": "T1B5E733A07505F11ECA5C5BB7B044CAFB94D9CE6A0B121D3979CE975FE0838B103A936E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222053, "uuid": "80e60c69-86ea-41f7-a236-e16e9adc9661", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222053, "uuid": "0a667165-f334-4adf-aace-a0f72f5d93da", "value": "1572864:p02sy1Hwtbz9+tw1KLrrIW8GhfeSB4D7/wElfVNFjcGnq8N:p02sy1Hy9WuK/rIW8GhB43DFcG5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222053, "uuid": "8291c798-197f-4fe7-9a0e-a180344d3f06", "value": 69590309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222053, "uuid": "c9019e0a-a551-4f49-a9f4-c47ac097821f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222053, "uuid": "f10ad35c-7fc8-4dd6-915b-226ba5a51105", "value": "ZelyanorSetup1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299762d7-ef4f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768178372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178372, "uuid": "4c4a979c-40df-46ac-ac2f-b67a2bd8da4d", "comment": "Malware payload (Mirai)", "value": "2e659c561efa2683c060a9812943331a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178372, "uuid": "eafa5b46-226b-488d-acfc-0836a2374d3c", "comment": "Malware payload (Mirai)", "value": "b189ef22bd730f073e597da65894abc37df3d4d36549fd0bdf87ccbceb1bd0f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178372, "uuid": "dbdc7446-959b-483f-8923-cdc00424a688", "comment": "Malware payload (Mirai)", "value": "4819f11f5ec4fae0e9dc6b7fd3a5ec195a7a85b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768178372, "uuid": "19168e2c-e1f5-4a56-8961-4a3a73ab121e", "comment": "Malware payload (Mirai)", "value": "d42ebccb200d2849e1a47f0453f961899d1503b47baffa9047dcad2aef6aaff988078b39d4016bd702a0c427f518517a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178372, "uuid": "502d4b75-a573-4ecd-9d44-5f4dce526894", "value": "T10A143A26ED90C0AAD457D1B86BEBC1B2F330F8F40321765F33A96A352E75E505B19386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178372, "uuid": "66ec2623-2ada-4d5a-a955-cdf117f3e644", "value": "3072:3uBS0fVBFMubmW9G1idi0BLtoromWbQud7LfFe8swY7bJ:3SSYVjvbd3p7mWbB68K7bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768178372, "uuid": "9ab61015-b2c6-419c-8d2c-75171dacf2fa", "value": 196280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768178372, "uuid": "9632c80b-f1dd-4266-8bcb-21d63fa51116", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768178372, "uuid": "35050d4a-596c-4a8b-b2fd-bb1514367864", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94978775-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230521, "uuid": "1884a298-487a-4c34-991e-15edad95cade", "comment": "Malware payload (Mirai)", "value": "711cdc1e1ee89634e948ae5a3230eac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230521, "uuid": "ff4b6df0-c73d-42a8-9bb2-4e4dffd84bdb", "comment": "Malware payload (Mirai)", "value": "b189fe06536314551f446c5b862463a75ae4b740b4f1857c73c7de8415e144a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230521, "uuid": "8381aa69-75be-4a8a-aa3e-45e6a1d68c89", "comment": "Malware payload (Mirai)", "value": "eb235da527d2752480cd3cea0b5f335100a25a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230521, "uuid": "b236e00c-d18a-40dd-ad8d-69dc86f4df2f", "comment": "Malware payload (Mirai)", "value": "fd036c0aac9155f2a132ebc1133a87aaf8e2a3396b86b9524d7d0be06a9c1f513a79d69de35b4dc84c1581fb5332b4b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230521, "uuid": "9e1e538b-8eb3-45f4-b328-7c775b4a2fb7", "value": "T1828302465B044DD7E41E0EF9124ADFE2B7CBB8B5514498F3CB6598DB8ACC098F848F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230521, "uuid": "082fe23a-7870-4094-8a5b-587bffc8b3b8", "value": "1536:KHiNQwTWAf6vTXkYjERPI2E1G+dw3iTJ3MLZSEOSEjySM7BjiGou5Hlpula/Mv1G:JNQwKtL9ERQ2MG+WiF3MLZBZSaiGouV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230521, "uuid": "c05f9827-5c80-41e1-b56a-9b21bc570e96", "value": 84804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230521, "uuid": "37bbc1a5-7584-41e2-a988-66915d063012", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230521, "uuid": "a8c2fb5f-a554-425f-9fbe-feadd1d1d3c0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b646ad-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216836, "uuid": "3a83b9a5-6e53-4d8e-b02a-c0aaa2c17d8d", "comment": "Malware payload (Mirai)", "value": "b143e0685dc00d2f457d4656445cb745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216836, "uuid": "d5c4c211-97e6-4d21-a7c4-3fe8f349f4fa", "comment": "Malware payload (Mirai)", "value": "b193cffafe15f05268117624ca526db46adecb8045f6f88120b1b3f2a3ee0eef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216836, "uuid": "3367f709-736b-4b90-a7ed-8552fd260a1d", "comment": "Malware payload (Mirai)", "value": "ed8aaff2d1148bf7b6ed05d344d68e715a932547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216836, "uuid": "c9fb1708-fdd6-4d1b-9c33-e74507ff8c99", "comment": "Malware payload (Mirai)", "value": "0ade7b0f56df295c7291cc78745c3fef740833546198c98bd0d5d6374e7bb7f6f9e87d3463d65f95748e5ff0d881bb12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216836, "uuid": "87f07571-0a03-46f1-afdb-d4710ec3c2a7", "value": "T1258328C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216836, "uuid": "024ae797-f2b9-4094-a94d-aa2e18183257", "value": "1536:ivDwDhVtcU4xiUWaqH3FYqe80WJi+Kj/Osv4gv9l7vP:sDWKzQLH3FZzo+Kj/Oc4EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216836, "uuid": "0bfd77db-332a-403e-bf4f-042c31a498da", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216836, "uuid": "ac1e5ecf-8109-4547-9c3a-40e540ff036c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216836, "uuid": "b70a7ead-6a47-43e5-8c60-f56be857a56d", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521b9573-efe7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768243724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243724, "uuid": "745ff5c8-7ee5-47e7-bf40-3bd7260cd404", "comment": "Malware payload (Mirai)", "value": "984e7667ba01a228068ff21daa70ce81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243724, "uuid": "e39aa1ec-a7a7-47a3-990c-28f88496fddf", "comment": "Malware payload (Mirai)", "value": "b1c1c098ce4c4d40d849b435f3dba4faf8029d1028010fe56593f2853030d6d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243724, "uuid": "a494c5e8-6e49-4ff8-9229-d0b1962d47de", "comment": "Malware payload (Mirai)", "value": "8c078a619597c13037c55e91a72e08f5ff141fcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243724, "uuid": "cf08be87-51a6-42ca-a4c6-06ef6a6a867e", "comment": "Malware payload (Mirai)", "value": "f63faa219ac5282db1052503e68a5b7211edab4b89589693f555f64ad1457ae2fdf2c78e73336fd3fc49bfbd0911b852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243724, "uuid": "4bc56005-13eb-4a29-8c5f-8b0b2e1019bf", "value": "T106D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243724, "uuid": "f03e1771-c143-4f59-b072-fba0b6a81e68", "value": "3072:1CldeCsOs9kzj2vV4Mhkhgif9EG30A2t5lsLXj8o:wPeCK9kzivV1hg9tymLz8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768243724, "uuid": "6c9537e1-5907-4c85-be21-a22049dd681c", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768243724, "uuid": "8035976e-349c-4e39-8f9f-47e9dcf1c780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243724, "uuid": "784d984c-c5c9-4aed-a4dc-bc1135ba2fb9", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3fca1-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216722, "uuid": "2d05a07e-7879-4a35-8be2-26270d769184", "comment": "Malware payload (Gafgyt)", "value": "4aa2d514473bfe503011e3c6da351b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216722, "uuid": "2dd6539e-b3f6-46f4-9e8a-ba254be623e6", "comment": "Malware payload (Gafgyt)", "value": "b1d624340813c3a08151e246b33e2caf7d2024809712eef46cd8978c3b31fd4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216722, "uuid": "9ff5c3e8-ca4b-4f45-b7b6-1ba2048c5dca", "comment": "Malware payload (Gafgyt)", "value": "3db5ef15712a220e38bf195ba5788daffe3fae9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216722, "uuid": "e592f254-bbd4-4088-a4a3-02bf370be627", "comment": "Malware payload (Gafgyt)", "value": "ce5c3843059cc796afedf4b27550af275cf7da992686e1de1847976a8994ab98cd53ecbfd530a8df69da20195b2d8395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216722, "uuid": "882c1db2-993f-4020-a533-926ef3cbcd8e", "value": "T1C2A34A5381A89EB7C083EE7929EB99701327A9521B2F1F5421385BF4038F9CCB54EB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216722, "uuid": "b3e71798-7963-4c6c-97df-19b8e5a0c923", "value": "1536:2iG2udDHZk2TwxoGt651dY6zMHcRyb1ixVtq/Y8W5mS0T/7LHYvE:c7DJTwxoX7LcRbwy8mrT//HYvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216722, "uuid": "98ea0ccd-e150-451c-ba60-5f82c4d57283", "value": 104407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216722, "uuid": "d838eda6-f681-473d-bf29-1c8b4c008a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216722, "uuid": "1bb03be4-1e77-4694-82b0-556ecf2c2aaa", "value": "s-h.4-.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1a7c89-efe9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768244764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244764, "uuid": "7705eec2-439d-47ba-bafb-53d1a90d1c06", "comment": "Malware payload (Mirai)", "value": "041c8d783637791e9b63f7ad8c77e376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244764, "uuid": "8c489c3e-10ac-4502-aef4-0d3cbd445aa6", "comment": "Malware payload (Mirai)", "value": "b1e880a1c89c5d632c6b8a88a28ddd9bb6a99705e903312111183175e15138b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244764, "uuid": "e5fb1b3b-a347-4bcc-92e2-cdeba47066bf", "comment": "Malware payload (Mirai)", "value": "3f4b133a944f5b9cd0f822986f47d13b48e6b54b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768244764, "uuid": "5c7691e1-3709-4120-9de9-f125c19d540f", "comment": "Malware payload (Mirai)", "value": "075b083bf2aaa28218de2e6c6e3a6745c687bf8eaa4a68f0be5559ece6d9793beefe34f893147573db7cb4edc046db8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244764, "uuid": "3f06ff8c-9885-4e89-ae1b-490dd8882639", "value": "T1EFB36CC2F743C0F6D85305B1507BAF369E33D4BA5025DB42E7689A31DCA2A05D71ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244764, "uuid": "af85bff2-5e77-40fc-9cc1-c61c29bc3e5e", "value": "3072:EPian1DT8im4EgPg1dRP2V2Zsv1hIB18e7:Eqan9jSukZsvo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768244764, "uuid": "59210315-c253-48e0-b55a-cf267225be44", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768244764, "uuid": "7fe93fee-7473-42cf-8d31-f842458f8619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768244764, "uuid": "681979dd-3dc9-407c-8f70-81af3e0b3692", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a3afd7-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224808, "uuid": "c46fc313-7522-4441-b723-6c87b9bdde99", "comment": "Malware payload (Mirai)", "value": "d8efcaae4e08cb68078717751d55ba7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224808, "uuid": "9a934fc6-2c8d-4db6-82d2-e641f280f79f", "comment": "Malware payload (Mirai)", "value": "b22a0cbbb294a31e2a193e00b11365d1242dff92ad660e2c712c593446f4fd98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224808, "uuid": "7d366752-eaa6-4103-b822-f43488452ff0", "comment": "Malware payload (Mirai)", "value": "47e9d438483a19bd27cf2937b2132397ac59b7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224808, "uuid": "207c5981-63bb-4dff-9e10-8938bee9ae7e", "comment": "Malware payload (Mirai)", "value": "af0d66fef564f2e8134dc9fe47d090dc19324d881c789c7611aa0d0b4e498ebd50abb192b414b2e1c67f0892deff1576", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224808, "uuid": "f54ae1a4-ce9f-4a9e-821b-32bc79904613", "value": "T1E3934B0273654447F6A70DB11C3F7BF193EED56121A0A286695EEB0F8136E32158AFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224808, "uuid": "f44a40b8-913a-45c1-8550-8fd537bbcb95", "value": "1536:0B6oHpOEsyqnD8VkrLYIHiv2D5wB4Pq0R8b3rIGAuiU6kppVg5FDeJI2tnoT2bVZ:wOEsfgmwBBCa3rI2J6kpp+5BZfT2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224808, "uuid": "5ae874db-fc3e-4ae9-93c3-e02230db23e9", "value": 97224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224808, "uuid": "8634466c-a469-4fc0-8aa1-76f298dd90f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224808, "uuid": "ea6e775e-29d1-439e-9032-a902caf384f9", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3c877f-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768223283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "36399572-9f1b-44d8-b5fa-e7fe1e10aaa4", "comment": "Malware payload (Formbook)", "value": "d8dc23424bd0f3e5ba76a1891e7332c6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "e53d3f6a-b02b-4c8f-b1c7-95eefda4fd4b", "comment": "Malware payload (Formbook)", "value": "b26c70dbbd9018430b9fd3c363cbd318a388516115e9048aaa0208c4f1472bc7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "d571a501-a516-40d0-a568-f1beec06c62e", "comment": "Malware payload (Formbook)", "value": "9eb74624377a1382f87641a272f63090b95e5ea1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223283, "uuid": "5d92db3a-d476-484f-bb62-2cc4697217e5", "comment": "Malware payload (Formbook)", "value": "5013f456d9513d0ce26a4c2d76a28d6a408328731dc85c77093cae92395631999dc304a55ff4ba5dc197c8c9185c1daa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "b9f65dff-0b28-4153-83de-5ef0add88753", "value": "T13D5533111D7E5EFD0EF4632D72BE7F2D19E088998582CEEDF3E1AD67030AA019027566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "ab135a9a-d323-42ef-a49c-32f441dfc029", "value": "24576:Da3i6+h8Twgpngwx2ZGmeYJIHXAIsKjCGhCUbO5JPXAEXRtf:c1Tweg3Em+3RCUKD4EXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223283, "uuid": "82f8e484-4149-4cb4-a100-e4735ff9bb32", "value": 1381253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223283, "uuid": "2cb1504c-6715-4e5b-aad3-a9842cf9c047", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223283, "uuid": "0d899dc7-d9d0-4879-b704-7858a5242625", "value": "6u3h4d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faf497d-ef94-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1768208125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768208125, "uuid": "104cafb9-d7ea-4da5-bbdb-dc6a7067c4ca", "comment": "Malware payload (ValleyRAT)", "value": "4ec903337671525e97b5e2b3364917ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768208125, "uuid": "4d25a551-5b1f-4e1d-a250-7581442c4a6d", "comment": "Malware payload (ValleyRAT)", "value": "b2a4cc6ce60adff72d83aa321e13f9c72f7149b46f1a2cdf6b62fc158744cf02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768208125, "uuid": "b3326d02-903a-408c-924d-f38b541e7969", "comment": "Malware payload (ValleyRAT)", "value": "d66b319310e9b7e86d0788ffaddcd12b7be2a78e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768208125, "uuid": "132216b2-411b-4e3b-87bd-f0c8dbaafd54", "comment": "Malware payload (ValleyRAT)", "value": "41c76ec033fcb0ccf91c726d9b15b9e6cafb25d62e70fe4414d4c7c1ba4d488e169ed3731c8a4f38f5dabc438cff442e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768208125, "uuid": "e6d2a03f-c6dc-440a-bdf8-7f74b593aaf1", "value": "T19E057D09BF21CD20DD2DA7315EB0629166BFCFA04B91A09E9FE1B96F0D711D1CF18992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768208125, "uuid": "ce394be7-abe5-4437-9a38-df923eba7e32", "value": "0a4c89c2b7825eb5be087d30227b8429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768208125, "uuid": "7a865faa-0a4a-4bc2-b533-9249a738da7d", "value": "12288:n5UzQzE0lni9qu7wT0NClu7eIKUCH3buu7:tE0lngDNCULgLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768208125, "uuid": "fbdea961-83e9-4763-a5e9-d1ffc850b192", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768208125, "uuid": "5774d8f0-f309-4a4c-a80d-04afd2c94d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768208125, "uuid": "56f4829a-be0b-4577-bd89-c92dfdcc5fbd", "value": "b2a4cc6ce60adff72d83aa321e13f9c72f7149b46f1a2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0011e50-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179940, "uuid": "4e7f89ed-07ff-4290-b045-e5279f7c4320", "comment": "Malware payload (Mirai)", "value": "1a4f432d6e5d7c8b2dda3b4ec187514c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179940, "uuid": "d3fafc31-f17d-498a-a538-4acea63d63f3", "comment": "Malware payload (Mirai)", "value": "b2bf607fdcea8528ccc8902f9e07a3166ce211ff6745b70354053e50da116c61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179940, "uuid": "9bcc08c0-784f-4dfa-8032-b52281b9d8ba", "comment": "Malware payload (Mirai)", "value": "369ee8de0ed3a9511ff50442d4080df6400074a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179940, "uuid": "46cf44cd-3951-435d-a312-8df59c1539e3", "comment": "Malware payload (Mirai)", "value": "3a2ec862ccb4f35f6ee4fb0c7f549d03e3b93ad104851f5cecffa4afd78453c1fc859cbb8be25b905e564171733fb914", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179940, "uuid": "07a5ad77-349e-400e-81b1-1cb2bc2a9bee", "value": "T171837E12CDA5AD98F02E7D3010B8DABB5713A545AD4B6CF73C478626400BD98F1DBBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179940, "uuid": "37e58603-2f47-440f-89dd-51bdb6038ebe", "value": "1536:avGS40d6/93CMo1tbKjv2Q6js7BJFjsZRN0R51BC1FOdAYT2bVR:a+SLgV3O1tWaInFf1B4+LT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179940, "uuid": "833d15c7-71f1-4dbd-9a40-0efdb3171d60", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179940, "uuid": "10afb613-79e4-48fa-a4b8-599a98d4d4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179940, "uuid": "70a079a9-9bd7-4a46-a646-7107edf787bf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a033594e-efa4-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1768215078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215078, "uuid": "2f010263-2a93-41f8-86b9-869f9949c185", "comment": "Malware payload (a310Logger)", "value": "a84b92297d9ae3adc4c61934e7350469", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215078, "uuid": "35df51e0-a517-4c96-bb2d-ee30d01b2897", "comment": "Malware payload (a310Logger)", "value": "b3276b16a2979a330c84198df04a5355ab18ee2b0b289bbff1079bd3761d6063", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215078, "uuid": "2a57a21c-e91f-4334-908b-c57e8bb456d9", "comment": "Malware payload (a310Logger)", "value": "10e106f653781247014cc748b28164217d8ad989", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215078, "uuid": "1325cca1-6e5e-4a37-989e-06e45adfb613", "comment": "Malware payload (a310Logger)", "value": "abd70be77cbfb042385b33ccea2206e836d864a88ed1e0ee8991e6e094be114a5193d92c419712ccc4fc80b115957ca7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215078, "uuid": "d8f43acd-d22b-4c95-8043-ffc733938515", "value": "T19B545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215078, "uuid": "7a02f589-375c-40c0-9d5f-26c38a3c8c96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215078, "uuid": "367c0fa0-0f15-4a54-a059-944f0e8bea51", "value": "6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUY:Hh6OTyejyThvFhIpQrAHYR/H7UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768215078, "uuid": "afa85f7b-fe4e-416b-bde8-f5d1338fd5dd", "value": 303620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768215078, "uuid": "c57925c1-57c2-4b31-930f-8a47756fa8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215078, "uuid": "f3131854-4e7d-4d7b-b51a-7e21054780d8", "value": "Start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c9b0db-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230577, "uuid": "9ef578d8-c128-478d-b2b0-74ecfeae6418", "comment": "Malware payload (Mirai)", "value": "19636f6bd554c9880eb6756ef5353191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230577, "uuid": "4c745c63-b7e5-4e7b-85cc-6149d0403512", "comment": "Malware payload (Mirai)", "value": "b32bec821dcdaaf341d8c46030de151b397c59ee31c8b4aeaa15dcaef3be5bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230577, "uuid": "1c48fda5-c8f5-4d7b-a6fb-a9c064a488f8", "comment": "Malware payload (Mirai)", "value": "6da43cd29638e3eac26891d990086e8bd525af84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230577, "uuid": "31cad099-81b1-41f2-81c4-2af42fb1e535", "comment": "Malware payload (Mirai)", "value": "3c57bb47047f4b137cdd848bf6c028316cb94e3d772eccf1803d94061aab3462b1c1a3a84acf307a9c54e4b96f41c6cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230577, "uuid": "05f0d291-9252-4b95-ab20-d506eefb4524", "value": "T12074B6BA7750BF9AD368C23404F357E5A7B2239216A38105E13DCA3C1DA139C5CDFAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230577, "uuid": "dcaaf5bb-6284-443f-8e90-b1c79d24c0a5", "value": "6144:8FTFAD9hb5Mg/GcOEf8YcSwVrp5pzwfU59tVfbfSLWF6FitZkoojU7Zc:8FBARpEcO3pj5poeWA6UZAU7Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230577, "uuid": "2c575c6e-2f58-4bfa-9070-810f971759ba", "value": 364548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230577, "uuid": "7a910700-f94d-4b5e-b18f-a3997032a599", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230577, "uuid": "f53b7e85-845b-490c-a8d6-89662b0d2d0c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afba00f-efe6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768243282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243282, "uuid": "1239bf33-31b9-4cfc-be20-8624535d66a0", "comment": "Malware payload (Mirai)", "value": "ea198cd9ac938164315701ed02900341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243282, "uuid": "c00d9ab6-02be-437b-8ff8-cc4c3fd8b584", "comment": "Malware payload (Mirai)", "value": "b36fd6cd61b874c1fc630c6678d309dfb19b16cf48ca4cd7341b105802896742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243282, "uuid": "a3f12774-5c9a-42f5-b8b4-6edea51c0ca2", "comment": "Malware payload (Mirai)", "value": "bec1fd966d2b982e65424498c9c2df206ea865d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768243282, "uuid": "eaf1de14-c91a-494e-9165-1dbdf39f3cc3", "comment": "Malware payload (Mirai)", "value": "21583b3e02a5b024bb0e8cf742b20986b24ff246f91fc5729156848fa4b87499bc4b3ec155afbe02d5739c35948143c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243282, "uuid": "61705787-43b9-4c98-816a-de44e50392f8", "value": "T1445301D02B75278C5271D87639DE305F8524292E729B3D141DEB818EF81B2239972EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243282, "uuid": "6f92fadc-0a0e-40bd-8232-9b5e71d406c0", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYR:8D+CAXFYQChaAUk5ljnQsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768243282, "uuid": "e833881a-f891-4a21-b708-30c311cce553", "value": 61382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768243282, "uuid": "8a5a4732-72b6-424e-b3b5-eaf87456d71c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768243282, "uuid": "7cf7a1ba-f44d-49ea-bf56-37a3257380c0", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a841e17-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768246261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246261, "uuid": "10085631-453e-4ffb-8fbd-33fffb2828f4", "comment": "Malware payload (Mirai)", "value": "5b04336cbb09e0a1c5c9b68d39386d6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246261, "uuid": "622ca130-ccd6-4630-ab01-3bfe126db4e4", "comment": "Malware payload (Mirai)", "value": "b3bab1e4be915a7920afe13c50846b43e1491cb18042e19e0e1eafc50ea17c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246261, "uuid": "3e6a8b47-6a03-49e4-8170-accd241dd77b", "comment": "Malware payload (Mirai)", "value": "987e7a499d89db4b60f76377b7f5d2e00570568b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246261, "uuid": "1d280f2b-d86c-464b-9fa5-b0cc25b7fa55", "comment": "Malware payload (Mirai)", "value": "c19033dc66eb10525c3b53c7d75520c52407f23ecf924841ce2c475923beba633389cd7a45c9c1d0b64165bb81e81ea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246261, "uuid": "ee2720ac-34c1-42e9-adbe-9df3718f7c6d", "value": "T13AB34B92FDC1E612C6C52577FB2E428C371753B8C2EA72039E256B31378A56A0F7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246261, "uuid": "68e0ebea-5a14-45c5-88c6-71eddcc23085", "value": "1536:opT09LIbKIkUz9Gi1Oxjg1LV6bDxP+FDjwHLamwd/j/OXs82zuQQauGQNJiAbaTm:C09LgKWKxggJPV+mwdAaLo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246261, "uuid": "59ea3b94-db1a-4a12-97dc-f746b1e3e8bf", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246261, "uuid": "bba1c65e-b99b-4d9c-822f-9c4986f94cc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246261, "uuid": "7f52500b-75aa-496a-8d70-d68794c1b218", "value": "arm5.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd3db3-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212039, "uuid": "30e58c17-7d52-4662-b072-96328d19a270", "comment": "Malware payload", "value": "8442044ca86f602c321b265ad8676145", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212039, "uuid": "cf7cd7b4-7f76-4c79-8c9c-c75a3c68b7f7", "comment": "Malware payload", "value": "b3d4a54802ac6045fd28b492693b73f8d1c96a4b57d95ee331a58ac2a3b460a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212039, "uuid": "89e5daa9-af3b-4ad7-9ec5-1509f8259c9f", "comment": "Malware payload", "value": "63ccfe59a806899d28b50791f93223e4bfbdc101", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212039, "uuid": "6285956b-eea7-48cd-bd1f-8e9b0f4452ea", "comment": "Malware payload", "value": "c6e6f316b9fa59d2b42c20a56b164f7d716f29cba3574f6977a2a1e4ad74172b9228602a92100168c2bce5320f87267e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212039, "uuid": "b9bfe964-e061-495a-aff8-c0a1274fec02", "value": "T1C6510DCCA86EB032B1068668A441C3913A6FD8671C4A1D1CF4FEAC347F4DA18F1A96D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212039, "uuid": "d30a8c09-c7a8-4517-af9e-9d8f6dabb398", "value": "48:cS16kuWX5wRjadORjnCjQjQ7wRjcijrjqRj725Rj2w4JMt5RjD5Rjs92kJyJ3:j15mRjbRjCjQjQMRj9jrjqRj7gRj2JMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212039, "uuid": "02721901-e408-4268-99f3-69087aa8efdc", "value": 2449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212039, "uuid": "6373cbdd-2e97-4e18-a1cd-ac3c4dac8d67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212039, "uuid": "739214f4-a0c8-4486-99c2-8dbc1df745c2", "value": "infect.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f248a03-efc0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768227103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227103, "uuid": "fc4bdb89-f4e7-46f5-9568-fe7e58bfcad2", "comment": "Malware payload (Mirai)", "value": "d9eac590a2feea81bce7ab530dbf3c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227103, "uuid": "c7f20981-9e64-4a7a-9aa3-e10c8c4125d2", "comment": "Malware payload (Mirai)", "value": "b5037bccb1c82871b75fb129874ea466fd877bf7513e05d642cdee930210a210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227103, "uuid": "aef716eb-a9ed-4fef-a2fc-5a11da02504c", "comment": "Malware payload (Mirai)", "value": "04f53a4bb3db7222324cca3f805418e384e6bc27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227103, "uuid": "96b2041b-70cd-4a6b-a9bb-cf5988061465", "comment": "Malware payload (Mirai)", "value": "eeb4ef0033f0a549f37bb55a44e338479fd1ad2f7f8ec265c375580a42616a7b5a5ef0d184f1c536445678d446e8c2dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227103, "uuid": "1bd095ba-ac74-47c8-8ea6-f29cb644cf41", "value": "T1DDD36D57B70D0A43E39A0DF0663B17D683EAAAC030E9EA452609FB0993B5E375045FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227103, "uuid": "26f86f79-2e2f-4c3c-93f3-31728bdfdb94", "value": "1536:xUpQiHguchLcD1KoGOXUY/tVoPW9ncMv3pGDuqHuEz86sNvA/riyDLXsI5Wr7l0:aC7uLJGF1POzv3WXQ6R/rP8Lrx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768227103, "uuid": "3bce1ac3-f149-4420-8dfe-e0ac8f793a93", "value": 131144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768227103, "uuid": "05f88ac3-5b7f-4707-924d-8b1fa842f9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227103, "uuid": "f0f47229-ba07-48a3-9e23-a7213ab30232", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044e70fa-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218682, "uuid": "e23478a0-81b6-42e8-803c-357c3aa9c28b", "comment": "Malware payload (Mirai)", "value": "475a64b1d56d7ccb735fb3d23207f826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218682, "uuid": "3a2e8f14-c9b8-4806-a847-fe3957efd23b", "comment": "Malware payload (Mirai)", "value": "b5a16e878bc78c8fdb5ede6d1807c582770908fa8c44dc5a77ac0cf99bbb5495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218682, "uuid": "ceaa6765-7888-4dc8-9c86-56f2196e1e8f", "comment": "Malware payload (Mirai)", "value": "1edef39bd0cd53d605ec85f04f6e9d0898568c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218682, "uuid": "df041f72-e36f-4852-870c-f1e7839d31f6", "comment": "Malware payload (Mirai)", "value": "10fb6bb919219e9341446883a4c5f073fa5711e66673d26ac6be9b66fa02223c005f4f21a7c9ce6243a86fd488cd86a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218682, "uuid": "e1e5a3b9-ce36-4d3e-b5f1-8af9725228af", "value": "T12E037EBAC42D6DD4D6548674A834BA7C2F63A31093433EFA5A4645A68047EFCF60E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218682, "uuid": "46e0ed38-a14c-462d-b5f6-9cbb39b18420", "value": "768:MaFf2wtYwNSKvPnveeddMi0EN+D2rbCvofi3SCqk:Ma12wtDVzOwpb/fkSCqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218682, "uuid": "8c0e9156-6476-48bc-85d9-0c2d403d377f", "value": 39204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218682, "uuid": "b5781201-e529-41fa-b9d5-1ef2aa6b29d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218682, "uuid": "2b651dd5-34d9-4cc5-81a0-991cd55bb5fd", "value": "SupplySrvsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da5ef5d-efb4-11f0-a129-42010a9c0007", "comment": "Malware payload (SilentStealer)", "timestamp": 1768221892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221892, "uuid": "975f934d-c590-4ef2-a78a-465d3fdcb497", "comment": "Malware payload (SilentStealer)", "value": "ca8c51698e1fb66be18c975ac138e30e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221892, "uuid": "e125c322-8a45-4cd0-a570-a83b551c6e32", "comment": "Malware payload (SilentStealer)", "value": "b5b31173eb9d62f978555545577c4e891258bb59df317defe75e0b623ec14664", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221892, "uuid": "12481847-dc44-4b7a-a21d-b916f224ab72", "comment": "Malware payload (SilentStealer)", "value": "2209a061a81cd9b74b6e3f7cb978ede1da16c140", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768221892, "uuid": "4868a004-f577-4fb2-b4c1-8f78e13d9765", "comment": "Malware payload (SilentStealer)", "value": "38eb376d04cc9abe65370a3d32c7f1c7b61c7e91f6b3dd02518fb3d318d23a4932eab8b51c369a4a13719cdb14f08996", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221892, "uuid": "6c2126c1-5bd8-4860-9a81-f6355e7217f8", "value": "T1A07284A5C864276CCAF0637E6662C107D99B9773C3221790BC9CC3087F721A959D2EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221892, "uuid": "9a3357de-58cc-41e6-beae-80a65cd7f7ba", "value": "384:sIw+fg8NAF7Z9NPlwO8jS4v1E5m7BHHWUEtukaPGr:sIw+fg8NAF77ckr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768221892, "uuid": "e8530402-10b4-44ce-a890-dbaeed822809", "value": 16568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768221892, "uuid": "b8dacd8a-a3f7-4973-981d-080084a2d95c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768221892, "uuid": "211c2a79-f5d5-467f-bd41-02a6a8314c06", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542d17db-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217528, "uuid": "ce90deeb-cb09-45f7-ad3d-5c98dc22727b", "comment": "Malware payload (Mirai)", "value": "c980239cb1b4b252d545f4386457f04c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217528, "uuid": "220e596d-42bf-4434-b2eb-53ad69748308", "comment": "Malware payload (Mirai)", "value": "b5d5205eb580f314e0b71b0bfc1fb27ebb9619d11a02a558d270bfa62654868d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217528, "uuid": "3983746d-534d-4115-bfea-2cb89180624e", "comment": "Malware payload (Mirai)", "value": "a02d73c8a48ab8b5238ab7b4363520e6f6641e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217528, "uuid": "7d32bf76-1982-4475-8906-5ec9a9a49589", "comment": "Malware payload (Mirai)", "value": "615b71e54ae0cc561f4937a4376b2fe417e2ca55a1039bdd0ae2930a896f2aa1cec5a672a1265a24512b7c281013e102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217528, "uuid": "e3b44a3c-b738-4ca9-a7b4-39e9bde19bd0", "value": "T14AF2F1385792A5B0C6B00D39F6ED03C3305A6B34F5DCA2CD2E21057865EB18A5BFE34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217528, "uuid": "fb95bfe2-b9c0-4a27-9190-b7b41056ee53", "value": "768:P2XPespPhuxGg2z8QWPYNdK5G9xWc8kjbXx43Ug:Ptsp5uAg2z8L4Ko9xWc5bX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217528, "uuid": "87810df2-99ba-4adb-8c50-ef2bdec1a680", "value": 34892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217528, "uuid": "44869c95-d246-480e-a6cf-8e6ab0fe1ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217528, "uuid": "3984e133-db9f-44f9-aa22-fc5f1142980e", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793f4ccd-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193538, "uuid": "02ddfa5c-2ad6-4a39-870e-0eb19dcc0fc0", "comment": "Malware payload (Mirai)", "value": "aa31585b7a9c6ae377aa469a007557e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193538, "uuid": "1a8ce58f-7035-4b03-81d7-99ca0e2d2c1b", "comment": "Malware payload (Mirai)", "value": "b682c0c90c6bf6c9d064da0281b1c5c1c58f583b714898560d7644abb77293fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193538, "uuid": "05294360-bce6-4cfd-a628-c6135c8e36c9", "comment": "Malware payload (Mirai)", "value": "93f411594d7f739950ac8b18dea10bcc96aadfcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193538, "uuid": "d03f0ae9-9bfc-4e3a-aae3-a04e09e9468f", "comment": "Malware payload (Mirai)", "value": "6941f8def5fd3f527488455e79c69542f4136c65a02d85b9a96ffe3e5c87b4617a722b5bce104e62e851c380d0c63263", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193538, "uuid": "23b4b414-3d46-4e46-a9f9-216d44417224", "value": "T15D831955F890DA62C6E025BAFB5D528C33631B74D2DE71029D24BB3537FB95A0F3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193538, "uuid": "c819ce56-b3a6-4ffc-9c96-9abd4f80c469", "value": "1536:3EWYislozMX5oA5aiiyi544C/42nO2NZckisWM4AFpoelv89OOH9HBIr:3ECzMX5P5aL54OoZosaANvqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193538, "uuid": "586a4d02-8fa8-4b8f-b786-2967bdbe1804", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193538, "uuid": "b05f0ea1-9025-4436-ad50-588d17da2c98", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193538, "uuid": "1043017a-f617-44c0-a68f-8ea304830304", "value": "catgirl.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bbb7fc-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181993, "uuid": "ac0325c4-11a4-49f9-8117-33045e67eaf0", "comment": "Malware payload (Mirai)", "value": "0b219f51436f8e27fe11a59c2f789fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181993, "uuid": "ba407416-82b6-4103-ba27-6bfd05d7a4cc", "comment": "Malware payload (Mirai)", "value": "b6cf4d5129600d70554ea8c800d2f1ef2cc416466faf249829e2b0abab5a804c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181993, "uuid": "ac07aff4-616b-48b7-b805-4b466736c495", "comment": "Malware payload (Mirai)", "value": "242b6beae2dd4529e3c644f48315073d9236813a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181993, "uuid": "3ce566ea-d9ef-4f66-8ed4-bd86dec0a2d4", "comment": "Malware payload (Mirai)", "value": "e4dcd9f4acc76f70445f47805d73237f21c07a8eb370af0e227474e2190cf20005017357e045065d7aeaf920691897e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181993, "uuid": "752298ab-c1ec-4ad0-9b64-bb7132c4bd0c", "value": "T16D93B91E6E218FBDF768873047B78A21A75833D627E1D685E25CD6006F6038D641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181993, "uuid": "6f40995e-e8d4-4125-9e8f-8052770a64e1", "value": "1536:pbk3IJ73TfwvDhMoagqybQXo1hcd6e8Vgykgs/Fd:lfJ7D4v1Ma1b/1h0mkDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181993, "uuid": "00cb65dc-7470-442c-8c7e-ec8756b311b1", "value": 93496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181993, "uuid": "7286ec62-f555-4e41-ba1c-67d2041df846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181993, "uuid": "57c4e2b2-5a61-428d-b93b-97bc0bae52f1", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da20a2b-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224443, "uuid": "593c20f5-0f4b-4c6e-ab20-cf231ecc733b", "comment": "Malware payload (Mirai)", "value": "3c30a729e0a9f6b16c8fc7873e60bfc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224443, "uuid": "3000dbd3-a126-4a9f-94af-6eb4444039a8", "comment": "Malware payload (Mirai)", "value": "b6ea41c5471cb78ee4a46d975b98dfa641057b094aa9a70c62c39ded0362323f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224443, "uuid": "ec69ab8d-5831-45aa-b3f5-447690bc12d4", "comment": "Malware payload (Mirai)", "value": "ebaddcbd646eae907e85e42610bb25bec20ae57e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224443, "uuid": "0534fb04-2f48-4889-ab0b-6dfb06beadf3", "comment": "Malware payload (Mirai)", "value": "02c7a58ba72ac96d1515c843b12066b03acc2cfc2258f53943455905a253645c4372def61c1c979353442d219891eca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224443, "uuid": "f58e9a7f-0da4-4376-83f0-35e45c25979a", "value": "T151C3F80ABFB11EFBD4AFDD3345B54B49249C460621B93B7A7A74D808F25A28F06D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224443, "uuid": "c68378bb-14be-4f13-a2dc-fed4111a4dc6", "value": "1536:MUbvCxNSduAgyv5/ueoDZl5uGDl8AhMz78Wzbtc81KUHBGLA2e0fZfqFX39wu7rY:MUjKfZlwV0IcacaD7JFT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224443, "uuid": "70b07256-111f-4073-b718-9324c894d5d1", "value": 125748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224443, "uuid": "239f5fa3-de4c-4482-9673-dce0b28079de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224443, "uuid": "1dfa829a-c44a-44ba-b869-0e95d2e77ffa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1803e87-eff9-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1768251695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251695, "uuid": "d8d901cc-b6bb-4239-a445-8be83adaf9e7", "comment": "Malware payload (CoinMiner)", "value": "2ef28b674df405009de9350343249f61", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251695, "uuid": "43a0284c-369c-485f-afa0-2915dbf1d05f", "comment": "Malware payload (CoinMiner)", "value": "b707635382df3b04219a8723ebda5db41eb04312c9433acbe097e43309fe49d7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251695, "uuid": "12a88b87-e91c-4861-a24a-7f84086d26cf", "comment": "Malware payload (CoinMiner)", "value": "a31e7829c15a73674c7f2d44492c083a23b88160", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251695, "uuid": "280df5e5-f9ae-404c-8bd2-035c058f03b5", "comment": "Malware payload (CoinMiner)", "value": "5b69ae165756729a7042295e1139116a2ba36b40dea455ecded772f04a14278120f6914edd9951e591941e3c288536d4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251695, "uuid": "214d8ad5-6179-42d2-862f-1081e0a5233f", "value": "T131363384AFBACDB5D1A62F3F00E682108D777E1863184DCB856447336E592F9F53628E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251695, "uuid": "83e80497-74f1-4348-8456-88732ca2917f", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251695, "uuid": "4836777c-20e2-433a-8dcb-9671cb1e56d2", "value": "98304:p15guweD19l4GDqWHv7AlGGl+M3wMuTNRtdrEEmFOk1x:p1qtexbLnAGwwlR61x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768251695, "uuid": "4c7aae20-7437-4d80-908f-f6703648d59a", "value": 4875688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768251695, "uuid": "f805bf06-d5b7-4081-a040-ebf88107d3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251695, "uuid": "bf18c79c-2cf8-4b29-b4f9-be6f0b0e6fed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158cb3f-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180774, "uuid": "d97fa25b-1537-464e-8f12-6ce349165c8f", "comment": "Malware payload (Mirai)", "value": "42101705805e268e2bb51a268ff5c0c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180774, "uuid": "30daa80b-7ad6-46fe-98db-680e5f8a5b23", "comment": "Malware payload (Mirai)", "value": "b844c1b8c215289e5f3d48212874c23147633267152c413323b5aa31787aff39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180774, "uuid": "413f97ce-b0c2-4869-9c9e-3561af7475dc", "comment": "Malware payload (Mirai)", "value": "8c7bdaacde2f576bc4cf8f4aadd2687cbb4f5b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180774, "uuid": "d2d3e686-6679-4f28-a78c-a13124b15759", "comment": "Malware payload (Mirai)", "value": "4839d760038c6e87d3d0485f8702c54502f2a3eab30b6faa83ad1293f5ff050b37ab22334449d433f46d0d798d7c88f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180774, "uuid": "720c3a93-1134-4456-b67a-017302439e3c", "value": "T188735AC18543D8FAE8690170A0B7F337A272E97601B8BDF3F790A672A421615F08B74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180774, "uuid": "e07de2b1-a8a2-40bd-b6e7-e37957b208ea", "value": "1536:uDrk+eJKhkkYEHNvvR+eZR22HdJRHjJuScokJDM7eBjfiRgubn+Td+b3eE2Hk11Z:u35eJKh7btYWRJdJRDBcokJDM7eBjfiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180774, "uuid": "cd9c4611-95a9-44c7-ae78-8f85d20c461c", "value": 78836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180774, "uuid": "da817ba7-1a77-4e06-a43e-7005b4f32c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180774, "uuid": "0416da7d-9450-4252-9118-d73087db9919", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea742556-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225511, "uuid": "52edbc13-a27d-40a7-8e3e-7543a7cf33b2", "comment": "Malware payload (Mirai)", "value": "330a1d9e75267c2db51e89dad0b08512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225511, "uuid": "95f96f4d-9c8a-41bb-8b3e-7406f69aa790", "comment": "Malware payload (Mirai)", "value": "b86d65cb8cb8b9bdf01ddd184109336924289b11a325a4e531137a38cc54131c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225511, "uuid": "a2f94ddc-e0e1-40b4-a152-cb30dcc7f25b", "comment": "Malware payload (Mirai)", "value": "900581cf90f2fbce6a61bf05a11acf9b49529568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225511, "uuid": "ec979cac-b8c4-4dc6-87bd-d7134e0b4d61", "comment": "Malware payload (Mirai)", "value": "a2d30b1b434e3a965b4f329a0ead6beb6aebe393deccf378491df11b54b05c0c5bc405b937791dd65d500c675efbff97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225511, "uuid": "f212711c-1792-4871-9842-228aa8ddccf4", "value": "T1E2932BA2B400DC7EFC1BD6B380570E15B12477E55F122F27F626FD63DABA1A42819D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225511, "uuid": "6e6c5009-a4aa-43fa-b8e2-4058df7a9e68", "value": "1536:jSO8kJxa9tCdwNE9jLGRJYD74QaNalIe12UEBVzOXXXF9iVqdbZV80y8ETPh:jSO8WgEdwN32P4QL2bVzOV9wqdbZc8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225511, "uuid": "c152f1d5-4f0b-45fc-9bb2-fcc1b8156d06", "value": 94868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225511, "uuid": "e7edde70-09d5-4e6b-835e-91c31bd49151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225511, "uuid": "b230a21f-8d56-4a1f-95ed-0fce2e5fd368", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3e278c-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217515, "uuid": "7b2750a2-de73-44ec-bc9e-5f462920622b", "comment": "Malware payload (Mirai)", "value": "6e2898f7c2f79c919b5933f92d5c3e81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217515, "uuid": "cc12d206-0880-4a83-b2ec-1bf544cd9cb9", "comment": "Malware payload (Mirai)", "value": "b978f567753856531193147c54c08b88e69696dbace5aec9dad38d3c1a3b2f06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217515, "uuid": "d59154e8-abe1-407a-b4e8-10c95a1e332f", "comment": "Malware payload (Mirai)", "value": "535110abfb566217f120b5935a857187e2294a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217515, "uuid": "43d99431-aaba-43cc-82f3-3670ea7cae62", "comment": "Malware payload (Mirai)", "value": "1af3b2a80860f632077cb2d2b3d611fb545cf6996219793974eb319ed2e94ea4c07189788edc2889b4b0d49e5e430c8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217515, "uuid": "df07724e-9259-47f4-b1e3-380bf96605e3", "value": "T126C39D32D8396DC4C1945434F8B1EE711FA1A5C441A25EBB2AE5C97900C7DA8FA0AFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217515, "uuid": "259c8b9e-6278-4801-8d92-ddecbff57574", "value": "1536:WaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKegMgaXJjXOsKigXMQSkweIQrVfwO:Wf5Z5Z98XdmVMJabaXEziaSkzPYwEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217515, "uuid": "bc820994-df6e-4bbc-ae1a-a48a692223a9", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217515, "uuid": "76ae0b06-f7ef-4baf-911f-b16453d44833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217515, "uuid": "57bc13a9-03c0-49b4-ac38-a9e0a7d1df49", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a729df41-efdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768238712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238712, "uuid": "126c3bbf-9db6-4e5a-9623-3febe2d28ecd", "comment": "Malware payload", "value": "d3bad1e315e99797a2f611b10a02538e", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238712, "uuid": "d1de0c79-428e-48b9-b755-cc3e900eec78", "comment": "Malware payload", "value": "b980a67b4fca541e5a70a6a36d5a95f7a72fbefc3d26c707006d82b3b614911e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238712, "uuid": "a3f2f2d2-160b-4f91-97ff-bb2e0d15f5a3", "comment": "Malware payload", "value": "fcf8f2e932d45e3f5cb68dc7aa882b648e86ec98", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768238712, "uuid": "4d0e049a-340a-4e60-b6c7-43917b13ac92", "comment": "Malware payload", "value": "c7413966a2789299fe2a2c7ac7a9076c0e3bf0b324f1fd3cc74c0cb1c4f9433082ba3759ad1fcd5e0ddf5de5802dda51", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238712, "uuid": "0ba80414-338d-4efa-aee9-e5977cf5a646", "value": "T167853386BF0939859FE32A784E7B612121A40F522D357208DCFF0695EB1F78E57AC0E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238712, "uuid": "5c0a7bbf-0800-43dc-b205-0744a4a34746", "value": "49152:mNolW9yfCaPbZJll8+1Uye3jH1/N4CVdYmBFGLdubSUJ:OyfCMFKlTHhGCzYmDGLklJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768238712, "uuid": "44428f86-151f-4a40-9f13-9518df67ea90", "value": 1840993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768238712, "uuid": "6003151d-b671-45c9-bf41-62a85a271094", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768238712, "uuid": "daa84a44-22b7-4604-ba09-866c13ac53b7", "value": "Informe FUNDAE - Monica Seara Fernandez.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae26f429-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255045, "uuid": "96340a91-3174-4fee-a7e3-e2a38a75e6a0", "comment": "Malware payload (Mirai)", "value": "def339f83f9563733942c51c450fe5e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255045, "uuid": "03c99789-45e9-45fb-832b-18b0d52296c9", "comment": "Malware payload (Mirai)", "value": "b9c2427bebaeffeae0547962290a308f7a52cf0b97fc88386581817318c204c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255045, "uuid": "820f08e4-ca64-44bb-bc3e-94471780dd51", "comment": "Malware payload (Mirai)", "value": "b2e00a9553b6215fadfc5722d766607fe65fc72c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255045, "uuid": "c69a87d9-4fb3-470e-8c6b-079f7745c27f", "comment": "Malware payload (Mirai)", "value": "d58872a570def0ecefeeaf17718a066833619c240a8d1d09d387665792195ead8606d6e461a3400e26f9282e87d40374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255045, "uuid": "7da25475-8211-4aa8-bfee-d907123383d3", "value": "T198230B46B992CE03C5C512BAFA6E018D37137B78D3EE7212D9206FA077464EB0D77A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255045, "uuid": "61b24adb-9184-4d91-8f70-b8d833bc9c21", "value": "768:kWnHxLGLEpsAdJ83ancGJRxYE3anrvAq9oL5U5fum7bqEINU3i7m2tqgqIFgV3Rm:kWnIAy3+xYEHqw5wPvIyi7mUqgqICm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255045, "uuid": "857ece42-975e-4a63-8115-1c7c89c9d006", "value": 50088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255045, "uuid": "5c55d7a3-896f-4bd8-a61d-0e38c07d2ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255045, "uuid": "087e1206-67ae-4271-9daa-c5d31ae5d23e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4a2ccf-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1768230913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230913, "uuid": "0ca3614a-1c43-4e3a-9f18-3d7c77670eff", "comment": "Malware payload (RustyStealer)", "value": "ec4fc2917cb5c9a925c855381fe3c83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230913, "uuid": "01e2cf45-5cfb-4e32-87f5-7a66a791aa8d", "comment": "Malware payload (RustyStealer)", "value": "ba49ca531601df9f05d59d57a601a187503905d6ea724ddcf1a6fbc9bee319c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230913, "uuid": "c2893c4c-43f1-4bd1-8e48-f95776266e5a", "comment": "Malware payload (RustyStealer)", "value": "ddb1e95ab0c2cce9a9b8b7ac479de570967ebd14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230913, "uuid": "5f66acc0-ff02-44c6-b576-b4c8ee585e61", "comment": "Malware payload (RustyStealer)", "value": "191a784e8dabcc75a84fc5137608de8f82ad7294e3bac220983869a84382e617e43654c0ef76398816db9ada8f8ecc0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230913, "uuid": "870af0bb-7db0-4a2c-858c-3b2d389fe607", "value": "T14EF48E53FAD14568E067C43493628A36E9377F86293C686E17F1B2301E7EAD11B28F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230913, "uuid": "16d90124-5a9a-4a14-a63f-5e9b443bc2d2", "value": "6e10ddc8dae15fa658649fea4d4ba34b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230913, "uuid": "347dea59-0359-4f3f-887c-31c16f2d292e", "value": "12288:Jw3DiOlyZ6XJCFVxmelWq92yfHh1WvfuGUZETNPZJOufC:Jw35yECjlWM2yfHOvf0EBPfOuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230913, "uuid": "bc4305ef-bf57-46d8-93d4-485758f4b06d", "value": 766448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230913, "uuid": "e063ec45-6db5-465a-95cb-50765f75ece2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230913, "uuid": "b954c216-3657-4351-97af-814dec6bd091", "value": "ec4fc2917cb5c9a925c855381fe3c83f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8e1f6e-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231472, "uuid": "5d8b52dd-914e-4e8c-a16c-b469868c1098", "comment": "Malware payload", "value": "10e1d7c9ca74c99519642cf807b07c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231472, "uuid": "50272ca0-f15a-4b4f-b242-2fc566e36304", "comment": "Malware payload", "value": "bb7578a783b3ad1995d501beb37b8a1ae2b2c1ab331e45375f5389b0538c6cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231472, "uuid": "e25120a3-4559-4ead-bfbf-9768ea5d70b8", "comment": "Malware payload", "value": "25c4e201f874983ec440b1785139fe45773d646a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231472, "uuid": "fa47af04-6333-43d5-8447-bade58a7e29b", "comment": "Malware payload", "value": "03b649a80d31d78400995e650cbb71138fbaf2c323f12c3e31c3bd5fc692d3d953d573553261e3ecbabb16ff789808a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231472, "uuid": "de20e00f-cee8-4f0d-86d5-847226dfc89c", "value": "T142C24B13D88140F5DD6242B24B7A6A32C27CAB01236545DB6BBC2A587F70ED3FA35B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231472, "uuid": "0cbd5eea-d958-4107-874e-9a878ed277dd", "value": "768:3o4wnRsCTB+JBAQy4zd+1RmpqbQH1WpvAf/pLFnx:3o9RGJU1idg6NFnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231472, "uuid": "8c063d27-c185-4f63-b905-3614494e05e8", "value": 28192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231472, "uuid": "d44bf9c6-861e-4c49-a5d5-98dc9b756ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231472, "uuid": "644af22f-fb66-48ee-b8e7-b726d88182b8", "value": "10e1d7c9ca74c99519642cf807b07c8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd80ef6a-efc0-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768227261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227261, "uuid": "1dbcd9e1-a301-424c-b0f4-232527eba65c", "comment": "Malware payload (ConnectWise)", "value": "2639ff72fb29e5a52ebcfd19d02f8c57", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227261, "uuid": "dc211c84-7c8d-4458-9dd5-3397b18e8296", "comment": "Malware payload (ConnectWise)", "value": "bb77a639753891a684b422a91c13471519295ffb0262658a7f50458ea39c6f88", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227261, "uuid": "f6a5af53-2787-45e8-a8a2-4d92551902f4", "comment": "Malware payload (ConnectWise)", "value": "ac187a4aebad9bbe6eb927ded3e801b4ab395b83", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768227261, "uuid": "2b927cf4-2599-436c-ba9c-4a8de4fa565d", "comment": "Malware payload (ConnectWise)", "value": "667bf4faa92dc4827c6420efbeb9a6bb20f734cc2633a6cfa3d2b957ccc864a87f318bbd4811672d3d5200134cba2b64", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227261, "uuid": "c249dfe9-e695-4b63-a9dc-182d2fa494d6", "value": "T16CA6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227261, "uuid": "a4c40d51-f440-4835-97cb-6c6b389fe934", "value": "196608:TKaLNkbgVi4Q+KaLNkbgRKaLNkbgdKaLNkbg:rWgViHgWg1WgxWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768227261, "uuid": "1ed5ef7f-70b3-4aa4-8ea1-33bcf8645721", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768227261, "uuid": "f0b07494-8c0a-4ef7-9975-a0f21ce33aa3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768227261, "uuid": "47410fd6-3fc6-4e53-b162-e6d64afca98e", "value": "Soireegatheringparty2026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34fd633-ef5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Tsunami)", "timestamp": 1768185153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185153, "uuid": "15e032e2-2ea5-441a-b6c4-3adf49fcf13b", "comment": "Malware payload (Tsunami)", "value": "d204073821146fdd64a233c1c920c564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185153, "uuid": "d39f89dd-0773-412c-864f-85fe6ff8868e", "comment": "Malware payload (Tsunami)", "value": "bc61d17def48adc20f861ecd30790859dce642e0922c18131261806e7afb0a66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185153, "uuid": "35c9af59-b602-4857-86d9-48126f9a29f6", "comment": "Malware payload (Tsunami)", "value": "f6b410ba9d2c3e3931543a0a17789126a1858b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185153, "uuid": "d3e6f995-b800-46ba-8f0a-1bb53459c0bd", "comment": "Malware payload (Tsunami)", "value": "30ee80489df0f1b006ab5d4741ce6b260d3e34aac75f590750c13b43c093e90620ae14d84e224184d2c9e8074f125478", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185153, "uuid": "c4868aa7-4f18-4d5e-b5e0-90684e3cc0e3", "value": "T11BD3B50BAB61DEB3D85FDD7705AA860110CD945602A96F6F72BCDA2CE74B94F08E3C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185153, "uuid": "aca946c1-c081-4f2b-a39d-7a005a7a568e", "value": "3072:Gpa7022NgEMxx+knqMV6TrbXPGDmj4Lq/WoleZ:Gp922NgXx3nqMETrb/GDmj4Lq/WoleZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185153, "uuid": "b8f1c8b7-afd5-4b84-a8a0-d981ae494b10", "value": 131692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185153, "uuid": "39e50195-7d18-43c0-8672-b345ef2e0d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185153, "uuid": "916ca048-ee93-4105-821d-3a8c9c903b2a", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9f32b4-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224441, "uuid": "3045aa74-9cc6-4732-a09a-91b1a73500aa", "comment": "Malware payload (Mirai)", "value": "335cac6753d28a7ab4f78362bfc988bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224441, "uuid": "6eff5ee6-de25-4dda-87fe-727cdd9430a1", "comment": "Malware payload (Mirai)", "value": "bce8836cc017f7c7b6a2c961c0c16f88a945bfd03bf9350136ac51517bbfa948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224441, "uuid": "3b5a7723-3a70-4d78-a6ac-b522f1c35688", "comment": "Malware payload (Mirai)", "value": "42e3856c0cc8a3d7ddc8736d60251250193b1387", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224441, "uuid": "5140c1a4-a234-4e61-a7e2-7f1ac18a3bd7", "comment": "Malware payload (Mirai)", "value": "4b3d826b162d41e234a0449c11bfee15a70e1dd9a07c578bf8b09fab49c04d92f436061c32a01ff936dc130e49ac414c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224441, "uuid": "1ae00b31-b7db-4a7c-b9f8-f7a4da9976d5", "value": "T1C2933A25ED396D27C4C0313B51E34531F476539E16BC9A5B3EA32E5CEF14620312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224441, "uuid": "f6d9edef-63fd-4eb6-a670-fb8b90572a0e", "value": "1536:sP2n/V0muvWYkNr2cJ6iOHJKKlfF7lH0bvnRQapnzA7uhR:OyOB1k1ulfFeLRbzAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224441, "uuid": "3deac73c-78cb-4e83-a7a1-14313ec51e2e", "value": 94228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224441, "uuid": "46aca62a-79e2-4d2d-9078-f0cb99bb2dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224441, "uuid": "8e5eeb59-b126-43bf-945b-e5569d8e005d", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5484e6-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216741, "uuid": "93b61883-494b-4a94-8691-b3b1307ff175", "comment": "Malware payload (Mirai)", "value": "85142ccdf61fcc44e250b0794d0d6558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216741, "uuid": "66c2201f-c07a-483c-80bc-98edb348d2b8", "comment": "Malware payload (Mirai)", "value": "bcfd1c9b186666483509dba5d0377d67e440449b7699f4304509855346cb6564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216741, "uuid": "b410c55f-b58a-4e98-ad39-279fd5fdfe0c", "comment": "Malware payload (Mirai)", "value": "3a1ca5fb4021056e76aa911a92e37fd591944ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216741, "uuid": "72d28ebd-f5e6-4c1c-860a-e2f37631b52c", "comment": "Malware payload (Mirai)", "value": "e9a46f944f2fd9bfb29512b3e6bdb0ad6b4d7827c2f5050c37236b5f9591c4f216dbbf97959fc78d6dcdb19fa109e5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216741, "uuid": "98e0621f-90d1-4eb2-b7bf-a5c709e25ed8", "value": "T11303F15D9DE96921E0AB39F425CEB60CB460D12C907ADEF7CBD4301E66A1F613E08B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216741, "uuid": "2dab5abb-8438-41ba-9b1d-dda27c34b902", "value": "768:ApDDQdmx3ELhtPG5AogtGdkcFF04nMPTt3gl+MFoV87fnbcuyD7UHQRjs:ApfQdmx3EdtPnb4qcFvcJuW8Lnouy8HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216741, "uuid": "7820d25a-e60e-42bd-9ab1-de25b02ebb09", "value": 39684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216741, "uuid": "752ab398-0695-4521-8e9d-4e8160a209ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216741, "uuid": "03bed33b-74ac-4c91-be9a-86e4c5c376e2", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c49a856-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1768224467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224467, "uuid": "d1910c6d-506a-4e0d-aa1c-d624c0711238", "comment": "Malware payload (ScarfaceStealer)", "value": "67fd19b0afd94811bcc625dce9aeb718", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224467, "uuid": "50a5c2e8-065f-46e1-a319-352bb5ad99e9", "comment": "Malware payload (ScarfaceStealer)", "value": "bddcfa402a30302934a95f6a7bb5d294f89f48b767ab80ffd05463057c732c65", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224467, "uuid": "4fd22451-12c2-454d-8f7a-2a1981d2e0be", "comment": "Malware payload (ScarfaceStealer)", "value": "07c1073e1bf2ae5d59c8aaa9f7aff7275096aa76", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224467, "uuid": "eb19f42b-379f-46a9-97f9-fbdd655ea29e", "comment": "Malware payload (ScarfaceStealer)", "value": "441baa0480635d56615a80c8cc0caa82497e4ce1c0f0593b3af26a0aa806233bc39dd0d0ae9d090da208b2e43847f5f3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224467, "uuid": "800520bc-41b1-47ee-8442-460488f280f7", "value": "T1F9F6E1D92E2C1AD9E87DC4545869700B84FD30E3C7AE3D42CDDA60AFE40C2EE7666D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224467, "uuid": "7df72dab-dc8e-4978-894d-ca196dcf186f", "value": "196608:oUJ9m1eRPVAeEkrgdUsdPPgpSGNx1Q7y5qePTSf5qsKMXKNdf4J2+Zt5udVbsGdj:/1EkQPPMj5R+f5qsNsQJ2k52VAGItV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224467, "uuid": "8579018c-a14e-4edf-b310-39082138fa64", "value": 15296481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224467, "uuid": "5ec3e0b7-3903-4d58-a2c7-22432b5101d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224467, "uuid": "b7c0e5da-d34a-4f53-ad0f-0acb89d02fa2", "value": "CrimsonLoader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b06d8-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212022, "uuid": "a8bbc90f-f0c1-4411-8ac1-4ebbd9b6b2ba", "comment": "Malware payload", "value": "e2bbfa1cb7fc4f84008ffc8c7536d0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212022, "uuid": "add66938-3f16-4975-aabd-8d931c71978f", "comment": "Malware payload", "value": "be37446872e673b0136294be6d33e98914bce933c8f6c596802aad760d181d6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212022, "uuid": "f73b9e8a-4f6f-4b74-9a49-171bed36444b", "comment": "Malware payload", "value": "5f58b5446478f683d4ad9f275490761fc3593d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212022, "uuid": "75513c6e-2842-4ebf-aa22-9b5dc5ff1b9a", "comment": "Malware payload", "value": "f08f44a99c4864e1bc1232c6519b269590e09b815c6dde237cfae54a236646ccb0f203a7c7b8d669b6eda09d76b276e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212022, "uuid": "84648058-6766-4fa0-8a8a-a947653d6f9c", "value": "T1C50533AE6A9150C5C4B6E62E9AE30D4AD21C2A67342F1DBED00DF3A4DAC1DFF513450E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212022, "uuid": "dc98d080-4d61-43cb-a34c-215524b0b924", "value": "12288:J4xffcHp9Jma9IxfyTbWHgb63RHTd+3odytau9QCqs1kJVjF6H9bVPdPy67aDG45:Kn4maex55+YgP0lgPM62JT4/uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212022, "uuid": "4452c56b-6f58-4dc2-a287-0705dbe43b79", "value": 863240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212022, "uuid": "dd46f08d-fa1d-47ad-b042-3b5ce43057ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212022, "uuid": "0540eb9e-3a19-4fcc-a983-9b4a37f9bf8e", "value": "client.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0a598a-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193546, "uuid": "688e3c8a-66db-4f2f-b820-cc088c7ce670", "comment": "Malware payload (Mirai)", "value": "c5c6345b886e4483dc998074f93a839c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193546, "uuid": "1c1b48b4-acdb-4718-9b05-5ecd826dabc1", "comment": "Malware payload (Mirai)", "value": "be833345d7ca70bd4615bc024e76a615cbdfa46633a94266834d5a7692c80e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193546, "uuid": "39c4abc5-70a9-438b-aa9a-8be4f145c0eb", "comment": "Malware payload (Mirai)", "value": "ad5383f4fd655c62271467e57e6cbe81f525899c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193546, "uuid": "02c949fb-5c46-48a9-873c-16aa7b45e18e", "comment": "Malware payload (Mirai)", "value": "c6a64d75ccadcb44e088a297848319f36ae8a43cae1817280e9424a28b1024d870c4d95378812cfb4e3ba263d641cbe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193546, "uuid": "9b002b78-5590-4d53-a49f-d919cba2b23e", "value": "T1F9D3F75A7720DF62C26DC1300AB3C75667F92AA12AD19549F25CEE0C6E3234E681FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193546, "uuid": "01f69920-47e3-4e2e-bfec-533acbe24f2d", "value": "3072:bc0dOxeL1srz3rjbbO46AC+ScRGv9+jqTD/jtEi:nm37jPEXv9cOnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193546, "uuid": "a5ddd8f2-b4d4-4b32-93bd-d60fd788dd2f", "value": 132160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193546, "uuid": "5a641947-cf5c-4f05-8391-2f510b414592", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193546, "uuid": "dc7869dd-8ac7-40c7-97c2-55d62cfe21d7", "value": "catgirl.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91edff2-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231522, "uuid": "3af6480c-54fb-440d-90af-9d04c95b56e5", "comment": "Malware payload", "value": "582ee420110c1d423c36376e6a7757a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231522, "uuid": "26f81515-390a-42ac-be06-0357f374c4af", "comment": "Malware payload", "value": "bedd39963a5f6036c057172a7cf01751bfa1346ff5c3bc767612dfd252371182", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231522, "uuid": "dc4d345e-ba6a-4509-b0cd-880ad111410b", "comment": "Malware payload", "value": "0105db10c678d18e33511343a0de52b62a6bb88e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231522, "uuid": "93560ce2-3a25-41e7-a990-9b70c5db731e", "comment": "Malware payload", "value": "8c8e4da4455bc02d5d9bb99dec1a29831a5b6a5c23cee4ef42b37d077920c3471f94534d80fb267bde4ddeacefeb1c5c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231522, "uuid": "e82dd899-4c18-4ae0-aa16-a74f677589d3", "value": "T1DCD502BB88B26993AA504663FB0F2C1A735B19D53B14D342E95190AC7F371D38E92733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231522, "uuid": "7b24ff86-22e1-4c77-bc42-6dbc118ff2de", "value": "49152:ZOc2yD4lTP9ffmnD1R+/3Z+CJ0riATYfRKkVr0Zd+uZBvg:ZoyEFPRaL+/tAEZlr0LhZBvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231522, "uuid": "873e4878-3f08-432d-8dd7-4b7689c9c4c1", "value": 2914559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231522, "uuid": "002d6d2c-6ac2-49ff-b43e-f7abb9951d60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231522, "uuid": "91f1cee2-6d0a-4336-b158-954e62fbec6a", "value": "Invoicedetail_INJO202512210004054.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0571e83-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216797, "uuid": "335619e2-dc31-4988-ad1e-d6a5f0da7831", "comment": "Malware payload (Mirai)", "value": "6cb77f249fb1b3f988558aabfa66890d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216797, "uuid": "8a957d8d-7d82-4ce1-bd4f-9cfb2244daac", "comment": "Malware payload (Mirai)", "value": "bf9e1f7c80c5d7152f3d35a6126c82ff55e486d7091776485fcc370bc7e49734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216797, "uuid": "de52a35f-366e-4cc5-9f99-7a694b068c49", "comment": "Malware payload (Mirai)", "value": "6974ba2ba85b6b6c915a07e4e947af0530860206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216797, "uuid": "73be5c41-8550-4985-913f-e4a376771286", "comment": "Malware payload (Mirai)", "value": "eca2c0c9bdd187a1769434ad8919b160ec2d543894dff48f183fa50345e43c433c15d25363b6d3a52918c5ce2968dc23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216797, "uuid": "14a25c9d-152f-4a36-bc19-594c595c1524", "value": "T1F2B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216797, "uuid": "aa411740-69a4-48c7-bfe0-d71aa86bc05e", "value": "3072:bdub7djS5HECz6Qb1ShRhFczcmVRh865xH:bdo7djS5ECXSozcmVRbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216797, "uuid": "5ba9f7fb-244e-4add-8123-fe22b08454b1", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216797, "uuid": "41a41b49-25fa-4137-bf7e-d92dbc735d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216797, "uuid": "40757c5e-858b-4974-b2d3-642eeed57d7f", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5bfd8b-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214562, "uuid": "95ac3e46-1d81-4ad6-8bb1-fd5cbfd0050a", "comment": "Malware payload (Mirai)", "value": "6de3c7c7d3100c4fd172f37e1f24bacf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214562, "uuid": "a9ed7f32-ac31-477c-80a1-f8df24ac8b29", "comment": "Malware payload (Mirai)", "value": "bfa78bf342f1c5c6daa29a1170611d2e7cc2d03c88859b59de6192905212a70d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214562, "uuid": "32b79025-8b7f-4870-b3fe-1b218d039b17", "comment": "Malware payload (Mirai)", "value": "dcff0fd9bc36ead0014198c54dadea4594d7172f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214562, "uuid": "b495e766-42db-47cc-9206-a140160b5ebb", "comment": "Malware payload (Mirai)", "value": "00fa07b1939eb66aee0a5a2359233dc3a931e604f765fcc306cf2b905fa002bc1dbbaf3b4bcedfd476b92607c4135490", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214562, "uuid": "2c841cf1-ae9c-409f-ad0f-f2e15ae57ef7", "value": "T1C9634BC5AA03DAF0DC2D9130D0ABFF3E46BBB57E0019D98FC7958571E463B02A65629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214562, "uuid": "05245f39-edfc-4615-a1e2-4b4a3eb73b58", "value": "1536:aoewCGVcccyapvSq/7gCHieXMzXtJLXDZfxR:ayVcc3apvSq/UCHieXM7tdzNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214562, "uuid": "2d214cc7-5bf7-4666-984c-d269eae0f0de", "value": 67236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214562, "uuid": "dcf1eb9f-f499-40cb-9391-7770f8b5d1fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214562, "uuid": "dcefe388-e12c-437b-88fa-0b7fb5a683b7", "value": "shadow.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7768d8-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768219714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219714, "uuid": "d39fcaa9-833f-4a51-b3e9-6d8599226354", "comment": "Malware payload", "value": "46a18f3a6af3f8433cf79f21f9849855", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219714, "uuid": "0870cc3a-b63b-4ba4-8596-1aa43f9d4db2", "comment": "Malware payload", "value": "c063a4fafe2e1ef2f9d8f2c69d8936d0460b739e495d185a19fd4d27251cd6c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219714, "uuid": "8ec19c56-ba41-4709-b59e-b26c46341244", "comment": "Malware payload", "value": "0f3371b23d529e6eef782e5350c0355fe0b3af05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219714, "uuid": "c64857b7-f370-47c5-ae4b-03672b6782bc", "comment": "Malware payload", "value": "64faf26fb13c5e8af0f8f0c448ac9c45d667804243088559d928fa83097fa654219cf94eca8dda3dcc192aae2dc50681", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219714, "uuid": "63747ab5-a2c9-4e68-bcce-0731722b29f4", "value": "T10E31041352246437CBF16444491E6B2CAD4AD4F370025EBE32591B9A1CCA8EFD1ED5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219714, "uuid": "578a5027-2504-4b02-bbc3-244cf7d020e1", "value": "48:bQiD4OjyiljJqjLhj66jnRjubjcEj9uruvDXru1unuS1Pu4dWn:bQcj3sJVtsRAqu0uSc4In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219714, "uuid": "676b298a-d860-4c0e-ab74-22197302d98c", "value": 1852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219714, "uuid": "a4ec7a4a-601c-404b-a623-316ca569af73", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219714, "uuid": "69effea7-c703-443c-946a-2d6dc73a015a", "value": "dat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ba146f-ef92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768207087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207087, "uuid": "a50c9438-5381-4623-8f5c-8df40bf6dc52", "comment": "Malware payload (Mirai)", "value": "92b7643b5df632d99c8d2ebc7c2331e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207087, "uuid": "0f45a403-cf17-4ce8-99d0-12d1bc8f4e04", "comment": "Malware payload (Mirai)", "value": "c0ad24e77b5843b74a40ab36289b40ad498736c4cc6dceff0d741b02e2d98ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207087, "uuid": "7fba089b-25f5-4d44-bf11-32b2ff162900", "comment": "Malware payload (Mirai)", "value": "baf5d7050bc025c1fd2ea86fcbc68b1828d66e52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207087, "uuid": "970e6776-adc7-42c2-8d25-eb3a258bd928", "comment": "Malware payload (Mirai)", "value": "98d9a5ec6b74a98b447385e3f0ec78fbc9dff378fe8aa20aaadf531cdd00d2b10c73e788570349058c62d5b45987f702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207087, "uuid": "b27a5caf-b916-46e5-aac4-1488a6c3e8cc", "value": "T13E63078ABCC4C602C5F061B1BB0F668E3B6643B8E3E2B157DD1D6B19674F8670A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207087, "uuid": "8fc5c15e-cc6f-44dc-a081-a04179caa81b", "value": "768:BCydIcrnHMKYEK+QWLJQlyJIBW2POANh7HFL/nlGyvideMh0tm9siLTMyO16Rvnl:/DgR4yaJMyOy/7auxID7KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207087, "uuid": "f3f0626d-f2f1-4a06-9451-31bafbb7799c", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207087, "uuid": "7056f0ef-f58a-41af-9ebd-5634a105db05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207087, "uuid": "ba885418-45d2-45c8-8f8a-19895bf6b0c6", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa6710-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214560, "uuid": "76484455-0d7b-44e9-9d2d-bdc32fcd4699", "comment": "Malware payload (Mirai)", "value": "45610dff63372c716abc0ea8e8f59caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214560, "uuid": "7315d646-9949-41cd-95c6-c1573b7461ef", "comment": "Malware payload (Mirai)", "value": "c0dbd4c29bbf9a3e126ebc019662b53f01de2b8832b7ffe9d3081ba992040250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214560, "uuid": "b44cd6a1-6085-45ae-83ab-945e42648a87", "comment": "Malware payload (Mirai)", "value": "4624024e9e0313436534bd4b16576bfe2dbddda0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214560, "uuid": "52a85c72-9199-4ce2-8590-2d8d1c142de6", "comment": "Malware payload (Mirai)", "value": "44edad1c1880404f270bc8e074ecaf6d0aed53bfe4f47471c3926d77529ab26abd276c2f79ae0ecd8149218bbaf432d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214560, "uuid": "f2b4ad90-0f89-4e4d-958a-a20651994ed3", "value": "T10D83C659F9818503D4D416BBBA2E119D331237A8F2EE33128D305F257B8AB6B0F77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214560, "uuid": "5f74164c-56a4-4502-bd23-38a07eb0c5fa", "value": "1536:mubnkTTEzvoRtxnmkxk3iAQt2MBQRwULy3P3ipVsEO1LKIKimPeU9i8n:fwiv6GqtjBSwULyfRgeU9i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214560, "uuid": "67572c69-92c4-47d1-b1a7-00b8c1af3f2d", "value": 86196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214560, "uuid": "f1706c7f-6735-4e16-8d44-4d4b27f73d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214560, "uuid": "e5d496ba-9593-40a6-ad81-ee6a27aa24a0", "value": "shadow.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf26a59-efbb-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768224978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224978, "uuid": "5a9a4ef3-01b8-45b7-a3aa-fdefab9d38ae", "comment": "Malware payload (AsyncRAT)", "value": "85bd68a6dbafdb8d433facf634637f65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224978, "uuid": "c031b7d5-ebc9-4fbd-9723-f8e0142a5271", "comment": "Malware payload (AsyncRAT)", "value": "c169e5acd074adeadf291e947e886000e0a5fabbd99f152424ba33323a34c889", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224978, "uuid": "f6eb2c7e-e6bb-4609-99d7-a97ea104da29", "comment": "Malware payload (AsyncRAT)", "value": "518e1b914d01bac98906db0514adbfb88304e2d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224978, "uuid": "e29643a2-958f-4b75-ac38-b55f71846c09", "comment": "Malware payload (AsyncRAT)", "value": "703f00e9fdafe7389ec2e4b0aad1925c1780c7b3b3f7c5b4d5a3db20cf4a8b18cf9c6c4aba52e485fe9b7e00c263e300", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224978, "uuid": "931058e0-a940-4984-bf7c-5305952cae2b", "value": "T187C22B0873F48261D1EC47BE48329200D375E64B5D53DB9F5EC4A5AE2A337CD8625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224978, "uuid": "a5690af0-3c74-4f1e-aa6e-82982de77029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224978, "uuid": "6fb8e476-ffd9-405e-8cd7-53d54a370273", "value": "768:iYuXm6vjh5EtQkAMyCJhxmFbHBFB9ru+:ym6vjhcQVtIoFbhFPru+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224978, "uuid": "94e7c914-3570-4119-b630-9f22bddc7a20", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224978, "uuid": "949efc48-5f3b-4792-a718-000bdf7763fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224978, "uuid": "bbf9c4b1-c897-4209-8079-17dbf68ea7f2", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8862ab-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179644, "uuid": "b7cb8caa-9883-4ec6-a180-94400ef1bf8e", "comment": "Malware payload (Mirai)", "value": "1f1aae2d3e21ad4e95edd83a1dc22c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179644, "uuid": "2e7be9dc-cdc9-4e9b-b82b-e38fb3ad1e0b", "comment": "Malware payload (Mirai)", "value": "c1f517aeff8d1058f63bbddcabc0151ab7e0524e45b1219878a32b9cdea72916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179644, "uuid": "9c4182f8-9f32-4d3f-b689-27a93c57c1f8", "comment": "Malware payload (Mirai)", "value": "1da34ca6562a0a1979c635d6166311891e917c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179644, "uuid": "0a3222ee-18cc-4e8b-978e-ffb60855f98f", "comment": "Malware payload (Mirai)", "value": "87b1512dceb923da59e65cc57d2806ed68b1da0b13bc2582286b3b962d82973fce8df153799d7fc4f546ff04c9810c53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179644, "uuid": "1cdfc353-eee1-4154-aaa4-242412cd8f51", "value": "T110931A52B400DD7EF85FE2B384574B05B12477D54E122B2BBA26FEA3DA2D0A81C1ED47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179644, "uuid": "b50c73a6-1622-4e59-bb5b-5a988b8519ef", "value": "1536:eGHcJnAh0fSNWJGAjZBo7Es0cO0QB97gPuewJFAIO6sEX9PO/XPFPYl5Hpvb8uYf:eccZm0qNWJGmZmEs0dUG86d9POVPa5HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179644, "uuid": "7c9f8d3e-0d8e-465f-a28b-c5a2ac1ae8d8", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179644, "uuid": "7309e8d6-e6e5-457f-b0bd-e11111e46f0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179644, "uuid": "77c1748b-ccc0-4f35-bfba-4d7b63d6c949", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a6c56-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216728, "uuid": "a4daab87-ff1c-4a66-8b3e-ff70a86e9494", "comment": "Malware payload (Mirai)", "value": "bc337dcf4892b544f3c86355f4c560d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216728, "uuid": "e2325493-9b6e-40fd-9ac4-f3103d822a69", "comment": "Malware payload (Mirai)", "value": "c228a1a6f0ae221977afc6184d8ed2407032a94e96eefc2cde10d1e704a741b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216728, "uuid": "c91f18f6-ec65-49e7-bfe9-bffe9edfc10a", "comment": "Malware payload (Mirai)", "value": "dab23a3fc70ad03b8e29bf24ba65eeda82e5a826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216728, "uuid": "2e0d40ac-6c6a-4b49-9b59-6c9847b5c487", "comment": "Malware payload (Mirai)", "value": "7779257c41a9d0843e042610018f0279fd79ab2fcbe1116401a3ac8a1cd37116464e7e057bd56838a4094ac251bbb3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216728, "uuid": "7fb481f0-c958-4b12-9572-a70e1b7cca50", "value": "T1CFB3C50BAE529F6DF33C82358FB38B25A749238533E0C585E26CED515D6028E586FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216728, "uuid": "d1a6ced2-e2fa-46d2-91e2-db81673201b8", "value": "1536:+5ziZ9SjONPnAPnzunENH96s9l17ubrOvoe2gx90D73So0nNTAbVRe7M:+o/IOIH966l17ubrOvoeF90XxWNTAWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216728, "uuid": "6dc325be-df79-4a89-b1a7-46d44b327032", "value": 113396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216728, "uuid": "983b35c8-0639-4b6d-beb7-9a53ddb3c28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216728, "uuid": "50ac11f1-53cd-4354-b788-4ed3201fd8d6", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb9d8c2-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255043, "uuid": "8a43194d-b2c0-4b59-84f9-92516b81ff5d", "comment": "Malware payload (Mirai)", "value": "a6f426590b845c0324721cb348572afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255043, "uuid": "960721ff-dc58-4b4b-9121-1ad55fb5bc09", "comment": "Malware payload (Mirai)", "value": "c23e13e7e3121a6abb9d64f221fef6e924457ea518f764818a5f4c4b1ac81afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255043, "uuid": "aa7c3fcf-bb47-483a-bd6d-03aeb37fdb71", "comment": "Malware payload (Mirai)", "value": "47abb5669e60a63697f4c8a0e6cebdd517abf8c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255043, "uuid": "f81d4fcf-70d5-4f43-b24d-5d8009ae6f72", "comment": "Malware payload (Mirai)", "value": "80bdfcb74f8bb2a3c21b9a5becaa1d98a5aef4b71ec412e0152b9e5f77a4485bb77c51c1824ac273cd1ecb6afcfa1be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255043, "uuid": "ce106e65-7cca-4cb9-a220-546ae3cbd9ed", "value": "T107337306BF254FB7D86BDC770AF91B0134CD681B25A53B397934EC58B20B28A15F38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255043, "uuid": "d8a1a026-b83e-4693-b71c-6c2a7b1f93e2", "value": "768:oGZIAj+kDziDnB59Ho0LwkUMfeyBe9yeGNnqe8XiFlZEX/Jk:VZDj+kHiDB39LwkUgTBAytNn7vEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255043, "uuid": "a24348e1-c224-4bc8-bc5a-19ca9fd13433", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255043, "uuid": "236f6efb-0307-4cde-85a8-f6e884bfbf14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255043, "uuid": "6a10d22c-5288-477d-9c33-d4f6a17b7f24", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba05ea51-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231443, "uuid": "314f974b-e3eb-4b41-a75c-db64a508ec9f", "comment": "Malware payload", "value": "e115f17941e424c307aac6f5c3364dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231443, "uuid": "0fc1d7f3-2362-4f48-a556-7a03379839bd", "comment": "Malware payload", "value": "c26b8d2f13c36520dbbb94e94179a857aeca893ab1f73bdcdb770fe84d502f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231443, "uuid": "436d38bc-0769-4681-98ce-d28213011a9c", "comment": "Malware payload", "value": "7b2d088265d3b61076c8c81256663bc95d8d901d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231443, "uuid": "242cea95-6550-4bb6-9918-868e708a5226", "comment": "Malware payload", "value": "f48654209d2571779acf9ff06907343dd5d3855903fd0e27800a6f3cdcf5c120c524d9594ade43130d7cae0faef9578b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231443, "uuid": "ece62237-3bcc-4086-b96f-ccfcb147dc9f", "value": "T187722B12DD8010A1DF8103B187BE7A32E1BCA752235951E757BC59492FB01C7FA3AB47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231443, "uuid": "b1698b0b-b3eb-42fb-b0f4-aa7ab4f2bf83", "value": "384:3o4wDTyysCTBIRJBAQy4gk+QhTFfsveuF0L/2mv9HqbQ4Wq:3o4wnRsCTB+JBAQy4zd+1RmpqbQHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231443, "uuid": "955c0912-4325-4c40-8562-6be63d10a9a6", "value": 17360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231443, "uuid": "ea9e39d4-0743-4c4b-89c5-51d2b31fea56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231443, "uuid": "4e8d4b4c-2a79-44a6-9174-48aa2e61247b", "value": "e115f17941e424c307aac6f5c3364dc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cdb18f-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204780, "uuid": "cbcdac11-a075-4127-844a-bff51cbad904", "comment": "Malware payload (Mirai)", "value": "8fc03267bdf7ead5292ba5fd88672fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204780, "uuid": "00c32c7a-c691-4a5d-8583-2a4d1b4cc94e", "comment": "Malware payload (Mirai)", "value": "c38b469a8aa634d566195cae03d91bc2e6dce96d64335c51605976edda5235a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204780, "uuid": "31c95772-e832-47ed-a564-98d9bd6b23e1", "comment": "Malware payload (Mirai)", "value": "50ea0ec0483a984523dea25aedfcda43ecea87d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204780, "uuid": "f4b42541-20d6-46d3-bbed-bff3c3fa372a", "comment": "Malware payload (Mirai)", "value": "f1f2c5d518d06b195f80d046aac924c0ce5f511ba4396cb71209ed3879eaa463a7c42764e9bdca1417fb54c547c7e35e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204780, "uuid": "72297977-a2e0-4d7f-8ffc-73ba576e059b", "value": "T154B30A9ABC819B11D6C566BAFE0F118D33134B78E3FA7103CD145B2A678AC6B0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204780, "uuid": "1b5fc7d9-5b82-4173-a76c-0d2f5e3150c4", "value": "3072:PZMK7TrpcQrE9oyJs4Cd1C3E4LuYBn6z1M7RBvzVX8lw8T2:PTYVJs4Cd1y5Bn6z1MFBvzVMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204780, "uuid": "87d19e33-9b44-417a-9eb2-c4640b749e42", "value": 113464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204780, "uuid": "e4aac0c8-735d-40ef-9e58-ca5907e662ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204780, "uuid": "7d711271-e766-43cf-9d6d-c1ebcaf80f19", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93164c80-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246410, "uuid": "e1301b24-799e-4275-afb5-75a86b1dbc54", "comment": "Malware payload (GLOBAL)", "value": "3d3fde739bc10940c6305f931d886e15", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246410, "uuid": "b9ba99a0-49b6-4796-9419-934339673f30", "comment": "Malware payload (GLOBAL)", "value": "c62850ec00e38c48999b2cf8fdd1f256d71dfb24c103bfdfb32e045b7f693990", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246410, "uuid": "46c38a9e-6cc5-42d8-80e0-78fa9c0200cc", "comment": "Malware payload (GLOBAL)", "value": "df8ebd1f1286caf16dca44f4a9224a88f9d7fc56", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246410, "uuid": "5598b0e4-5c91-4da2-a7ef-697c76003977", "comment": "Malware payload (GLOBAL)", "value": "76ca8c6c9b8d4a3cf4ce41606efbd9050f3dbfaa5dbeb85d958fc938da283c1e9bc811b9c10953f7446c35d3db98d082", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246410, "uuid": "d3ae7e37-1928-41e4-9f7b-940a1c1ea98f", "value": "T16E347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246410, "uuid": "2058031a-2089-48d3-8d6b-d668751ade90", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246410, "uuid": "a50d8978-4381-439d-8c91-ddbbaf18a38e", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246410, "uuid": "8ae96522-5123-44ae-9a53-95ae2317dc8f", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246410, "uuid": "db4c5fa9-dad6-4c78-a5f6-e14ee74d66fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246410, "uuid": "c56df9b5-b5df-4c26-ad97-8a75da30e461", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3372afb5-ef90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206306, "uuid": "03420684-09d0-482c-8888-4cc36c6b0634", "comment": "Malware payload (Mirai)", "value": "0e902b1dc3eec9ba8f685b7997584595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206306, "uuid": "68643aec-118d-4485-956d-24e38677e09b", "comment": "Malware payload (Mirai)", "value": "c67268949045437a39fd715ce9879031ed08a67292bba5cb60cb8de1649b5fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206306, "uuid": "ac60a380-c8af-449f-9ede-b94731adda5e", "comment": "Malware payload (Mirai)", "value": "fafdd4ac22fb4bb534d1c07697dc328c2c1bb2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206306, "uuid": "0aab0601-37c8-452c-b7a7-eee826d2e925", "comment": "Malware payload (Mirai)", "value": "0b101bec8bf820d2591f00da5d0369b7b2a27b7d8bb94cbaaee5f9ec61efdea664e771ad9cf105acfc526a3405ff911f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206306, "uuid": "39c10603-623a-442e-950b-ee1d77675f18", "value": "T13FB3190ABFB11EFBD4AFDD3345B90749289C460621B97B7A3674D808F24A28F46D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206306, "uuid": "db01ca1f-9add-4078-90bd-05641bb5d298", "value": "1536:aG4LKC71uSxHX4pZK30GzvxYCXTNRMcXivEHFG90rKz1MIY+Uj6UQM0RNQmL7n73:aG0KfSxHIJV+mnNQAdnTT2tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206306, "uuid": "0ec1b206-5bcd-4a66-abcb-1081c669b564", "value": 117848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206306, "uuid": "45e8005b-c8cd-4665-98cb-08e2d7dba072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206306, "uuid": "a4b60d0a-8c63-4006-8dde-927839d29019", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b70b31-ef5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184541, "uuid": "54c76177-4fce-4a91-a3ec-f1dad7af992c", "comment": "Malware payload (Mirai)", "value": "c1b3db8c99e6b0f961e381f7366900e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184541, "uuid": "7ea75495-876e-47dc-8abf-9577b8590d54", "comment": "Malware payload (Mirai)", "value": "c6ab64b7133eedf2e4954edaee5a21fca6cd5ae774caea0dd4f6a557b64b19b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184541, "uuid": "32fcb6d8-f454-47bf-93d3-3be85d59c8c3", "comment": "Malware payload (Mirai)", "value": "883f4c480422969f7677bc3759a2e79c87953e72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184541, "uuid": "10514539-8de4-45f8-8c27-c29d4a951356", "comment": "Malware payload (Mirai)", "value": "0453ac80c729e7a2365b036fefc88454526e762e1b441c59d665f91d9c764fbe33b8ac0edbf8148e3814b9a823afeb34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184541, "uuid": "50f7459e-2529-4207-83f2-1de0f0dbfaef", "value": "T15774B6BA7750BF9AD368C23405F357E5A7B2239227A38105E13DC62C1DA138C19DFEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184541, "uuid": "91dce8f1-c8db-4026-8e85-1a45286be84b", "value": "6144:hFYVJFLa1lJdkkmyiHj1w28KsuwBQqCi5fYEgAtIo5DNrER1oZU7ZP:hFouTOyiBvVwX4Al5prTU7ZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184541, "uuid": "d5459973-8888-4c06-bda5-c657619b2f70", "value": 364244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184541, "uuid": "5d33b62b-4f4e-4774-86fd-acd1db87abe6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184541, "uuid": "055ed43c-1b20-4fb8-b4ef-c8112f13ac71", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa927331-efcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768233564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233564, "uuid": "16ce6822-421a-4c73-aa4e-85c966cadb5d", "comment": "Malware payload (Mirai)", "value": "efd1b72d9576154f5e0eb3e959e565f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233564, "uuid": "03ef131f-2d67-409d-a4d4-4babcaca41dc", "comment": "Malware payload (Mirai)", "value": "c878d08e6752c51e0d0fd7a2ef93c6206c1b9787d9b3809399ae2b0272fb336a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233564, "uuid": "3d142f0b-30ea-4c39-b381-30310a8a3b15", "comment": "Malware payload (Mirai)", "value": "9b979fcae9c7628a36b077991da515e51ed9be2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768233564, "uuid": "2ddbe379-7898-4400-ad7f-230070e3159f", "comment": "Malware payload (Mirai)", "value": "5973b776fed7c011e0f784d4c4ce7f2f41b731c0adf3a550292e41befb427a62ffa4a4a862ded50d1d38a35ebab735a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233564, "uuid": "6349e0d2-ee15-4706-a9fd-74a827d13802", "value": "T10534095DF880D77ACBC0217AFA5602CD33735F64EBEE320589356B383BD6A15993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233564, "uuid": "7de4baad-8471-4fdc-81d5-960dde56262d", "value": "6144:qbbWcadupyhlHc3SRpapifArZgN7ZN/heY5XIU1tMBYRq+TzXfLw31dik:yWSrZgN7JtWYR3MFdik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768233564, "uuid": "1b4f490a-6577-4724-a380-722c564fc063", "value": 248600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768233564, "uuid": "8b3402f4-9f8d-48d3-bf08-26f96409a2b7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768233564, "uuid": "cb6c5683-74ea-47e7-b708-8aa3f4753cb2", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cef432b-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216737, "uuid": "34a1fe33-d505-4347-b7b0-88ed5d834b1e", "comment": "Malware payload (Mirai)", "value": "edc662865aad5353d5511b408e4f16e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216737, "uuid": "87663792-5a44-4893-95a6-59d9683d7ce7", "comment": "Malware payload (Mirai)", "value": "c90c08d68c7f3844b7055f345eccca551e589bbe98a23b36c64370c159fa6679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216737, "uuid": "adcf9368-7304-42e3-bb02-75d1fcba7c52", "comment": "Malware payload (Mirai)", "value": "321ab55cef6d0c001a10edbc8e13f154a265287b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216737, "uuid": "22cdd936-03ef-4547-9ec7-1c9db5ac4a88", "comment": "Malware payload (Mirai)", "value": "d0e7710f8348d73ccd8150dfe34049e8183599037d7df2fda1e46e8ed8414b1d25557d2357c2578af1b5a1629ae2625b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216737, "uuid": "85bdc7bf-7df4-4808-bd5b-c1de21a02ff9", "value": "T1A7C3AE97F78B24A1C86147F007C76B8D3AA362019E6BE9E76C1E753B19391DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216737, "uuid": "b5373430-a2b7-4171-89ac-ba22d6a5b1d3", "value": "1536:nq189r2mIHgqH8INZ8SNB4ZPLaLWq0IijTQEE8+FCUxZJ3eg9x/LWg:q1ur2nj7gmqZPLetETQC+FCkeg9xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216737, "uuid": "d89e0079-50d3-4fbe-8e0b-9ba874e87a70", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216737, "uuid": "0e9e0351-251f-4eb0-9ad6-6057b9b03ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216737, "uuid": "a6d0f477-c7e6-4c0f-acf9-4a4a55ca1b18", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64683f9-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211250, "uuid": "274e7e63-d769-4131-b040-87a823b0e765", "comment": "Malware payload (Mirai)", "value": "a5f2aa37971efe020e2d865d4aa98c86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211250, "uuid": "48571da0-eb82-4fec-91ff-096372e1e22e", "comment": "Malware payload (Mirai)", "value": "c94776964f380011727600ab8f94b0e33e1073f7db46f83aca354e2d4c0ab4c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211250, "uuid": "b9d3422d-bf16-4ef6-8636-11ef1e0fefa6", "comment": "Malware payload (Mirai)", "value": "00b66dd98f830bd5aac5425bcbe826961d4f0c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211250, "uuid": "5a6891f4-7aa3-4a12-ae96-e0342a825051", "comment": "Malware payload (Mirai)", "value": "6d9be64a185398888e8ce04cefcac60ca767e1653cdd6e01fe5a91f7db5408668447554e2c658debe0ef22e340b41215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211250, "uuid": "120a4bd8-eb01-4f16-ae0c-88c729015235", "value": "T158D31945FC509B13C6D522BBFB5E028D372627A8D2EE72039D156F24378B95B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211250, "uuid": "a45abcd1-8afd-4f15-8a47-e462700cfab2", "value": "3072:9Qdfm4TK2B5ATB4XvQ4JQT70RQCWnf81//+3:9Q5lfB5AVwQ4JY70RDWn0x/+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211250, "uuid": "640f7a53-eb74-434e-911e-533130630152", "value": 137772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211250, "uuid": "17cd48f2-8759-463a-80f6-6d8f9e5b3ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211250, "uuid": "ae99b217-1c08-46ab-a657-7304d593ff51", "value": "bot_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1419ec11-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180484, "uuid": "7f0ea94b-a2f1-4751-997e-debde72e1011", "comment": "Malware payload (Mirai)", "value": "1f36754f32cec486e986d72512de9b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180484, "uuid": "99cf8a3a-8894-4517-ae85-dc03130090e2", "comment": "Malware payload (Mirai)", "value": "c95a87168e98e1beb4a6b02e6a0d0e913fe90168d543759c89a5e80d334aea9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180484, "uuid": "89e2ee7b-1c4f-4a22-8928-5aff97cdf906", "comment": "Malware payload (Mirai)", "value": "d95c38c1d797826d8d2275dbbd07f984cbcf78d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180484, "uuid": "8cafb6a8-01c0-4e5a-97c0-90c1602e69fa", "comment": "Malware payload (Mirai)", "value": "7ab9925baf72b77dfbb383265095862ba261e276fafca1d6ebbc5bec37b1949474ce91934648dec1e5b185dfa2a9e24e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180484, "uuid": "b2fb8c6a-6381-4101-b559-a5278c412507", "value": "T13B63E996F991DB12C6D592BAFE0E51CD331307B8E3EE73139D146B242B8B46B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180484, "uuid": "1679a760-2a23-41dc-b417-1f033dce6602", "value": "1536:/9n6kP9NIg7sF211Iz43Tx3SpVq61GX3wMbij4GGuXnJj7CgYcT2bVR:JP9NIg7hs+TekE4GGuXnJj2gjT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180484, "uuid": "3ec0ee48-a5dc-498b-8040-9d946aed5ec0", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180484, "uuid": "6607cefd-910d-4d7f-9cfe-83f3355d5804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180484, "uuid": "f2163aea-d421-4c21-b436-43456afa4d64", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5508d758-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217529, "uuid": "9328af95-ac3d-4e47-b1e1-523199eb40e3", "comment": "Malware payload (Mirai)", "value": "b37ea43e988864c7ad50e96c3a19a4ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217529, "uuid": "fe0e2c31-7e13-4ce5-b7eb-51257a42cc36", "comment": "Malware payload (Mirai)", "value": "c99cf981a022e1476f2e482512a3243321d2db759c37b57c6611909b46f1c659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217529, "uuid": "10a8fc4d-8c5d-4299-a509-01561b4b4113", "comment": "Malware payload (Mirai)", "value": "f2ef3f159100570de7ef9834a71eea165cdd4ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217529, "uuid": "79be3ffd-0bde-4f17-97e6-8121049de988", "comment": "Malware payload (Mirai)", "value": "921b650cabe0efceaba2fbb9981f31cc95f1535da61775f2cb7f2251d8e0d9303e25328c1c31f2fd6cf6323a7dec0d23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217529, "uuid": "5578d5d8-74d2-4bfe-b446-6a1cdf45435c", "value": "T164B339C1BA43D4F5EC1641307177F73BAA32F0791239DA87E7A49E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217529, "uuid": "1e4ed40b-283b-47ec-ac30-ebbff6e1c480", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wToTyw9bMFazA:Pbj4doYGFB0/45gdgG9LzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217529, "uuid": "3ba532e1-c204-4081-91fa-6c36f75e7da3", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217529, "uuid": "8a879e8b-b643-4550-b2a7-ee352977c4ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217529, "uuid": "aca7a659-1e95-48e1-ad67-56aad2a9e1d8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7d86c8-ef53-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180043, "uuid": "91746cf5-c929-4d45-b5ea-4b96e0ac393b", "comment": "Malware payload (Mirai)", "value": "cea6fc529d539d81008bd9e229345007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180043, "uuid": "01cc49d1-2b61-44c5-8729-840bb361396e", "comment": "Malware payload (Mirai)", "value": "c9c8c9d80d19e451a51425fdbb07aa20db295f9e662cf960e47c093fed670b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180043, "uuid": "43394593-6ccb-440d-bdd0-2f7991bc1ae6", "comment": "Malware payload (Mirai)", "value": "1c4ecec12f880d79acea2779bea8366805a2e100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180043, "uuid": "df043507-9ae1-4961-ad8e-dc17c382714f", "comment": "Malware payload (Mirai)", "value": "ef5c9e7245721f8ad38a8a8f3ca6bc48ff41351fbbc1661bb21adab55ceade6d3adb97dea14c3f28687a1689f5fb1d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180043, "uuid": "3126ea77-7312-4e0c-9234-9283349e37f0", "value": "T1EA74E796EB411EBBC40EDE31051F4BC511AD909953EB472BB278C45EBF8EA0E29CBD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180043, "uuid": "173eaecf-3fa1-4d86-a9ad-2133a704cdb6", "value": "6144:ODFBBNL/FfcSkJ4FDCJ55VBJLS56gBmm+DLkQdZEk9vREgFro5GsjMTW4U7Z:CFBwL1NdZggFk5GsjMT9U7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180043, "uuid": "cb6aade3-b54f-46ae-941c-2e7ca6f35813", "value": 364368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180043, "uuid": "d9dba6f3-249f-4c45-9583-750bf2669fd7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180043, "uuid": "d2fbba05-a26d-4586-ac47-bac9edab9e6d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19d1141-f00e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768260608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768260608, "uuid": "5b55ad22-363a-4ec7-81e8-868268c65d6c", "comment": "Malware payload", "value": "0a35a379be18a688f42d13f02915a179", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768260608, "uuid": "4215a366-0041-4488-8994-9545881d2064", "comment": "Malware payload", "value": "c9da7a7cb5203dec2ff3d82000011ac676f2141738994ab862e3a45bcd3799e3", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768260608, "uuid": "c8dd0abc-3724-4cda-b11d-4281c49b4f7c", "comment": "Malware payload", "value": "03815462204a4b3b36f60313f42eecb91dcc80d0", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768260608, "uuid": "ff0b58c4-9322-4ec4-800f-4cda7ca88348", "comment": "Malware payload", "value": "a8a5dfc851fc86b78f83f6d51ea096ac8b79e7ea591d4996e2d01f8bf5c20189b46414bc169dae35ad51baf550c65b30", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768260608, "uuid": "87208ee5-becf-40b9-84b4-b8f1e69751df", "value": "T14FA6331EA545B8BE9FE7839DB94C235897EA290427481C364CF30B7C1E5B2C59366EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768260608, "uuid": "82ce031d-5abd-4dc9-a9ad-a43836335d55", "value": "196608:6fEDYPCr8pSnU7KDIta/o3nRrLbNxw4VJsJefAO1xsPUnM4pow9COB:+EquKSniKDIAA3nHxw4L4gYUnM4Fkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768260608, "uuid": "caec5f1f-eacc-4479-a1a8-362d73fba9c6", "value": 10230414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768260608, "uuid": "ebfe2bf7-b1f5-4222-a1ab-fad589fdc3f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768260608, "uuid": "1fde169c-fa65-48dd-8954-0299b3766ee0", "value": "nRFQ-CS-2026-0709-NO-172026013592-MR_5126-01-2026.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e426f77-efbf-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1768226484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226484, "uuid": "a37b03dd-7248-4ab2-9b6e-ffe8ff2e73ef", "comment": "Malware payload (ConnectWise)", "value": "27ef4e994b17129ba5ae4f0a8ea4ef11", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226484, "uuid": "5c721163-3662-4a4a-9b5f-d1583223bec6", "comment": "Malware payload (ConnectWise)", "value": "ca8b49520e9e2b6f1002cde6a3961f2427bc47f699f64a3ab75fe9e54cc2d7a7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226484, "uuid": "eccce501-8126-4872-9957-28056c99e7b6", "comment": "Malware payload (ConnectWise)", "value": "80dd8b69a5b97fb1b8e3504a65fd4dbe2d5958b1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226484, "uuid": "f1fc5da6-9b4e-4beb-b6eb-fb2d4b9d1949", "comment": "Malware payload (ConnectWise)", "value": "0643113864d703e6cc170a3917d0c7c1dd497de9e2158a56b9080c4383a395e6cf38a9c71784c0116bbba9ddb851cae2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226484, "uuid": "1d1f79fb-cb66-4266-b6bd-528c3dfd523a", "value": "T144A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226484, "uuid": "c5f752f9-2c04-4e74-b5d1-d6237c27c53f", "value": "196608:QKaLNkbgzi4QeKaLNkbgRKaLNkbg1KaLNkbg:WWgziHAWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226484, "uuid": "3a7f8403-2924-443c-a461-610c06dbccf9", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226484, "uuid": "dfbc8e12-80ee-4a1c-a823-995e268c7eb5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226484, "uuid": "7c9fe679-8d05-4508-94a2-cb908bdf8fa3", "value": "Invite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831ae0dc-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216748, "uuid": "f4b0b679-83b0-48d3-b506-617880069797", "comment": "Malware payload (Mirai)", "value": "3e69d32d90a90ae58bc50a6ba6ad9b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216748, "uuid": "bc54b64e-748f-42ab-88d6-89a8daabab48", "comment": "Malware payload (Mirai)", "value": "cb52ae19dce8f112409e790bdffae28ae8514edd23e17f38b48b8df4bce83dae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216748, "uuid": "6f6a41da-8dee-4cb2-8b53-b371a1f52b51", "comment": "Malware payload (Mirai)", "value": "3fccfb31306fc5e1715b909448892f217b7fb805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216748, "uuid": "42e9cf32-97e6-4a62-bfce-e5d1b984df6f", "comment": "Malware payload (Mirai)", "value": "8c66c6934127a3d400d77d0f7aeff239cd7416028f54d04d2914e076a614f93c9b2ee36780ef5b11fc5773c12b5b193b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216748, "uuid": "4c6396ce-c0d9-42cc-878e-d1435ebd2c97", "value": "T1B7B2C0B0A31729F2C47004397A2C1555374726F3D6EB2A3B2521892E9DDB2076EFD6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216748, "uuid": "0e8b4385-b5ec-44c8-9495-2b7c6e452663", "value": "768:fG4rcUl3p9byh2Uy+2XpOdZVoQ3WVQs3UozMgE:NrPj3Go1VFzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216748, "uuid": "2c6c8e2d-d390-4816-9b4a-71c4ab928964", "value": 25104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216748, "uuid": "5ae6634e-b2bb-4d30-9d0f-0e1087dd70e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216748, "uuid": "9daac278-c195-44b1-9592-05d32f97982d", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5443e8ed-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205073, "uuid": "6d6690fc-8f30-431c-bca8-e3a875944d35", "comment": "Malware payload (Mirai)", "value": "a78bd251dceb0e321b2447e149674795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205073, "uuid": "b3323706-dd07-48f7-a3cc-8a0b2cb9bfe5", "comment": "Malware payload (Mirai)", "value": "cbe4668144b6315b58f559bfbdeb28e3e9e24ff6e4c3dd2906161cf8732ea2dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205073, "uuid": "a17cc13f-c098-40dd-9af7-7fcb7a97fbc6", "comment": "Malware payload (Mirai)", "value": "031ee32f8d15664014d67bc95aab62fd2d97fd42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205073, "uuid": "dc6cc143-93ec-4cef-849e-6677a2a73e5d", "comment": "Malware payload (Mirai)", "value": "013e42a71465b941b6e11482263bc06ccd37cce171c940e8500bc2f9b9fa4fad8637ffae7f3640ca770283a9006ddb62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205073, "uuid": "b944f491-32c1-4e37-9f80-929877101313", "value": "T120931986BC85C612C6E061B6BF0F52CE371743B8E3E6B2439D1DAB19674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205073, "uuid": "458b7b65-0963-4ddb-bc39-56dca4ec2eae", "value": "1536:dV9wapZ03ayqCkY40xPlQ+HeG2q4/Plw56v4TAbVR:dV9wapW3n3NQ+p2q4/aI4TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205073, "uuid": "04b0b380-7866-4e7b-b193-e0e951c9f41b", "value": 91852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205073, "uuid": "845d4940-709b-42db-8695-48e8ef1d5d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205073, "uuid": "d13ca145-dc67-4430-864a-fbbd10dbaf81", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bc44cd-ef87-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768202624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202624, "uuid": "6da66252-06a1-4cdf-89be-6418b46f47e8", "comment": "Malware payload", "value": "6a58defe5cbc18900ce78f7d19f2299f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202624, "uuid": "67f01434-f4c5-4259-b9c3-d456412ae0ef", "comment": "Malware payload", "value": "cca65d5b874dead34f2533a6fcd47b2a6c69d187382ce80cc64b4c3bc0f9e064", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202624, "uuid": "3b3fe1af-329d-4be1-a9ff-c12603da88e8", "comment": "Malware payload", "value": "d54fca193cf1495761eb56146238fb967e7cb589", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768202624, "uuid": "3362653b-3b95-45cb-b1f5-9b227e9ff5ae", "comment": "Malware payload", "value": "85834b05f363aeef25936c2d0c590f77eed0c5983f741bf0757d1791921ea61ad5dd038e16afca743d6a6c9f0acfb2d7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202624, "uuid": "135f7791-9346-46f1-badd-182220db89a7", "value": "T13A5723A3F380581AE1F602F6417557605347AC294B83CB877E68362C5CB39E52F68EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202624, "uuid": "2c3b5b0f-3e2d-4220-a965-6e6ce8b0c8c4", "value": "393216:mgY7vcDgtKymGoADH0VLfWDZtqwmzlK3hA4ewmbqUQ1Fv8Omw3gMIpWdBFl:XScDgtNDPDiLyZtmzlqPlmNQLV+Mvdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768202624, "uuid": "e173ff69-1407-40b6-8ae5-b3c726235974", "value": 28524645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768202624, "uuid": "1ab76143-aec4-470b-9f55-de7b488710ff", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768202624, "uuid": "225e8f5b-14c7-443d-a984-c52a9623ded2", "value": "\u0130nat TV.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92eca341-efa4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768215056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215056, "uuid": "5248ff90-2458-4204-aade-0335c6911bed", "comment": "Malware payload (Mirai)", "value": "462cd96e37e5060fb5f5f0dc0b443c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215056, "uuid": "fc20e0b5-a2eb-4b9b-bbfa-3b1eff821b18", "comment": "Malware payload (Mirai)", "value": "ccbdbedf0fce886de428c009c824b23d11ad1af3253123d788adbf49e6d0cb9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215056, "uuid": "5288f506-9fc7-4dfc-a57e-f7dc59513a26", "comment": "Malware payload (Mirai)", "value": "30793d42950f0f4e48e734cae6f1528b44bc816c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768215056, "uuid": "3f559d1b-9273-45db-a5ba-53e9f54d074a", "comment": "Malware payload (Mirai)", "value": "48cefcdc2713c794e65e706c90030df1f05197e9177a2b83792c77e961d957d063c406c8e9f1534d81c4f9a768c77f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215056, "uuid": "783569d1-cf8a-49d8-8f7a-b7a2904955db", "value": "T1826328D1B001CE3CF90FD6B9C599091AB968B35099430F6E52BBFDA37D721685E63C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215056, "uuid": "8e8e0011-fcf4-4b05-bce3-9b2162f4e0bc", "value": "768:BAkYobPvcmEDwv6JXkCoF745RSEsfCr/Lta/mN5mBCJwP/RlvR9MfMOFk8Y423C:BAJ+hoXHrAQ/BAyo8JwRlvR9kMOa8FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768215056, "uuid": "f49fc3ee-2d4d-4f3c-92ef-8e403417a21b", "value": 72716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768215056, "uuid": "16d4be2d-2655-436e-92bb-1bdc10a445a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768215056, "uuid": "c5a65af3-6410-493b-82f4-dcbcd940653f", "value": "shadow.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c4dd07-ef54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768180485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180485, "uuid": "9136c1fa-9329-497b-8230-479cea74b0e9", "comment": "Malware payload (Mirai)", "value": "975c5549433570378bce60fe76b9bbfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180485, "uuid": "6cf8826f-8702-49bc-9201-bb2b8773244f", "comment": "Malware payload (Mirai)", "value": "ccf3e9efa086286f9b53d9b2b468beb42e56473149ab352ca1cedf3a39115375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180485, "uuid": "233ce47a-4bec-4d8b-936c-127020021b2e", "comment": "Malware payload (Mirai)", "value": "91ca706f99c812c974fc82f8cdeb094f73b81c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768180485, "uuid": "058150d2-33bd-4894-aee6-e5b1d0dbba6f", "comment": "Malware payload (Mirai)", "value": "3180b873fda538088ff558100280244a0edb91f2afc4686022aa3f9eb5819ae867c4359461a6991078199226652a9217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180485, "uuid": "d5d2ab17-a44b-4ebf-92ed-f525cb7e0542", "value": "T1CF931A86BCC5C612C6E0A1B6BB0F52DD371743B8E3E6B1078D1DAB19674B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180485, "uuid": "074a9a48-182f-42f3-98b3-f52ffa2b1722", "value": "1536:A0rgfGMvwc/My67LTnxmd/C3A6TfZYVp62tzBctpxSWgXT2bVR:AEg+MvP/UVmd/+A6TfQp6ozBctfS7XT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768180485, "uuid": "1e0fc27e-85ee-4a6d-a4af-0ae72d721eac", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768180485, "uuid": "2c3d4abb-dfc8-48f9-a3a4-4952cd0b1135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768180485, "uuid": "c4b8415a-4785-49ad-bd53-3755af9e5e58", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bfbb03-efd2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768234680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234680, "uuid": "c5b8077c-fbef-4655-8478-3ab96575eaf3", "comment": "Malware payload (Mirai)", "value": "676d44f1e2f36069ae200f14e1f05fab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234680, "uuid": "9e0b05bd-64df-4559-9bbd-f33993b76b39", "comment": "Malware payload (Mirai)", "value": "cd561fe79daa037e7fa4449a69ed45f42f3756624c9165e9853e563ac17a201d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234680, "uuid": "c7ee420d-820c-4fbb-a645-1d51cd2c4ec2", "comment": "Malware payload (Mirai)", "value": "31c9131d8570d42cc830f58b13ba7c2fd1e23a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768234680, "uuid": "42c7e4e5-5f6d-4db0-a18d-a974f4fa4a2d", "comment": "Malware payload (Mirai)", "value": "fedb2e33333c21dceb4d1b6bc8c92a2466646267b0fc478718008b38c96589e05851abf10c2f32e8abe79ceeab3d916f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234680, "uuid": "8a4bb7f1-de5f-4418-be47-eb99e661f41f", "value": "T1A9D47D5CFE5E3C42E2C7E2789A4D83E1722771E0D32391E37982424DD5CA9E9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234680, "uuid": "f61d7dac-e8c6-419f-bac0-7cad0d4e90fa", "value": "12288:RUTv9DAoATEMQqp60zZgwLWqxzcXgGjLi9iSKRNDw5kXF7tgtL:RUr1AoAT1tZgwyqxs3/9n/dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768234680, "uuid": "0beec002-30f6-4eb6-a3b7-54f42f992cc3", "value": 644272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768234680, "uuid": "5e26a00d-924a-4217-9b10-5635da277b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768234680, "uuid": "ce51dd06-f64e-47bf-b672-990b129f4f3a", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a8ef7-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217524, "uuid": "8c50e64a-bde1-4ced-87de-0d66b38bd488", "comment": "Malware payload (Mirai)", "value": "999096b20fd79bb8fc30a217508c79c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217524, "uuid": "bf3ffb2a-a1af-448d-bc7c-96b41e57846a", "comment": "Malware payload (Mirai)", "value": "cee8936981ddf5d503ecda6c5604fbf628f684191a5998d8c2e63fd3f163c2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217524, "uuid": "82bed195-ba7f-40cf-9870-ab902f154f67", "comment": "Malware payload (Mirai)", "value": "8ab7827e87193976e3f26cb1d61d00e1157ab2b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217524, "uuid": "cabb6845-635c-444d-a649-3daf501444f5", "comment": "Malware payload (Mirai)", "value": "ae8c4e12a820ff3058d3ca02a21ac479a1ed8f9042d17d6b4bf1e8713b99317eb35ce1b568385e8e0e806b1385b268ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217524, "uuid": "2c0c60df-8091-4c84-b6c2-00bfe3033c29", "value": "T16AE2F1B3C1DA4FD9EEC799B17CD683C07B600EA61611E2D42F14DB52B4426333A5A9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217524, "uuid": "a6f49e05-b67b-4d86-9e02-7d3f5f2fdfc6", "value": "768:qYLwpXzOCWFF7vmk/4Gi3Ko4uVcqgw0RKWX/:tMTgw9lao4u+qgw0UWX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217524, "uuid": "e3f7791a-37fe-4281-bf9b-1facfa88fd44", "value": 33396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217524, "uuid": "c12c1eeb-98c3-499d-88a5-34dfe617744c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217524, "uuid": "e43eb4af-b234-4051-895f-9394b44a8897", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52db87ed-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205070, "uuid": "a60d8d7d-99de-486b-b9f7-dd17abb62a43", "comment": "Malware payload (Mirai)", "value": "a387097d898fb8d6f693691e32d09bc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205070, "uuid": "8d3ee44e-27d4-4246-bc35-7a6fb4490af1", "comment": "Malware payload (Mirai)", "value": "d01292bde35ece8105dac297b6f590a9410ecbcbbdcda46ab82d3dad3bea958a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205070, "uuid": "dfac85be-8e15-461b-a9cd-d912467f0ac5", "comment": "Malware payload (Mirai)", "value": "515d09353aaf67a071cb9c8481534d5aa637bc9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205070, "uuid": "c4d712a3-5883-40db-9011-b42fa7467236", "comment": "Malware payload (Mirai)", "value": "b495a04b96608a4577cdb77f9316b11ae270ad3f3833e3c6fc5163c9ebd31397719af9cd8ac36a501fe7832d5b1b927c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205070, "uuid": "9e19414d-d209-409d-9a5a-01244d1fddc6", "value": "T19AB3190ABFB15EFBD4AFDD3345B90749289C460621B97B7A3674D808F24A28F46D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205070, "uuid": "52fc2892-eae7-4414-909d-818866ed9fd5", "value": "1536:aG4LKC71uSxHX4pZK30GzvxYCXTNRMcXivEHFG90rKz1MIY+Uj6UQM0RNQmL7n7G:aG0KfSxHIJV+mnNHAdnTT2tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205070, "uuid": "12d498e6-b37b-42d6-846f-40d25bae8e38", "value": 117848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205070, "uuid": "385fd97a-1228-44ca-83be-1c01a0d149ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205070, "uuid": "456a300a-f4fb-40f3-88ef-b2be0ef5e0d8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1667503a-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768205828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205828, "uuid": "aec71f9e-ffb4-423a-9a20-1f4f4ac34f74", "comment": "Malware payload (Joker)", "value": "94d0f3e43f95900c112c0a63471a9efb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205828, "uuid": "5e9c2454-9f7e-41bf-97aa-2733a56df06d", "comment": "Malware payload (Joker)", "value": "d0a15d8c5c2ea81c9d47e2553346e1713bfdb007f41d7c5d35a38d06d8611921", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205828, "uuid": "410380e0-d8e3-41ef-b9da-ceef25df6db2", "comment": "Malware payload (Joker)", "value": "3dfbf10fe8517a01ee14d13c9f627be27b6df047", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205828, "uuid": "2da7726a-4d25-41f2-ae4b-78cde188a18a", "comment": "Malware payload (Joker)", "value": "40c918ad4ab5d070e99271981eff951c810596099999488e49d0b78ba452b08d9b02f2ae780a43d18a1ba823e43e9d56", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205828, "uuid": "50d8b254-3a3a-44e2-861e-7486630308cd", "value": "T16376129EE31CA42FD47754B24EBA6621024B4C438283ABA3B655730D39B75C88F5EFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205828, "uuid": "376754d8-c5e9-4275-a829-0e6f73202aa8", "value": "98304:h4aRDyAqdcvr7c2GmLoN2mcrIsheUSkP2w76VEVdSYcaEHGraAgKcL2JszGeWT8R:emyAcRWIs8vkP2wWKUfy27CnTZiWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205828, "uuid": "f4db16a7-3d22-4660-aa9e-846340b9f405", "value": 7442301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205828, "uuid": "2b0cb428-e865-4fb4-82f7-c2320b8d1da3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205828, "uuid": "d7438cb0-46b3-4930-a93a-3680792ea82b", "value": "Storage Junk Cleaner_1.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72772a24-ef55-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181072, "uuid": "715b1900-dde2-4865-ba5d-5ce99e71ca50", "comment": "Malware payload (Mirai)", "value": "9808a0b5febefa27e089d8fe9b4e5b67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181072, "uuid": "905605a0-1f72-40cc-9205-3e74737dbd3d", "comment": "Malware payload (Mirai)", "value": "d135727c1ee1482a700fa8ca985bd9601e0fca6d5560dbeebeb25dc57ecaf4cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181072, "uuid": "ec20926d-e73b-47a2-bcf9-6e77b355ccd5", "comment": "Malware payload (Mirai)", "value": "8838c4986aa8bf8d995ed71d64c5324939312ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181072, "uuid": "8644a22d-99d1-44c2-88f2-5b4fae14c5bc", "comment": "Malware payload (Mirai)", "value": "334fdf5adfef1a646b6bf1b93393d2054c7f70e0c4ca8cd73dd6acab31b2a0e32413268f893ff1d6baf23bf99efeeabd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181072, "uuid": "f1d8c795-609e-479c-8de5-b07d8aef1e3e", "value": "T13CA3FBD6BC81CB11C6C566BAFE0E618D33134B78E3EA72138D185B2D674B86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181072, "uuid": "ecc6e910-bea2-433a-b574-1bdf723e3074", "value": "3072:ywg2eSQq8S7KfEzScp6r7wxu2TuVmYe8u8EE1LvbT2:yj1Wpp6r7wxK7e83EwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181072, "uuid": "2e2a2928-6c43-4874-a044-109698ec3c0e", "value": 99948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181072, "uuid": "ec4dd4ff-37b5-4bf3-adf6-797e848c80c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181072, "uuid": "d395d800-2c7d-40da-9267-3e7d4889f13a", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f379c33-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214540, "uuid": "1fd0cc66-e9e3-44f1-89c0-52ebab89ee71", "comment": "Malware payload (Mirai)", "value": "ad705b2dbd150d0c1331865502aa4426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214540, "uuid": "ad6ca5a1-e324-4c3d-849e-ce741087fd25", "comment": "Malware payload (Mirai)", "value": "d136c60cb183aa77b4ee61f1587019c3e49315fc8e687458ecf853fc12e72e11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214540, "uuid": "e70163cb-ae08-4742-824f-995749707a6d", "comment": "Malware payload (Mirai)", "value": "4e65cb78401d138b9bbcbf487516d64a4cdc1836", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214540, "uuid": "f3e0c2b6-2319-4eca-bb91-55579109c713", "comment": "Malware payload (Mirai)", "value": "e5ccfec80c6f623c4b28c0861f1475fe0ffdf6f1bf673ffec6f4c86136548d3abbcd8fd81e6e53e5f533062534eb449a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214540, "uuid": "2e451b11-3e2b-46c4-bb97-4bbe1f5ee217", "value": "T10573C752B8C29107C9D492F6F71E019E331523B8D2DB3307AC266F613689D5F0EA7E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214540, "uuid": "8be58f88-a21e-4e0d-8670-2984c111cff4", "value": "1536:H5bN+1K0L28BPtyeDmt9tptdxvlYydbzKd:H5bN+o0L28BPVu7dxyydC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214540, "uuid": "fb00f547-fff7-4418-96f5-12ae7b7a225d", "value": 77644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214540, "uuid": "6ade6a04-7b91-4e4e-9077-8b4eff3d68c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214540, "uuid": "5cf22d97-13cf-4eac-bd83-5fb0e5148e12", "value": "shadow.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03151d3-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229735, "uuid": "ad9713f6-f18a-4141-bf46-ea67de95a178", "comment": "Malware payload (Mirai)", "value": "bce9f7046615b21fdac942f588f86853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229735, "uuid": "0cd5b1f4-6269-4705-aeba-22e98a117e95", "comment": "Malware payload (Mirai)", "value": "d1758e3746bd750cda9a97f46d44333821c6e599d0b332873679db6b6dfe8bfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229735, "uuid": "a99098e8-de43-4958-8ea9-1303e375dba6", "comment": "Malware payload (Mirai)", "value": "c7ddbe642995e93438e69b9d81daeff198d7a4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229735, "uuid": "d41b538c-895a-43ef-aeb4-2f4d8158c758", "comment": "Malware payload (Mirai)", "value": "7711453ed000d5cec2d67349ceefcbc4e44595b47010de1bccd6b9d74b9628419196feac0fff4130b101f918e8354b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229735, "uuid": "2f194c73-3ee7-40b4-ab5c-00a799afc713", "value": "T162146B07F682C1F2E19306725097C76A1730C9311356CD07FB999E79BC7660A8A2B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229735, "uuid": "05304820-f644-4b3f-8f22-ec1ed284a676", "value": "3072:z32gfp0zaPbrHe+sEpzqjX1lB/24ccBHg+Cf2haXZWXgvz8X+jTB5YQJkYWCjzSZ:L2yp0zaH++1+24ccfo5vz8W5uYLnSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229735, "uuid": "c661be9c-311a-4bfc-883a-6c04d3493d40", "value": 206000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229735, "uuid": "2b6bc1bd-d284-4feb-8b03-f317b82019af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229735, "uuid": "1a0c8896-fe90-41ea-9569-8b15098a6b35", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0235444-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255048, "uuid": "81b6aee2-9156-4838-9941-c450e17a8f76", "comment": "Malware payload (Mirai)", "value": "dca7a91d119c28a5190134a17cd0426c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255048, "uuid": "31c41ff5-51a9-496a-bd26-ace7f5a7fcfc", "comment": "Malware payload (Mirai)", "value": "d18c30c5f9ea7c1e66ba6fb7cd6b7ae26505871e47312206972b1cedddb8c1f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255048, "uuid": "940e71b9-4cd6-4b7a-8037-a3e7a0cbf276", "comment": "Malware payload (Mirai)", "value": "9b5c2b2c1e0b63b1fbe0b6ea6b48f8cb57e92279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255048, "uuid": "aeafc3ec-3f30-4b1b-a71b-668154466c8b", "comment": "Malware payload (Mirai)", "value": "964457248b38535dc3fcacde8641ddd005ced0432807b95f66d55b5bc3f6a4c78139fb2518e6cfe783b027e7e9e3a186", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255048, "uuid": "d5ebcbd0-a72b-4c54-81a0-683bb430a57e", "value": "T1DE03C645B94B8AF6D40744B041E3F63F8A31EC394972C69EEF29BE75DB236C1A103259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255048, "uuid": "3a76ef6f-8cba-4293-af68-72cd6c060a2a", "value": "768:sFHQv22/Jb65IPTAv2Nt93s6l7ZUGDqobk6:sFHf2/UIPTAvgt9c6nUIqof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255048, "uuid": "90d578b7-3d79-484f-bf29-c94fdd0e678a", "value": 39456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255048, "uuid": "de0095cb-d71a-4420-a291-8acbe47d7aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255048, "uuid": "2a2e194c-10e8-4b98-85e1-1577da299539", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7a8ba0-efe1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768241223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241223, "uuid": "968cbcb3-37b8-401f-89a8-9093e6f98e01", "comment": "Malware payload (Mirai)", "value": "cd5c4dc32046b1564d539c4175f60a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241223, "uuid": "a7eaf863-e480-463e-aebd-7dbf07450838", "comment": "Malware payload (Mirai)", "value": "d207e0b4a46eb66b280a1c5f6473332178076d1aa3f8c1ffc8d0bf5fb0e2a0f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241223, "uuid": "737207f8-dbd8-408e-a058-80a64fbb626e", "comment": "Malware payload (Mirai)", "value": "a7b0323cdb0c3d7b425fa6818f394543931714f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768241223, "uuid": "aa026033-f0b7-46d4-8826-f21ac4480c49", "comment": "Malware payload (Mirai)", "value": "1516e85d435091b4a5f844848572e869eb8cd4bf8c72b5f59ca3eae04ca73e8255e6271d2c6c4541a0de6b5cb0a10f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241223, "uuid": "a3b7ac36-8eaf-4dcd-b4b5-bda69b4d14b4", "value": "T128C34A67FC819B11C6C351BBFA1E518E73131BB8D3DA72169E106B21238B96B0E7F605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241223, "uuid": "8b6e24a6-cdf1-45fd-bd14-ce3dcccd033d", "value": "3072:r2eBhKxC0rO42A+QjihgYbXBaBIwfz3HBrl:rHB+RrO42YCgexaa83H5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768241223, "uuid": "e56e52ac-07a9-4dac-a222-d56078bbee29", "value": 120020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768241223, "uuid": "94bece1f-587f-40ad-9e4a-08b1473882ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768241223, "uuid": "1bed1dac-3dd7-446a-9dfd-cd4fd5519095", "value": "arm6.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d47f635-efa9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768217221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217221, "uuid": "b9d81768-1401-41f4-9808-3a15e695be44", "comment": "Malware payload (Vidar)", "value": "9a56c7a3e41f2b82857a37d29a1e1447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217221, "uuid": "097543d1-65ed-41d0-b545-3a07957ba3bd", "comment": "Malware payload (Vidar)", "value": "d23f4f05ca1ca1d698ba18d66771b070c99ec38726acd79548b3441c9a3905a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217221, "uuid": "b4c26173-8f8f-46c6-b916-2b87b6d22f66", "comment": "Malware payload (Vidar)", "value": "c7d656b13525a7452cb6d43b81e7bdb8497e1929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217221, "uuid": "17b0bb14-ed4a-40c7-b364-651106832624", "comment": "Malware payload (Vidar)", "value": "396706166437107cc34d6ef107effafcb3738c5c39fd5e710056dc1e466c8928290ca11df00889e8abd6190e25cc826c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217221, "uuid": "1ff470b7-aed5-41ba-a2dd-131c8fff8991", "value": "T102566CD2BA408635D5DBF239D8612156B330B488133512D36FA61AB49D7FBC4273BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217221, "uuid": "2947b2bb-c4a6-46e1-9017-4206482207a7", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217221, "uuid": "f5f12d62-27f6-4499-8a3c-c660cf6a6cba", "value": "49152:cuGcb6gZirb/T6vO90d7HjmAFd4A64nsfJU/fzDHXBpmAWlrLVK1ACrmQqtMqSV2:7ZzHkAWAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217221, "uuid": "30e23fde-79d9-4fa4-8946-837f7d312869", "value": 6065792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217221, "uuid": "bdc1cbd9-0c6b-4bd8-9f83-3cab84651bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217221, "uuid": "4805d318-6313-4307-8b90-7d70107997f2", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61c7af3-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload (PXRECVOWEIWOEI)", "timestamp": 1768231007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231007, "uuid": "d40d6624-c9fe-45c5-9108-60ee9e72c634", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "5c24bc73025b64e285f118c49420b6d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231007, "uuid": "b18c93ef-9791-45ef-b90b-9849f331cd6c", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "d37789af995529e2c3bbb9c4ed8fab17c457b30e75bff13765f3e88c4b4777fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231007, "uuid": "3971a374-f944-4b9f-ace6-5d299e1f8bc1", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "8468571060a621c0d55127df35ba6cf7395b3fea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231007, "uuid": "22ba15db-a5f5-4720-a693-bd1c63d766b8", "comment": "Malware payload (PXRECVOWEIWOEI)", "value": "6247f3b394f8da9aafd51c78fa2a35f319c1f4b34efed9f19f47d1c8142f4825741ca0d948a7c229f6fbc39ec5a1a524", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231007, "uuid": "157bdeb0-9c82-4141-af80-c01e830d0a92", "value": "T1DC26D69047181905E5BFB6862ED4F0AE9AA867FC1427283E360933C1FE7116DCD7BB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231007, "uuid": "cbb3919d-ceb1-4ee6-98ad-6d67af281979", "value": "384:ZSLBGZH8LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLg:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231007, "uuid": "be968c26-2b6c-467a-87ff-9355390af8ef", "value": 4658395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231007, "uuid": "ed3b75f5-f668-4823-900d-5c74f65dd519", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231007, "uuid": "502cb7d5-1c6b-401b-be06-a3fc73d449f5", "value": "BOOKING_GUEST_LIST.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceb7f64-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218697, "uuid": "7dc69806-3873-4b9e-b2d8-5e4e832d73fe", "comment": "Malware payload (Mirai)", "value": "de60b0fcf835872573993ee5f9778c6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218697, "uuid": "19b5ccb1-e55c-424b-b918-5a106926d0b8", "comment": "Malware payload (Mirai)", "value": "d384816ab8fbbd2da4f8ef21ecde8b5054605eb0e39bfa1ec8a7287d771bc319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218697, "uuid": "b58f30e9-3048-4cd8-8635-2dd931030740", "comment": "Malware payload (Mirai)", "value": "6132f4b13e166631393862bac54a66d7d4b4a925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218697, "uuid": "befdfe7d-c9f7-4fa4-875a-0d6b6640066d", "comment": "Malware payload (Mirai)", "value": "4e649e980cb2826d9b2957f846328bc93ba27eb3fffd0cdf2d798205b23435b43012e81cbd3290f17b75bd8dfe4379ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218697, "uuid": "309af824-6187-4d26-87b6-37f5389e73a6", "value": "T114C3AE97F78B24A1C86146F007C76B8E3E6362119E6BE9E76C1E753B193A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218697, "uuid": "64e6f0c0-a8f3-4632-935e-11143a941c90", "value": "1536:3C189r2mIHgqH8IdgTB45+LaLWqEICjCotZ0eVCUxZJmGg9V/LWA:y1ur2nj7iq5+LetUCokeVC9Gg9Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218697, "uuid": "236d5f40-9df8-4a98-820f-84fad9f4d3d9", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218697, "uuid": "aae92e4d-da0e-49f6-89db-83e466239643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218697, "uuid": "9c0083a4-ec39-42d0-a410-446fd2c0fc16", "value": "johen.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141d8af5-efaf-11f0-a129-42010a9c0007", "comment": "Malware payload (Chaos)", "timestamp": 1768219568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219568, "uuid": "c6fd93c3-25b9-4ecc-94ce-621e691bc4e4", "comment": "Malware payload (Chaos)", "value": "375613233fc35e213ee18b8ddd1b5ca1", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219568, "uuid": "7c54e418-c5cc-4be1-8c11-3fd2e9affb34", "comment": "Malware payload (Chaos)", "value": "d385e5069c4999a4d4161c038443c1682dd33dc578cd7fc9d1d5b2627e41fb5d", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219568, "uuid": "006c7ef6-6e22-40f6-96f8-8c3105997023", "comment": "Malware payload (Chaos)", "value": "bc7b7105306c70a3d369d9c622530a639b8503a9", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768219568, "uuid": "3352e812-b84f-4d85-89d2-0328fb736e20", "comment": "Malware payload (Chaos)", "value": "08c18bf5c981d65fdc629902fec7952349b0182da1b99a7448b2d29f19f5f2b35225ac07b53c4113b28dba26b6bfef80", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219568, "uuid": "38d9dd67-741e-495e-b445-180693cb7b7e", "value": "T146B2D508ABFA4A39F6FF5F786DB211505775B916DC29C7490C8E418A0C33B9C8CA0B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219568, "uuid": "6cab5265-fd12-40e7-9c96-5f432a384616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219568, "uuid": "40056df0-403a-4938-9102-18b424ac06a2", "value": "384:G0JORJNOrjIkMo3uiMlGzgGG0OVs918NHAbXWWU:WJYrjIkn35zht9+NgbmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768219568, "uuid": "3b2c2adc-e8cf-4573-8eed-352fb1e3651e", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768219568, "uuid": "e2d6976c-a903-41a7-96ae-d528ffee41de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768219568, "uuid": "fe191d56-03ab-448e-ab54-e922d53607b0", "value": "cache.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b80e1b5-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212037, "uuid": "f02d99bc-ced9-4a52-a4d9-5b7c410f8ce9", "comment": "Malware payload", "value": "f9645bfc0f5c4c49c987df5b85994efe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212037, "uuid": "b1714db5-fecf-42f3-88ad-6deb2d5e3086", "comment": "Malware payload", "value": "d49c2defb357305284c6cfee085f3f164182cea5ebebb7af84b254d7a5753ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212037, "uuid": "071afd84-8f7c-4fb0-86e3-333b83b75754", "comment": "Malware payload", "value": "e4f7647040f3c104c6fea16ab6446c051784496e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212037, "uuid": "f30d48ba-9007-4b3b-9260-d100f1f62434", "comment": "Malware payload", "value": "22be88db648fe85e52febb7cb8f7c93ec802456e39126f38e672e7da9fd512ec0ed2cf8e60ac695766eb034f0d0010d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212037, "uuid": "d506de09-01a8-4950-b419-6e4203a42b01", "value": "T1DCF4333DD6E9D781EB93A13F3E31D9093E8870F06B5026796659134C2ED6325AB3F680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212037, "uuid": "f3feb8d9-0325-4d0e-a6e0-30f1f8539651", "value": "12288:m3kZXRbRgdWTbenIj+lIt7H847l7VzFqHBwqMgI6ed93lqGYA:m0BRb2dW+nS+lItjb7JVRcBq7dNlqGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212037, "uuid": "14bf425e-7e43-48c7-a80d-1452734095dc", "value": 724436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212037, "uuid": "afe10f37-4799-4273-bdd4-a66bcc5fa355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212037, "uuid": "e8cb7ff5-7764-425e-9a20-e6b2e3f1c31f", "value": "client.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdebfc1-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211259, "uuid": "21678713-0d18-487d-b520-6252fad02140", "comment": "Malware payload (Mirai)", "value": "81ad2f818522dce8992814597c891d26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211259, "uuid": "1126eb62-8a0c-42a0-8ebd-b31fe29df6e4", "comment": "Malware payload (Mirai)", "value": "d520e0f3eb57b6750dca8842e3fded4bea5f6ae1b9049bc0e74030aaa6d10d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211259, "uuid": "bff9c327-47ec-482d-9cf8-19384bbdc847", "comment": "Malware payload (Mirai)", "value": "85a294eb3f4414fb67142c315f49eaaef18834eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211259, "uuid": "c2fa7e28-5366-483a-9aef-6f8cca62eb05", "comment": "Malware payload (Mirai)", "value": "fb20a4101e03616dfc4ba1cafa79d512dd3ca5c19cdc3fb14bad83041718e64d0422301283ff79d2099396a6993e0b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211259, "uuid": "8718e07a-639c-464e-9bb7-65ed43fb76c3", "value": "T191D31985FC508B17C6D512BBFB5E428D372617A8E2EE72039D155F24378B96B0E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211259, "uuid": "5b065368-250b-485d-a641-24343136f69c", "value": "3072:J5BPIhEk3Eu50uRGmqx4ry856v/hvvlWzKBI:J5hIB0u50Tjx4rx56v5vv4zKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211259, "uuid": "f334b6be-13ac-475a-97af-30a6dcb207e5", "value": 137772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211259, "uuid": "d854353f-eebb-413b-b4ef-ede407e5bc4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211259, "uuid": "1481c01c-77b7-4c6b-a821-1bd96aebade2", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83824097-efe3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768242089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242089, "uuid": "cefdb26b-9e76-442c-9098-4ec2cf7b8024", "comment": "Malware payload (Mirai)", "value": "73993b1e529f0e9c4ef0cfa256552625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242089, "uuid": "25e7c3a9-a377-428e-97c0-8cdbea1f4fbd", "comment": "Malware payload (Mirai)", "value": "d538d8b32caf6db4ffd172fa871c1dd0faa798c3837d2d615d68c2a163564297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242089, "uuid": "d34bddf3-8ca3-40b2-9248-ba30acfc9e2a", "comment": "Malware payload (Mirai)", "value": "2f33349063767ffc757ba0ce38abe4fe52b723ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768242089, "uuid": "60257a43-1a8b-460a-a2b0-17ce88e4b833", "comment": "Malware payload (Mirai)", "value": "16f2347877bcd225d02bd9549256a62aa190cc3be4fcf040858f640f9d960c5d99a728b4b1b4d03f6d69259d1f8e3efe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242089, "uuid": "87b6bce9-356d-4d62-b50b-01be0e829185", "value": "T1E0B33C92F981E612C6C662B7FB1E428C372707B8D3EA73029D156F21378B56A0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242089, "uuid": "cb47ef61-f199-4a10-9223-105c9944adfe", "value": "1536:luppTlX56Jctn/OpfcDZv5HDjwys+dCkDj/ONivc5TfIEMKvXuDm:lupZlf18kvvNdCUwkY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768242089, "uuid": "778b4f82-65a3-4248-aa6c-eaeaccddbf42", "value": 111828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768242089, "uuid": "875dc265-7afe-45b4-abe8-d7d2761708bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768242089, "uuid": "26754e74-6a36-49dc-a35f-9dc0068c1ba8", "value": "arm.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2305bd-efd5-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1768236276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236276, "uuid": "a84b98be-cdda-40b4-8f00-72c8683d4894", "comment": "Malware payload (QuasarRAT)", "value": "c29835d37e0ce348e407e675dde9bb52", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236276, "uuid": "5d5e7027-e359-45f3-bd93-58cdb586afbd", "comment": "Malware payload (QuasarRAT)", "value": "d53ca0706ece78210e747cbe74ff7cba643ba453dd025db2bf9561fe2697415e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236276, "uuid": "a453fc3e-3e07-46b8-8e3a-705e770e5859", "comment": "Malware payload (QuasarRAT)", "value": "729ec80ba0708f9a90c6171f8d9bb2b9fa8321f3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236276, "uuid": "9b74fc05-5586-4edd-8fa6-41d7c18ff146", "comment": "Malware payload (QuasarRAT)", "value": "5e0cf83f6bf3cac97f5d898b57bea6a6e578c6097924079fb19cc4431bd9c39fde8bb6d3dacc983d2e4bba5ac3de8578", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236276, "uuid": "6edcb188-73c5-4c06-a411-997a8c7ae01e", "value": "T185263335AAE9437BC37A0371D8EA558F473878F0AF63C42776557DDB02B392498A0326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236276, "uuid": "5b52cb1b-938b-4620-9c9f-38659b67240b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236276, "uuid": "8c1c2b01-b336-43e3-acf0-c9c0cc8a7dae", "value": "98304:abIQP4Z5ZgLNMsKM+rh48PVrSRZUjS7+mvKnZqrh2h7WvPpieF:abIQP4Zfgm9M+dt9q+jS7UZqd20v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768236276, "uuid": "18eed353-3bc3-4cf6-9ae9-1cc57047d872", "value": 4474880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768236276, "uuid": "c711d5bc-4fea-4ceb-9665-ee6a06fc73e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236276, "uuid": "176d4e3b-3676-42e0-985f-7620b762e062", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a36623c-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204573, "uuid": "0a71cd19-b349-4fd2-af36-f36ebed45b25", "comment": "Malware payload (Mirai)", "value": "c19413b5b5acafde71fe754e8202fd37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204573, "uuid": "e8e991e4-976c-41c1-b419-4f2b5cdd5ffb", "comment": "Malware payload (Mirai)", "value": "d54a7aacb4bedf55bf5d68d83bd604e60b155f127cf7808d8d7812271ec41b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204573, "uuid": "ee82a6ac-64c6-45c5-923a-dd08c529e908", "comment": "Malware payload (Mirai)", "value": "961c53d209962b86ade6b23620bddbb852dd318b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204573, "uuid": "8dbaf7a7-5193-4f4d-8e45-873f5faf6044", "comment": "Malware payload (Mirai)", "value": "ecd365cd52e0d00c3ab6c1ee772cbfc6a09339c67284f2524a403436fa529979a351b15db8d2eaaaa340ba0c41ba9eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204573, "uuid": "4c3a4b5a-325d-4f6c-9457-7375f22723e6", "value": "T1BA73C64A6E539FFCF22C82754FB38B3A6B55238633B0C284D66CD9511D6024E596FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204573, "uuid": "94f4938c-1321-403a-bf89-d6c0a560be67", "value": "1536:oV/jXaNJC1xC1fg1Gu5gGVdVQeP7mwevWkAV3cpsT6:oV/ja45gGVdVQezmwtkAV32sT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204573, "uuid": "483541ce-fc71-4360-8c22-e5b66072072c", "value": 80468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204573, "uuid": "f9015c03-7a0f-405f-9870-756c0b9a0a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204573, "uuid": "47ed03d6-9961-4dbd-96d7-2db6962fe699", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fc913e-efca-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1768231542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231542, "uuid": "92a4a763-b01d-48fa-8075-fc2fcc3b2707", "comment": "Malware payload (RemcosRAT)", "value": "a6c76ab7aac39065346672a12d1d0267", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231542, "uuid": "234eaf85-a457-4768-9948-1fbc103c0727", "comment": "Malware payload (RemcosRAT)", "value": "d5a643d1bfa474ce4e0edde403008bfcf0c8d7505696776700e35a5fb6f4f164", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231542, "uuid": "b3983484-212e-4eae-964f-76f2dc3bede6", "comment": "Malware payload (RemcosRAT)", "value": "a7b3ff70a41abec4f07f957a9cca7dcf4b8e083b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231542, "uuid": "799097e1-86f5-4305-a861-da43edf2a619", "comment": "Malware payload (RemcosRAT)", "value": "e765bd635ee4909053d41c21c39e42fc19aaa83b2215ae1ac3721444c267c97b87bd6a9c64e9f2a6ab1213b93958f33a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231542, "uuid": "5d3a6b71-636e-44e2-9d3b-b0650a7e5450", "value": "T1B7440994570D6FD406D29BCF180AD8AEED4EA2E43E61E4ECAEBE5504435EB04C0B4F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231542, "uuid": "db3b50ee-49dc-47a8-bb2b-a58f6ade99f4", "value": "96:eyCSlns9kb3U9khWD1URBZf8oV1Bw1V1dsC0n/:8kI9khmqRPUoV3w7nsCm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231542, "uuid": "619fcfe8-cf9c-4e2c-90ca-2e52d2f53f7e", "value": 271950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231542, "uuid": "21843842-1c9c-49c1-9829-4d7726a64109", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231542, "uuid": "0311a278-3457-4b93-bf10-c5317f62c674", "value": "win32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5752080-efed-11f0-a129-42010a9c0007", "comment": "Malware payload (GLOBAL)", "timestamp": 1768246441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246441, "uuid": "06c477bc-292f-4234-9544-75d028b31e77", "comment": "Malware payload (GLOBAL)", "value": "5508d3cad31cbeecb459c0531b1d9840", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246441, "uuid": "4355f8c9-af15-498d-93df-25589bbc442b", "comment": "Malware payload (GLOBAL)", "value": "d6283822fc330342132cf753d3ff0dda6bf30946af6251259e6f98141a1eec0d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246441, "uuid": "3d75b2c5-8b8f-420a-9735-614889ea9af3", "comment": "Malware payload (GLOBAL)", "value": "aef3d31826192d6084ba25c98af3437c35742f99", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246441, "uuid": "7e9dc841-49e0-4590-bd18-4895fb47a965", "comment": "Malware payload (GLOBAL)", "value": "b41151b683e21544536f4488839d0308922dd60f7b653ea63d888c90e5bd13a8e65f66d663bdae26d141bc0a8fd05540", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "global", "colour": "#A44185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246441, "uuid": "f7b00072-4b5a-4082-b9b0-f364f72fd77c", "value": "T1F4347C30BBD28431F5B75A721979A7764C3E38270B31DACF9790096AE9306C18B35B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246441, "uuid": "021d8258-e281-4015-9e73-f0d1ee31064f", "value": "934cf7ece072cb192e6f1696c5852040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246441, "uuid": "f7d2a5a0-8c33-490f-9508-1206ed40b0d2", "value": "6144:nMQQtXosqtZFnEsPB5TWAZ1OaHjdbOu9/H9:MQQBMLEi+AVT/H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246441, "uuid": "6a74e6db-fb7d-439e-abbb-7cb1667d3964", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246441, "uuid": "41124b00-7881-4c09-8b0b-4d57d539bd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246441, "uuid": "ccc243b2-9d75-473b-a342-ed95827985ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eea95ff-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218781, "uuid": "c0e67d8d-8f85-4592-abff-52b12d7f6c5c", "comment": "Malware payload (Mirai)", "value": "63e56fbe1adeb5a842dafc61dc91bde8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218781, "uuid": "a6324b0a-df81-454c-84c8-f856b0c784ae", "comment": "Malware payload (Mirai)", "value": "d64f802517d8b592568b94d7d86817177f273a111dac374cf5a3343e298a754c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218781, "uuid": "14342c94-79ec-4427-9992-4bffe3c1c069", "comment": "Malware payload (Mirai)", "value": "c5573a17ce0b15181cade7bf1db5b50d70555711", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218781, "uuid": "3f8a28ea-1e86-496b-b061-dce77ce2932a", "comment": "Malware payload (Mirai)", "value": "e400a40d76a0e59b4a554ea1856face8849cacdad9734dc7d3c9bab878b14e489a6b83697789aaf2f3502474bef3ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218781, "uuid": "41fc3802-17ea-4561-8980-04bd04bf18c7", "value": "T195B3E709EF611EF7E8AFCC370AF9270124CD596A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218781, "uuid": "2394777a-56c6-42cc-87e1-59ddbe30dce9", "value": "3072:w9urbdDS5HE6o/JO7B3OFp0FsC01h0q6T:w94bdDS5E6t7S0FsJ1WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218781, "uuid": "09e9e657-ad15-4d52-b3b2-c9203cfbe9c0", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218781, "uuid": "e3d54735-a808-40eb-870f-8560ecefcf6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218781, "uuid": "2c92f1e3-7fee-41c7-a15c-6326143d527c", "value": "johen.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be41290-efa2-11f0-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1768214105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214105, "uuid": "891c0c22-7b54-47bf-82e2-40a7633b80a6", "comment": "Malware payload (SantaStealer)", "value": "e438c03527e6850e6a1b0871ae53002a", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214105, "uuid": "adfd76b5-d484-4aa3-80f5-70ab101f1f8a", "comment": "Malware payload (SantaStealer)", "value": "d8ec36e6949174efd811829fd4a9281751f06576e54e57a39d64cd5180ade475", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214105, "uuid": "765a0acc-a79e-4766-875a-7ab0c385550f", "comment": "Malware payload (SantaStealer)", "value": "78bbf66a57efc63587edd935e0f72ea8ec63a22a", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214105, "uuid": "f057e343-da72-43a4-9b09-8b57786a89e0", "comment": "Malware payload (SantaStealer)", "value": "dddd94bf7927847f8cc7e97af4327fb8fc052ae45f7420d2aab811271d88197f945e0612fcd5e10b1786bf4cb1442468", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214105, "uuid": "74062a05-d328-416c-af15-884d410d5808", "value": "T1F466D0CAD16B40D6CC067FF598142BC39B3056324A34042836ABBE595F779FAC11EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214105, "uuid": "e2ce55d5-1378-4d58-9524-293225d17ea3", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214105, "uuid": "38fa46d9-6e2e-46b4-a79d-a763003afa22", "value": "24576:V5JiB11JZNSC+/ZJhjdG8xLc3floOeyEkuj6VSGil+v9VrAwDGUW7yKKwCr6DD6P:V+07CCNYbGbQ16PFfVRJfo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214105, "uuid": "e13ef816-96ab-4e16-b23b-f29a58ffda41", "value": 7011840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214105, "uuid": "8e08c0f0-b2d5-461b-9ae3-6b02d400585e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214105, "uuid": "5e4040aa-c8a8-4452-930c-85fabc9bf605", "value": "Lizarium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42054a1-ef57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182041, "uuid": "2364d6f8-3f6e-4092-8ccd-ed9ad987ea20", "comment": "Malware payload (Mirai)", "value": "f9cefc3222d71fbf9372f4b87a9a787f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182041, "uuid": "f762fba5-fbd3-441d-b91a-9f1fce80f38e", "comment": "Malware payload (Mirai)", "value": "d8ed9ae9ea3e0222642e6bb63ea8b980961cbe655460b16e444e90a46211dbae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182041, "uuid": "da24323f-6200-4c8a-bf5e-0c529d825776", "comment": "Malware payload (Mirai)", "value": "8d2bde8258430ff35d23a8cfd17a547cbd0d0716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182041, "uuid": "da55ab48-c50f-4db3-8762-a851bc8806b7", "comment": "Malware payload (Mirai)", "value": "1751ee6e52d5e49fcab5301f0eb64925f45fd10188ccd071b0ad737e7bc7d825e882ae915bea07569766d3ea60f982e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182041, "uuid": "b40f596c-e73e-49e7-97a4-40c699343838", "value": "T135643B23FF0C6422C8929E712D7B2BE6A338D9E161B5A10554196F2D2F32BB0598777C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182041, "uuid": "f8c160b9-a147-434c-a556-5521a9518a64", "value": "6144:jZ8+FsYtjwev1BiRLtgjgLJvF3Fxqcrt1XN8tth:jftccCFBt198tth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182041, "uuid": "2882f5d1-b02b-4637-aa3f-8f8198844bf6", "value": 312760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182041, "uuid": "81f704a7-23c9-46ad-8620-d2cb15efbf04", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182041, "uuid": "d65b6744-f608-44b6-bb47-ea9800782e11", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2174d1-efcd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768232547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232547, "uuid": "c8b575b9-ab0e-4f22-b99c-2f2c9529fdfd", "comment": "Malware payload (Mirai)", "value": "5c633a01c9d6dcadd344b186377647d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232547, "uuid": "167720ab-7902-457a-8773-3942b84778c9", "comment": "Malware payload (Mirai)", "value": "d954df447abfeafc899580d9d985863b7045029c1c64fa7982857aebde535b0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232547, "uuid": "36962a71-1e8c-4138-94d8-5aacd228e15f", "comment": "Malware payload (Mirai)", "value": "030d1a4404469a82068cb8e43f21c60a2b52842d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768232547, "uuid": "2164dd51-c733-450f-9331-91614f3f2d24", "comment": "Malware payload (Mirai)", "value": "a792f1b3a28807dc1b57f85c7dcd7c833977a40b13dab3faec8a2c83b25e44538142c3cf67aa35ff193d4ece977f12c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232547, "uuid": "83081eaf-f59d-4be1-a81a-e1dd5089d4b2", "value": "T193E3296AEC819F51D9D526FBFA5E8189335307BCE3EE3112DE244F25139A92B0E7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232547, "uuid": "91a83555-00bf-48f9-ab52-6dc01690872a", "value": "3072:bNLWLdATyyHH/48VlWLvCmIa28aV1W24O7TuU3WVKgXhj:ZLWLdATnZPWLwaBaV1WnOWUGVxxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768232547, "uuid": "478ed868-9928-4f1c-902b-bf8d04e0ecd0", "value": 146964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768232547, "uuid": "753df9a8-bf5c-4e0c-a88f-8e8204dae25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768232547, "uuid": "c3a55dfd-0a92-4745-b553-ad9db16290bb", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fc35de-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214546, "uuid": "657887c5-3a3a-4cfb-9d02-02aba7a06687", "comment": "Malware payload (Mirai)", "value": "e2a2870efdd1dd80996ae78893324eef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214546, "uuid": "5ae40db5-2f40-4b87-80bc-94cbca04c839", "comment": "Malware payload (Mirai)", "value": "d9999b362b8cf592d481104f078514ab67c6ed77bb1a40759a20a9f72f477849", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214546, "uuid": "9380c86b-3f61-4b64-82db-408f14d77555", "comment": "Malware payload (Mirai)", "value": "a8b45a5f6d29d7b4a1a5a30c77843a4d71f2635e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214546, "uuid": "5438cf21-11d9-4036-9b23-76302fe0275f", "comment": "Malware payload (Mirai)", "value": "2fff443e00132a3d9e4d6a79b21ce4b8722e72fd86a68367ad47eb5fffde83bc6091ce77ac18129523e5c100b2152cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214546, "uuid": "a3888d30-dd52-4780-82fb-92692dad2c84", "value": "T179535B82F6D3C1F1F58346710057E7AF8B34EE298024DD9AEB193E75ED76602825B26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214546, "uuid": "40e3a4ff-e23a-44d9-9d70-e7330e079ed9", "value": "1536:9ZvFSwgtLZvkHTUbwaYlt7iC6mCoryY6:7FS3tLGHxaYRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214546, "uuid": "9ad95ef8-c696-4ae9-9e99-69ef99e6e9ac", "value": 62712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214546, "uuid": "95f1cdec-dd83-4106-8808-a9383fd53ff5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214546, "uuid": "3bb20144-8f53-415f-9452-fd62d14c6731", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7add7dcc-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217593, "uuid": "ed100a9e-ba87-4cba-aca8-93b7af1359ba", "comment": "Malware payload (Mirai)", "value": "dd1e378978d734e65151e678292747cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217593, "uuid": "6a4a4622-17b1-48b8-b945-c1d6a282bc2b", "comment": "Malware payload (Mirai)", "value": "da20932334b916a18878be244d4220defe82022f5dba35abb6e114dc61548b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217593, "uuid": "ac711235-2daa-4450-a72f-1a1c95078ef5", "comment": "Malware payload (Mirai)", "value": "e4c914a3bd069cbbdaccbf02068e0a725c1cc2b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217593, "uuid": "403e80b4-21b6-4a00-b4b6-d001a67ae1a3", "comment": "Malware payload (Mirai)", "value": "64ffaa06196ce197f0b7b849616f5c0458f368f9f7a1b04399a3e075a2dff7afe36ea1ea8a36abcc95b33690f553633b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217593, "uuid": "faa9ed4b-8970-4ab4-99df-edeb3078958c", "value": "T145F35C46EA818F13C4D527BABA9F42493322A764D3DB73078D185FB43F86B6E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217593, "uuid": "d571385d-3e6f-461c-8c66-ff30f4cdd798", "value": "3072:aP6g14YAUcspLjEobrMROiuPOLk/feR9wDtAaM/9enbiuGpy/o9u0:aP6g14bUljEsPiuPOLk3e4DtBM/9Cbi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217593, "uuid": "4ea36d13-6943-4592-9e8f-713a71d2d1a3", "value": 159454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217593, "uuid": "622a53de-84b7-4062-a7da-bc25e1c5465e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217593, "uuid": "59601ba4-81a1-40ef-b993-ba0824e8b0ee", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddac5b47-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179104, "uuid": "e83ec60f-5ceb-492e-b14b-cded0792a2b0", "comment": "Malware payload (Mirai)", "value": "1af9c1e543e9b3ce1efde24a9526fd57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179104, "uuid": "4776752c-1540-4fa2-a9b1-b6b1b1a1ed92", "comment": "Malware payload (Mirai)", "value": "da68784b959039b9ba03748cfba795916469a98046d3e7a68f80eee5be555edf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179104, "uuid": "4467d5ae-6de7-40cf-97dd-6bc99ddef9bc", "comment": "Malware payload (Mirai)", "value": "27286507d941a8565085e327519b077a3af49210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179104, "uuid": "f0a92a07-5822-49b4-b93d-4e2a7f087547", "comment": "Malware payload (Mirai)", "value": "659b53a32996ae4f7ae63fcf1500d8de0c57118bd14dcb8219baf934daa757d3bc2e722b2eaa7b2dafc0651b7c18d9ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179104, "uuid": "f7099eea-b6a8-4c43-8566-8eb8f08b5267", "value": "T1C6931986BCC5C612C6E071B6BB0F56DE371643B8E3E6B2439D1CAB19674B8570E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179104, "uuid": "cc0f4cf1-b3b5-48af-a015-09a14dd6f21f", "value": "1536:/4KZoeFjg8jyue+NVPxGhTfi2g1bNNiVK3TAbVR:/4KeeFE8HjfOTf81bjic3TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179104, "uuid": "ed74fca1-3eb3-476c-8dac-a99bb53883ee", "value": 88888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179104, "uuid": "00e4fc28-d3d9-4dc4-8b94-57eae852392c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179104, "uuid": "0a5e3d9b-4c60-4282-8b9e-f35dfa473479", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2e6de-efec-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1768246030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246030, "uuid": "86a325d5-1c61-40df-9d61-ead43f1cc6a0", "comment": "Malware payload (Phorpiex)", "value": "73e3211be7ef35f98804b642fc7484e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246030, "uuid": "315d9a11-2a9d-4b4f-a4e6-2aa4a7f0bc5e", "comment": "Malware payload (Phorpiex)", "value": "dace0ace114449ffb03a07902681e2502a507b2968d0d72436fd50f1fbdad9cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246030, "uuid": "369c56db-6767-4c70-907b-087ee4ea47f8", "comment": "Malware payload (Phorpiex)", "value": "44a8780e285208ad102c5c10e5811e39d8e65b34", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768246030, "uuid": "5d60a7f8-6417-463c-82ae-06ca72aaf8cf", "comment": "Malware payload (Phorpiex)", "value": "e91deae370fb5b03b79044df1683493a9b03712fa25d0e3fbbb0a17071c965b22c28a68cca94464099036855336afa75", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246030, "uuid": "0a571329-4b0e-4ec7-95d3-f71101ffe9e7", "value": "T137B37D1134C1C432F567217A88EAC7B58A6DF8310F75A6DBBFC406AD4F266D19A36383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246030, "uuid": "7d7faff3-33a6-4da7-a563-fbb6a8ecd1b0", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246030, "uuid": "dce70a8d-cb00-447f-93b7-73071c5b90fd", "value": "1536:pPOGBloc2dOTtyuzm5Gq0IbOLshFMSSrgY96kkqrfC8H5fLA:JOGBec1P+Gq7qLQFAwTqrfCg5fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768246030, "uuid": "38c372fe-471f-45bc-add4-0490eef34fb9", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768246030, "uuid": "ca677fe9-4636-4cec-ad0e-a862a9409fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768246030, "uuid": "c507ee9f-898f-4a6b-8c03-43a3261def63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46a6c73-ef59-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182927, "uuid": "bc8bafea-82c9-44d9-a8f5-a7090f0f5087", "comment": "Malware payload (Mirai)", "value": "74e609611f4116b36dd1680f463e78fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182927, "uuid": "0965e639-7923-4f2c-9abe-469ce4ea3c11", "comment": "Malware payload (Mirai)", "value": "db0de14f92993e4fe831cf7559fc084c6399e04d2a942e137d342bb11967be52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182927, "uuid": "40da4df5-1db9-4c6c-a277-1a77e0904721", "comment": "Malware payload (Mirai)", "value": "e6032240d4a3ba7f61835d0b7022aa3ca38c796e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182927, "uuid": "a9307934-34d7-437e-9402-c67eb3ce919a", "comment": "Malware payload (Mirai)", "value": "bee1268a6eb82406e9c69c8fec883e1ac3b915e31a5cff27b4531ae6b455f36b23b4863996dae1c96fa76a62d3064b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182927, "uuid": "cd72b35b-8614-4832-b6eb-ccdfcbdb0266", "value": "T150556C2AB2B2F66CD007C03497DBC6A14521F0756A323D7B3784DB352EBADE45359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182927, "uuid": "766d3b55-b36d-451a-af90-95852aff208a", "value": "24576:71CzHNg6GaVmDP+jq2PT2UN2X0PHs0LLQ6dOLY:71UHNgIkF2PT4AlLLQhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182927, "uuid": "74001f0e-0fcb-4ae3-8957-0ec4ee7c95c3", "value": 1314544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182927, "uuid": "39eea005-f226-42d9-bc94-fbde7cde8ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182927, "uuid": "9a67ad91-b393-4d30-9e42-e04e70bef39f", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a2e0d8-efd8-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1768237500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237500, "uuid": "ac37fc67-80b2-4da5-b2d2-8794174036f6", "comment": "Malware payload (GenesisStealer)", "value": "c345de24b389c312922d3ddae714fac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237500, "uuid": "79789e49-22f3-4cf6-bb0b-2b783ace002f", "comment": "Malware payload (GenesisStealer)", "value": "dbe6483c3fa475ac6ec6cf2b981ec08a5617093568ef1b04575c129013af6908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237500, "uuid": "e655ce2c-31ac-4381-a273-a855e887ddd5", "comment": "Malware payload (GenesisStealer)", "value": "693386f8bcf7e8ad2d37ee34d7e400343386fcbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768237500, "uuid": "2c67434f-a5fc-4a74-9faf-5233f47e56ba", "comment": "Malware payload (GenesisStealer)", "value": "594569945c4a8612e0faaf59d61e0573a3d85cc93d585ad5146aa8e554a8f7130096aac4e6fff5c7739b8ef6330dff90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237500, "uuid": "40f53b2b-1939-474b-a008-dc14c1569f5a", "value": "T1AD18337E2FE6D90FC005757B86A662F114E268532E26907F726A81FCD4ACE31D2709C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237500, "uuid": "c8b3c00c-c17c-4674-ad59-e5be3c4e342a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237500, "uuid": "8f162e59-0f53-4c89-a3a6-060911581568", "value": "1572864:KW+BWMFDe45kQdQ8J/q3w6hDRVOjTyD1KWHsPKhwC8coHhdXmaXALwpD/bj7aE:K3BFle45J6/rhDRVzBKQ5wvS4plX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768237500, "uuid": "c4871069-8e3f-4241-affe-5aaa54af90df", "value": 89332367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768237500, "uuid": "b01afeed-b8f8-4d21-8683-e7cd6446688d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768237500, "uuid": "e6b3ea2c-f1e6-4002-9be8-5686e9c7de43", "value": "VoiceMixer_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72770ee1-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768216720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216720, "uuid": "5630dfcb-7b2c-4d63-8256-1a7c01a5ab6a", "comment": "Malware payload (Gafgyt)", "value": "86c7f630582609c6b9097e3eac1088ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216720, "uuid": "209fd0b3-5dfc-429d-8ecb-1a73329c3b7c", "comment": "Malware payload (Gafgyt)", "value": "dc966bf0d1b7eb048fcf658d7f4676818456a5882aca6717a6408ae923544a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216720, "uuid": "dc4318f8-7b7d-4a7e-95fb-0ec73c7874f8", "comment": "Malware payload (Gafgyt)", "value": "3f17cc424d63672a89d69bf92721b4072d880840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216720, "uuid": "29c0cfe8-ea06-4f18-a04a-8fc1a203ef6e", "comment": "Malware payload (Gafgyt)", "value": "2c9fd2446d8ba8a6a7c906a0cc7ea23be6aec9d627a992b3628b744b0e7dca092ec0806525dcd3c641d622e6235e5ea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216720, "uuid": "2596f931-e26a-4769-af26-d432c3cce3bc", "value": "T1BFE3656E7A22ABBEE168873107F39F70D39515E227A19341E2ACCB185E7138D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216720, "uuid": "1695c43e-4060-430a-8e4e-97b284b499e9", "value": "1536:0n/SF/iP6OzAGS2rKZluV0Qx1ExNQJd5OpgSJDsBHEgBuuAzWgSHFVBNJvVm6Cn4:X4OKjnbSBsQupHF3dmbnbUHIfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216720, "uuid": "3666547d-6dd0-452b-b7ec-707799354dde", "value": 153902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216720, "uuid": "e129e738-66d7-45e1-86d8-eef9e3bac445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216720, "uuid": "6cd3d62c-8743-4898-bf5e-593227abebd4", "value": "m-i.p-s.ISIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35512136-efb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768220483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220483, "uuid": "ecbe5caa-6d25-40e9-bc65-e6ba047f9e92", "comment": "Malware payload (Gafgyt)", "value": "4165d34cbababf0f03763b4051353f57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220483, "uuid": "234063d8-b953-4881-b91b-870c9c3ab5a7", "comment": "Malware payload (Gafgyt)", "value": "dd723ec4bd8ec04dedf695ecd83f667c9d3ac9b195d27f9105ac34d42241a769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220483, "uuid": "8af72252-91fd-49da-a9a0-1c8b9e323f01", "comment": "Malware payload (Gafgyt)", "value": "445c897820fce7cbed9e5a9f0de9f4370c4ebc98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220483, "uuid": "7fb15201-f13b-49aa-880d-94dc87e5c5a2", "comment": "Malware payload (Gafgyt)", "value": "af7cadc9cac8486515483667b08d8ca1807720710920202687254dcb0417363fc27d53f639cd4dac648a3cc56af2f3a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220483, "uuid": "9cb096a3-d09f-44fe-9162-18dc9c4dd290", "value": "T17283182B9251C1BEC08346B12ADF9961AC73BC390B3262067395BE6D3F35CDC5E99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220483, "uuid": "835eaf6b-bb2c-43d2-9796-be62303ebedf", "value": "1536:qbu1gdrMtjWqtgI6kev6mJgyPyp6z7m4fkr6iLHzEvwOSkIpHqJRU:qi1g3qWLDv6gPyu7zCDLHzEvwOFIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768220483, "uuid": "ece3421f-3764-4ab3-8796-1189c8c9907c", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768220483, "uuid": "b20f553c-2ceb-4f88-a809-aae7967d4338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220483, "uuid": "cf7cc8da-b15f-4b47-bf1d-2f5cd3c59d04", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7342aab-efbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225506, "uuid": "8142edd9-d65c-4253-8436-51223f7b30e0", "comment": "Malware payload (Mirai)", "value": "f2abde1d243a0ab49414002111bddab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225506, "uuid": "c9caeafb-e952-488d-9a69-c8fdd9939b1a", "comment": "Malware payload (Mirai)", "value": "dd7a12e5f521a68643c2aa92e447e733df25f175879499302da5d38b432c6144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225506, "uuid": "952b7505-2203-4175-ba03-07bcdd36da47", "comment": "Malware payload (Mirai)", "value": "ac330d1e36b212d114afcd9a9bd7035a3be37183", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225506, "uuid": "fc39e141-118f-4c8b-a445-e1ce36a07b99", "comment": "Malware payload (Mirai)", "value": "8d7be23cf9a9c0dacec88a4f539d8e26e0304c33de6a61bc5d131b418405629980dcf9f394a634b853549af4671632c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225506, "uuid": "ff1bcc88-a1b3-430a-85b2-3fc15d4cd0ad", "value": "T1FC636B028C756D98F07F7E701039CABB9753A54DA91B6CFB3C478661001BA88F5A6FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225506, "uuid": "e1d913a8-86a2-4b96-bd1f-0fb76746adea", "value": "1536:JTZc4fH8gSEk+niZ60PeD+b58CDgPCiRTF:JTZc4HNk+niZBPeq1ZgPdTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225506, "uuid": "c314da7a-b71b-41f7-8a43-d73d31bbeea5", "value": 66760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225506, "uuid": "35d5527b-0aef-4e82-889f-477234540bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225506, "uuid": "ce172ece-ce6e-4c57-88f9-1c22139d4799", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b3ee32-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179941, "uuid": "8022b183-e471-4053-816d-bcebb9d8c81d", "comment": "Malware payload (Mirai)", "value": "f39a936b0fc0ab9d4a1f4adc60dfc446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179941, "uuid": "50d8aaa8-d24b-406d-b81b-6206dcde165f", "comment": "Malware payload (Mirai)", "value": "dd8442ca906e0b1f39e72ebabb2b6ca507c68011a72d512efb4e6e00c6a07e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179941, "uuid": "5db86c23-0de1-49fb-9a98-d596e3b7034a", "comment": "Malware payload (Mirai)", "value": "8a7a35e429a0b749b7c2b728d8aad8c0b6f6df5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179941, "uuid": "c33a1bc0-81ea-4eed-9f3a-0b77f9e4ff1d", "comment": "Malware payload (Mirai)", "value": "a23fcc998741b01c0e01a53f5676400e1a45e733f4dacacb0a14f5378bc4be06b39e971620b40e4c2380d466268897cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179941, "uuid": "774d5113-5ee7-4f8f-a0a7-79d45069ac3d", "value": "T196D31260EAC2BEE8C134597D1036EEC84E2C6F1CAF87C11D75E512B1EA5DC460229B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179941, "uuid": "43b0b5d3-10f4-413b-b24d-7cf9efe21a37", "value": "3072:G6bW3+pNkzWWueE+XNsGwmqVqyhC7WORy0durfLYSqG6Y:KOnkCWu/WNsHmEJ5WdaPqG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179941, "uuid": "a392b1ce-4b2a-482d-baf2-27e975da1e2c", "value": 132916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179941, "uuid": "49cdcc54-1de0-4d0e-9488-64a801583055", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179941, "uuid": "80fe1d50-ec81-49e5-abaf-16c430a3a9cc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f140abac-ef5e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768185150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185150, "uuid": "24ead584-e7e4-4628-9672-625155bc90c4", "comment": "Malware payload (Mirai)", "value": "e74b712cd00c14d5e7c367f006926f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185150, "uuid": "77580e75-197b-4aeb-ac09-68d14fbce531", "comment": "Malware payload (Mirai)", "value": "ddac860fa89ed2925bcd40158cc799bedfcd558f56ebcf199c18f7b634e41b01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185150, "uuid": "01f0a5b9-5e56-491b-b72e-167e46fdf417", "comment": "Malware payload (Mirai)", "value": "5f34be76f78accd88040f21081195afa89adafb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768185150, "uuid": "a8f28a5c-993e-40b7-b1ee-d06c94713f9e", "comment": "Malware payload (Mirai)", "value": "852d75d92fd50c2702dd0c728c907b25eb792b5cbf2519fefe44919e2ccadcbd9b5f3871aea957cff507fdc0150d2f47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185150, "uuid": "43ed5ade-2bb3-418c-b587-1cb5bdb504fe", "value": "T1D9731995B8814B22C9D512BEFA1E118E3313177CE3DE73129D20AF24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185150, "uuid": "9ff163a5-f0ab-40d8-9094-e0214855e2b9", "value": "1536:FnnAqDQCyz8NnRHH5wRAaSu/GWQcgMuivGjcTE20670L5HYUs/g3o:d8C7zZwRAaSSqjcTE206gLh93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768185150, "uuid": "4be88e58-bbbd-4e89-bd41-58eceb5a3d40", "value": 80412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768185150, "uuid": "a950471f-aa07-4a03-a921-149cdf858d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768185150, "uuid": "dec71932-958b-4396-89a6-4f77e84179cd", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf54944-efca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231446, "uuid": "9086f55f-1c5a-47eb-9f53-92d861a6ff39", "comment": "Malware payload", "value": "1b3c0ea48ab4e1621852f764fc346151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231446, "uuid": "b670fce9-bfb2-4dcc-973f-3a7b5353e7eb", "comment": "Malware payload", "value": "df467545dcaf4894501a15ff101c33b74c0748a6245735ee46a4ce851058f1f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231446, "uuid": "3108ff0a-1ca6-4d9f-8288-c4a0e8f28c02", "comment": "Malware payload", "value": "4ea1df12a7cc955b615c8012f0f00ba461090d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231446, "uuid": "150f3411-5da8-4408-96da-c22bd3319642", "comment": "Malware payload", "value": "ff4825c4f3f1cc7d7ad6ba638e924c0e4cf42e9980946e42158169c0a8acb24cd6dc20597c345cf2b6debb4fd69a2c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231446, "uuid": "5e2837bb-5cb2-4bdd-8c07-e6e12248d88d", "value": "T1396239029ED024A1DED102B583FE6A32D1BC6752234850D397BC28896F716D7FA36F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231446, "uuid": "0b61de94-636d-4d1a-9425-d225cd4425b4", "value": "384:3o4wDTyysCTBIRJBAQy4gk+QhTFfsveuF0LW:3o4wnRsCTB+JBAQy4zd+1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231446, "uuid": "94ea9b97-0fc1-4486-b460-5482231e9ad2", "value": 14652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231446, "uuid": "47cb4043-ea8e-4ea6-9cf1-f1df53b3bb37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231446, "uuid": "513ddbe8-1a00-4a1e-86ac-082ed0771a0d", "value": "1b3c0ea48ab4e1621852f764fc346151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7838a7a8-efbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768226178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226178, "uuid": "9e98d48c-2790-42b4-9069-b35126d89d01", "comment": "Malware payload (Mirai)", "value": "5ed6848e6c17d6f953858722d1519856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226178, "uuid": "9a4a95c1-bf2a-4a3f-a5e1-99e4156a206d", "comment": "Malware payload (Mirai)", "value": "dfd65fd6c5cba5a6a2fd93bb8b677bab68f67569c9deb91bf310f557f5d6beac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226178, "uuid": "daea6564-4714-4430-8266-50d419a8fa3b", "comment": "Malware payload (Mirai)", "value": "8bab0766747092f4ce0c510c2364e9a3640c1758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768226178, "uuid": "3e207d21-4c44-493a-9e07-5dd579873ce5", "comment": "Malware payload (Mirai)", "value": "4d585de78d5e4d2ad4c0f93450401f7b557b62968beb7735ce22ef227d1a88b1e193ceb2c14628e348bef1c1894b8bd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226178, "uuid": "9e1aea5e-d6d8-4d59-92bc-2db529ae375c", "value": "T19F5349C29142D8F5E9090174203BF73BB576CEE802B8BDF7F75556730429AA4B18A78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226178, "uuid": "354152d5-15fb-43e7-b0d2-43dc2ce34783", "value": "1536:u8OApdYyFtMmL8/iZ28GnyQY2zNnzncUWN/RpnnLxSDhNcz:uF8O22mL+XWQ/NznzWN/RpnL8DDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768226178, "uuid": "f0b5f739-e341-4e1b-88ed-57bb17ded947", "value": 62448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768226178, "uuid": "ec821eb2-213d-44b5-898e-52bbdcef9201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768226178, "uuid": "92f80d5f-e019-4915-baca-80b8e0d7aa03", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8c6d67-eff8-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1768251313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251313, "uuid": "c99551d2-5e31-48d7-92b3-0b23c11796ef", "comment": "Malware payload (njrat)", "value": "23792bdd1136c3a69ad6a5bdc0914a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251313, "uuid": "afe804ca-1865-42da-9114-ee015f2873ce", "comment": "Malware payload (njrat)", "value": "dff65050ec444ad8da5d6ebe757ff45f71c8f3e898382c7e9570031a8c90c26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251313, "uuid": "f3c36859-966d-4c0c-bd09-ee2fdb3b4a37", "comment": "Malware payload (njrat)", "value": "cfa5bc8de22bc1f9b0661cbf5146015238a37a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768251313, "uuid": "adf1fe3d-d155-4783-8dea-c065d7a6c96d", "comment": "Malware payload (njrat)", "value": "434eec7c1ea134a45713f2c9d838b4934176b64b0b17e5113f4bc576147bf2e88b09befbfaa9a4b3fcd2c90eefe9662c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251313, "uuid": "c8a86211-f815-4deb-9884-620c3095d37c", "value": "T13603294D7BE18168C5FD1A7B05B2D41307BAE04F6E23D90E8EE564EA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251313, "uuid": "9c13f52c-9850-42c8-a874-76775af3202c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251313, "uuid": "835de5f8-234d-49cc-a294-837f9300e709", "value": "768:mnY0DwODZX8fkMklk8rM+rMRa8Nu/0Ft:mnFTZMcMkSP+gRJNm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768251313, "uuid": "10a66bc0-e887-4dd7-ab00-b0265352c215", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768251313, "uuid": "e4fe2081-6011-4fce-80b9-05b0c81f990b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768251313, "uuid": "0eb3849a-fae9-4b4b-9579-5436ba1a55d0", "value": "23792bdd1136c3a69ad6a5bdc0914a45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d74e48-ef52-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179648, "uuid": "e5e64851-0e3e-4a65-a399-bdea6c3f4e02", "comment": "Malware payload (Mirai)", "value": "9e5d05f84e362ea5d3540e9d00007c76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179648, "uuid": "d4b1ed8c-d025-4818-a482-9a5e09ac35f5", "comment": "Malware payload (Mirai)", "value": "e05a699b01e1a92a02034c12f6fd0ef4f3640071cd6c5f3adcd4b954029507ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179648, "uuid": "af53e419-3603-46d6-8976-e81d3024b9c7", "comment": "Malware payload (Mirai)", "value": "7c5661d6dfafe526cce05d6f7efaa9ee34835e1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179648, "uuid": "7921f294-5d80-4903-b50c-293f7c6dd0b5", "comment": "Malware payload (Mirai)", "value": "ac602ef1d07535e765a69fc68a3f28df52f41b2fd785569d43619f70990c1c8c526fa9e4dc1cb31f2226b617f31897e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179648, "uuid": "96b10524-50f1-4314-8a4f-d455863eb78b", "value": "T1E1838E128C699D98F07D6E3020B8CBBB4B13A945A95A6DF76C47C22500179CCF5DEBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179648, "uuid": "b8a49008-4e33-4fff-afdf-9ad1eb107aa4", "value": "1536:DkcI4dcnR5IMfrgYPFj2lMjPFJukjN0NolDqnCX90qmTAbVR:DtIPR53rg0+yHukbqnmWvTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179648, "uuid": "f5316da7-ebc1-40e8-8bdb-8088a6e1ca93", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179648, "uuid": "8adeccc1-dff9-4abe-9446-46bdc642d26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179648, "uuid": "6a255f0d-e683-47a2-814e-c359afc911cc", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a7af49-ef8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1768205323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205323, "uuid": "9793130a-1048-430a-86a2-93214afaf898", "comment": "Malware payload (Sliver)", "value": "b9bad3be80e67bf954a6e82375846d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205323, "uuid": "316ff12d-d556-410c-a394-0eab21615779", "comment": "Malware payload (Sliver)", "value": "e09f66978e94f4eb3c379f58de9ea6e3e9808fa5daaaf4764e441f74e14ef147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205323, "uuid": "85527f82-f46d-4a4a-819d-20408d8cc900", "comment": "Malware payload (Sliver)", "value": "c4e94157adf0f1c335226c50bc64c518a821994f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205323, "uuid": "7309c1c7-4a1e-4d52-8910-d2be2265aa32", "comment": "Malware payload (Sliver)", "value": "ba78e165ceb21e0346a90527b8983633b01b6c8fdd4224021cff514dfcf6a0e2b7326e24668c4a851b9a21418d2bf84f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205323, "uuid": "d625b013-86d9-41db-ac71-539cc630cb86", "value": "T1CF26332808A23F37B6C83BB0DA7B3A519993910E76F44B766726DC67917EFD61305032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205323, "uuid": "971a4f93-22c6-4160-b353-9e8c0cbae71f", "value": "98304:aaaTVYKV80oeVtPgjRzva6gZc+cc5tPN0Wn0SXa2Ktke1LbqDDCbm+pKanJeL+lx:sJYPnjRAW+5t3Uz9D5oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205323, "uuid": "68cae29a-e167-4119-baf7-b689d4958757", "value": 4739832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205323, "uuid": "d8a3c896-efde-473a-8070-57df44ac42cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205323, "uuid": "66f594c1-62df-4584-adae-33a37970d55b", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3611daa2-efad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768218766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218766, "uuid": "6f0e1b21-8c6f-4ffd-a8e1-1e9c9377b6aa", "comment": "Malware payload (Mirai)", "value": "7c3eae346b150cf23a6a1546c415aa55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218766, "uuid": "c8a5f4e9-1a04-407b-9a02-bef5e3a450cb", "comment": "Malware payload (Mirai)", "value": "e0c4db171b90e6fe04b3ac6b96b695dd6c2168c3abe90e71be2410c9125201f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218766, "uuid": "d2270817-56af-4eda-af0d-0dbd3d32fcae", "comment": "Malware payload (Mirai)", "value": "bf13d87cabc4b75d3f1fee6acea2d78b2e675809", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218766, "uuid": "384979d6-3841-4bee-bf7d-855c506d3e93", "comment": "Malware payload (Mirai)", "value": "2fba8b03639ea3dbddd342b5532f0e6ea904f54cc63bc03aa9cfc8fe2caa6b3dd70d4413aa3d315e9ea42f193f7bd270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218766, "uuid": "48f09762-96e8-445c-8fa1-d2acc267e02e", "value": "T104834B0273580D43D1A71EF02A3F37E583EFD59121F4BA89660E9B4A81B5EF2154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218766, "uuid": "5685847b-cebb-450c-baa3-1250580c388a", "value": "1536:r9UIXOVeWbi7JNdtp4OlEFL+wmCWoyntMT45:r9UlViJpdEF3mvk45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218766, "uuid": "241530c0-3260-41b8-8a08-39b5197410f7", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218766, "uuid": "4319bde9-c3cb-41be-bda7-2ee52d1194cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218766, "uuid": "3d6b5b28-01bd-4bf0-9b60-8f2846be8adf", "value": "johen.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa21fa5-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217601, "uuid": "6a56a1d7-627d-4a9e-a3cd-4e4c27c3d1bb", "comment": "Malware payload (Mirai)", "value": "9dcbc1d56b12da9d1335cf3d51f95df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217601, "uuid": "94f96e73-9ce3-4b7d-bbf6-706340c3b229", "comment": "Malware payload (Mirai)", "value": "e18e662e9b55381cd8c5a19bb81e15b78db2ac0ae2c675c2bddf39d984ee5d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217601, "uuid": "6d032000-0f0d-40ff-b769-ad0aa4472283", "comment": "Malware payload (Mirai)", "value": "98ccecd6eb9e43405b1806d0fd526789158a48e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217601, "uuid": "311297d9-5e9d-4d83-b7cc-814409d4f720", "comment": "Malware payload (Mirai)", "value": "22e91fab19ead97382c337cc8ec53916b2a71a44a4e31a6274670b32a503f35a63b72bff5f2081e5cd3af423acb8f7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217601, "uuid": "a41b095e-1722-4753-8bbd-457d604fc0f8", "value": "T13DB391097F610FF7E8AFCC3749A92B4228CC651A21A83B75B934D818F64B25F15E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217601, "uuid": "63caa99c-6d91-4c00-8b73-ef8fe4aaff2e", "value": "768:mHnnxjB96cW/c5Y8in6Jn/1CcMT/p3Stftk+qgchmIVrDsxxr51ne5eA8e2BSet0:Q396cW/c5niVrArzIl8FBSPpZPWGycD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217601, "uuid": "46ce5180-426a-4be9-bbf4-95de85bf0f36", "value": 109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217601, "uuid": "9abfc640-1825-476d-a8c6-ad33f54a927a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217601, "uuid": "05ee34ea-6bd0-46e9-8d73-b29253e60500", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99194a24-efd6-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1768236541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236541, "uuid": "c96e2870-b16f-4f33-bae3-20372aa0d380", "comment": "Malware payload (Formbook)", "value": "311112913be9ab95b4ad7b798b7a9cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236541, "uuid": "06936b6f-f315-40dd-848e-dd41bb2e8cbe", "comment": "Malware payload (Formbook)", "value": "e1b88cbd16d1d9106174eeb24a17473d275febec83d44e51549dd2c9f649d074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236541, "uuid": "3415e729-4176-4d92-8497-c1d60d544692", "comment": "Malware payload (Formbook)", "value": "c9fbd2f8ee71967d61632f4f45874de1deda1138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236541, "uuid": "a22dee00-061a-4c3f-bf90-defdd44af301", "comment": "Malware payload (Formbook)", "value": "258706ccf7bb48b635ffc2e9e907fcc74b8fabb6b5317e48231e72d1a1688357612d99a942aba7a0653ced917d874bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236541, "uuid": "04d8f92d-6b41-4124-936a-f0766f4ebd2d", "value": "T15B35CF1363DD8361C7725273BA66B701BEBB782506B1F56B2FD8093DF920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236541, "uuid": "a489fd8f-dadb-4ff2-9831-ae295fb68c42", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236541, "uuid": "feb614ac-4d7a-4c4f-8ef4-2b825c78062b", "value": "24576:Qtb20pkaCqT5TBWgNQ7a9CiM9V1/5eJSblD+6A:ZVg5tQ7a9CigV1xeIx65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768236541, "uuid": "fbf8cd21-5ecf-4e99-b7fc-c48267a96c7e", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768236541, "uuid": "26659ec2-381f-4d24-b5ab-d35c16210d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236541, "uuid": "51c8c96e-bfac-49c7-b863-c61b5fc6176e", "value": "NEW ORDER ACR-012612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fe9325-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768205552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205552, "uuid": "f066168f-6a2e-4c0a-9cfd-1a4a90e69679", "comment": "Malware payload (Mirai)", "value": "629dff39a39bf344e74411ac10ac394c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205552, "uuid": "9595933d-695d-4af5-b575-cfa39e6b84b0", "comment": "Malware payload (Mirai)", "value": "e21764274eaa4eae278b3217dce05d21dd011ad9defa17bcbfb83b83e3798ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205552, "uuid": "39931775-c305-4b3c-97cf-0ad301db0cb7", "comment": "Malware payload (Mirai)", "value": "b1b1092ce8cce23d9d0dffe0cd90ababb63f22ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205552, "uuid": "49f1e48b-e29c-4980-aabd-1f75592d10d3", "comment": "Malware payload (Mirai)", "value": "183e9d967939885668eb1978cd5af22943d660c940c7dc13fc47e5c8517215ca56203b702cb24074f5f37e4ca594be37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205552, "uuid": "a0e728cf-e676-47d6-bdb8-29155e8c1138", "value": "T1D1931A86BC85C602C6E0A1B6BB0F52DD371743B8E3E6B1079D1DAB19774B85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205552, "uuid": "c0481f6d-54e4-4d56-b536-e1104666f4e7", "value": "1536:87uEYXf/Lxynyt7pkBnxXlZPvVTfZarknxwLEKGnkcXV9vT2bVR:87urXf/9yw27XD3VTfgknxwQK9WDvT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205552, "uuid": "e6cd4023-643e-4212-8d18-80c238862365", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205552, "uuid": "f5bac24e-f3dc-47ab-a24a-97c14eac1463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205552, "uuid": "0d049af3-b6ab-483b-a82b-72cf6f5c1435", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4254daf-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182578, "uuid": "ec0d7af0-f9c7-4f50-873c-002f31169012", "comment": "Malware payload (Mirai)", "value": "728e874f937a3ba427c10b2cfd0a2897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182578, "uuid": "5861c5f7-a5ec-4b7c-aded-6c914d0a1be3", "comment": "Malware payload (Mirai)", "value": "e3e93b0b3891b9f5ab0ad90a5c9a0d1c1ebfb5755f82cbed93a5a1fed9e98f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182578, "uuid": "13961285-b7ba-4cce-a0a6-e0590781712d", "comment": "Malware payload (Mirai)", "value": "3aaffc55150c8052616d63cc9ab0c39e3bd6c9ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182578, "uuid": "f6a1c609-0f7a-4117-a450-ec2e60478609", "comment": "Malware payload (Mirai)", "value": "2390495727b79c35c498fb9b4006a0737aaf3d918cbf65655d3460d639bc9a1df10220834f4baf104aa1f9e87ed28f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182578, "uuid": "0c90760c-a794-4d97-98f0-e042f70bdb39", "value": "T19293D506BB650FFBD86FCD3746A9070239CC551A22F93B3A3674C918B51B64A4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182578, "uuid": "6aea5913-8ab4-4aa2-89ba-9fc80df13cca", "value": "1536:SXVdbeEh/kc+Yw3Iw17yfQ04rAM1gYuZ7hbXsVIGRwhwaBds/xV:SFdbeEh/kV51rA4uwxeHBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182578, "uuid": "168a2c6a-b04f-43da-8f8f-38045299346f", "value": 97592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182578, "uuid": "2d3af0d5-335d-427c-908d-3474c2fdceb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182578, "uuid": "992841d6-117e-40d8-adef-878f179ebc97", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2259da-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211258, "uuid": "423a0954-3431-4f01-8fc9-385d23a4dc30", "comment": "Malware payload (Mirai)", "value": "fd608f640aeb83e2c030f28497f1e930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211258, "uuid": "61ca9fcb-60b2-4ec6-9c2f-002aa7cd9fa1", "comment": "Malware payload (Mirai)", "value": "e43f5de12b6c1b7db559645a93a6459ae2423069a29d3cbf83cfb7d566f9db0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211258, "uuid": "69ce127b-be01-4611-baae-1639dd767119", "comment": "Malware payload (Mirai)", "value": "6b81d5bc6235c2436c8ceeee796e03459bfa009e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211258, "uuid": "71e32682-87d7-4c83-ae03-cfeafe40ff0a", "comment": "Malware payload (Mirai)", "value": "839e3d1dfef6d7207ca88bc23bf2f5c1b663505cd84c441f8397bd149b5710a1e90943504a42902c6c435575f48ad280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211258, "uuid": "267f0917-b6a5-410a-8816-c6b4c3e3109d", "value": "T1E3E34B07B4D184FDC4DAC1B84B9BB53BD972F46D1238B2AB37C4AA222D4DE205F5DA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211258, "uuid": "11bde776-bade-4b21-a278-2007970965d4", "value": "3072:TsMQ5Ts9u710E1abol+P6beDK2827uhgZxBnsRF8cCG:TsMQy9u713DyuIxsRBCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211258, "uuid": "8b1dbbbf-20ed-4f68-9bc1-e34857bca5e5", "value": 147384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211258, "uuid": "8992ef59-ac62-4c41-869d-c8659bd7aba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211258, "uuid": "eda2c67a-c8cc-46c6-9c88-3fa8c680d925", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b812a6b2-ef9b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768211253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211253, "uuid": "666ca5bf-b09c-4812-82d3-668437707adf", "comment": "Malware payload (Mirai)", "value": "8bcc0620439e0ae3987e0be4bf5ddaaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211253, "uuid": "f1dd526f-50a9-4645-81fe-73ce1fe0d013", "comment": "Malware payload (Mirai)", "value": "e56c4a3a8aa517e0c8e64851f00f41ea2419957f6c9e1ddf550642e0ee85ebe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211253, "uuid": "0797a115-0889-4844-9b3b-706d5650e40f", "comment": "Malware payload (Mirai)", "value": "e25b2ad8413a0c64557e28ebb904bb30e82d41fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768211253, "uuid": "02a041d1-bb20-4a31-95f8-dc3427a8e835", "comment": "Malware payload (Mirai)", "value": "5731c739ab5288c058ce994d0730f9f820d8c8e3f64031b0c8e2f1a506c1b9ab9376191d1393384d4c919a87890b7356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211253, "uuid": "c00c8c22-703d-45df-89b4-b4cae9467b01", "value": "T15104C706ABA60FFBDC6FDD3706E9070639CCA50B22A57B353674D528F50A50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211253, "uuid": "32b7627a-3d89-4d97-86ea-65f9774da208", "value": "1536:+cpFj2Y+6Y/q77enJtsrB1KBcHneJtsGTcPe1lGSd/oBX2ty2FmSTnMaGKXKwuAh:Pj2YY+neAB6FFrGKawC0QAZlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768211253, "uuid": "1a639798-dc20-4811-84d1-05dda4d78ec4", "value": 182768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768211253, "uuid": "c551ba9f-5dd5-4daf-a9d0-7b4f2a90a31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768211253, "uuid": "5dd25164-bfe2-4080-a7d0-e3671c65faf1", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f35254a-efcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231666, "uuid": "f0bf2c15-b1a3-46af-ba17-c01ebd07ec24", "comment": "Malware payload", "value": "b41b66f017aa1aaaa96032dc0818eb99", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231666, "uuid": "194be6b8-cc9d-4b3b-a219-1bd58188fb1b", "comment": "Malware payload", "value": "e578e75d5a3dbe6699cc3dc123a2f1c8a2215f8b747872cb505522a308c95d34", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231666, "uuid": "0dacce76-ce77-4347-9508-2eb1d3e8f3fa", "comment": "Malware payload", "value": "e9a69ac99f9300415a32577a0ceb942e8164f04c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231666, "uuid": "e9bb709e-12c0-49ad-a75c-e58dda7c6108", "comment": "Malware payload", "value": "24b1226217ec0fa889f259960a058cb660db3cd6e77eed4a3786902fc193b29557b127d44825ccce9463cc63a06e0450", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231666, "uuid": "47e2ca38-085e-4a47-9373-a6bfc15aa0c9", "value": "T1346168100EE711D9F2774B315BEDB2B2896BF865E9399AB8004C46801723654D8B5F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231666, "uuid": "c8351c2c-a9f1-40fc-9a61-213c7d43027f", "value": "48:825aw1arVrLhQ6vj3rP4SJ3DZm1dJ9AaH:8255svhQG7D0RqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231666, "uuid": "73d2e437-9992-4ebf-b430-a3c4c9ca64db", "value": 3302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231666, "uuid": "ef3ecf67-030e-4190-9807-44011e049ca4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231666, "uuid": "df9be097-09c6-4676-8822-15aecbd3876f", "value": "staa.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4bf06f-ef5b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768183824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183824, "uuid": "67397a85-b2b8-41f2-9dc6-4f920ecc1e61", "comment": "Malware payload (Mirai)", "value": "1b4598b3cf92f256574cc884d7def01a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183824, "uuid": "31ab7bc1-bbc6-41cc-b361-f84ce73fef4d", "comment": "Malware payload (Mirai)", "value": "e656648d870a231a168978684937def622ddbc3a3a7168311a82add2c7bd381a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183824, "uuid": "76e8a74b-ee3f-4865-9856-7f3692712a0f", "comment": "Malware payload (Mirai)", "value": "a21410fc12316604c2ca97ef1bae1b61135a8ae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183824, "uuid": "a4c72080-e9a0-46c8-96c9-58f3ccc252dc", "comment": "Malware payload (Mirai)", "value": "6ee66afd3bee0525757f77acd93724569ce4583c6653a1e6dbf1c9f291e642e8a03ca3db0a6536d7cc98cdc9ec759cd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183824, "uuid": "6db77895-0ea0-4856-8347-c44ad87094d6", "value": "T1A8054C1AE2E370FDC197C030079F9B726939F4790211AEBB21D4A6353D46ED12B29B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183824, "uuid": "4b71dbe0-3a38-4400-b8c4-692afb538c15", "value": "12288:0sIe+kqclpQHY17nUaZq7uXpmSTj+gglQ:0sIe+kqclpN1hZouXtTjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768183824, "uuid": "0ebc686c-88d0-433e-98ce-57e53f7c16c2", "value": 811072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768183824, "uuid": "9d405188-4a9d-4276-a734-aaaefa88dffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183824, "uuid": "e89aaef7-fea5-473f-8fe8-505c9b3d2307", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c4d054-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217608, "uuid": "5c0faeb4-e265-4301-9cdb-5e868909d6b9", "comment": "Malware payload (Mirai)", "value": "e365e637d28f607791ddd1d8248ba47b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217608, "uuid": "da4a5c68-6b0a-41e8-82e3-0b9e38ae6c24", "comment": "Malware payload (Mirai)", "value": "e66f95299248524c7f19ba4b20e25878641e187eca62809ccc5ba6f59084bdad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217608, "uuid": "0d8a2c8e-d4d8-4ba3-bacd-c72beab497bb", "comment": "Malware payload (Mirai)", "value": "0b8a9e25c62dcc5b948b13d7da8931fdad144edf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217608, "uuid": "6a126e10-b46c-494c-81b5-09f8a7a84f2a", "comment": "Malware payload (Mirai)", "value": "f491dd5488612b99aa8e02970e2633d1dbbef5c6364fa7a6a184b6d050c98d5185adcc9738da9fba06c02a770f7b71a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217608, "uuid": "e516acac-877f-490a-a47f-7ee18ab00220", "value": "T120931946BC918E11C9D422BAFA1E118E331263B8E2DFB267DD205F2437CA92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217608, "uuid": "ca4b1e90-e80b-4cfd-81eb-abc3c32b8430", "value": "1536:xwn0FOi1ieIoOSI420fF15p521lZwOEdvYT+HWLjf8dcwIsi8ytx41omm:ZF8oOe28/vwllHqHWLjqytx41o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217608, "uuid": "03c76e13-46cf-4051-8432-b2cf082de1f1", "value": 95596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217608, "uuid": "dbfbc814-3502-4f09-a235-f091fec6e78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217608, "uuid": "78398bc6-059e-41cb-b735-8b6117e3eb4d", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98d565a-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206075, "uuid": "adfec233-e87a-4cd2-a4f2-658d46f5c0e3", "comment": "Malware payload (Mirai)", "value": "af29cd34a2f47ebe49d7ea29e0d25296", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206075, "uuid": "518177c2-a13b-4eff-884e-d0b00538d6ff", "comment": "Malware payload (Mirai)", "value": "e75fb726c5491034e25e9dad8655043489209e8d9b2a7b232c7824b2018e6553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206075, "uuid": "e88ab4bd-4416-4fb5-b890-68c0f6d78e81", "comment": "Malware payload (Mirai)", "value": "f4d07d506912db359211c57cf5871cb967bb4144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206075, "uuid": "3587b494-3d7c-4522-8ae1-579d6d1f4138", "comment": "Malware payload (Mirai)", "value": "7f8f28ece681edeecd8ced023bd5560614d6716163f27a6b84651537fc1e91933b90444e17939be141cbb74ebdaaa659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206075, "uuid": "ea89e95c-4f29-4ce0-a150-2e8ad35e8a64", "value": "T155634A15FD796D27C4D0727A55E38930F576439D1ABC8A4E7EA32D9CDE04320302EAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206075, "uuid": "59a28c91-a850-427c-ad90-bafa114ed80f", "value": "768:Jyo2vVIb2qBzIx26zkqDxDFx/0X/I+2rH0fwy8WO+Ut1k2zKct:Jycb2azIU6z1DxDFx/0An0fwy80ezl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206075, "uuid": "f2ef8318-68d0-49ae-a5ba-fd5fe3ce45fb", "value": 66772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206075, "uuid": "f65ce4c1-158a-4dae-9b32-ae8b19597a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206075, "uuid": "7f679609-cc70-4b84-ba62-ddd6ff9e4c58", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431c662-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223272, "uuid": "dd0bdac4-2cfa-4e3f-9a1d-41fbd9fef5ec", "comment": "Malware payload (Mirai)", "value": "2debf6be45a6d68713ed116903e75e9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223272, "uuid": "b2a48040-3ea8-47c3-9427-b6c9f2fb9fa9", "comment": "Malware payload (Mirai)", "value": "e8b91649992692b91ec4a4c27841ba4e769b7d5e104a401f3d730b860de6fb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223272, "uuid": "e0d54784-9820-41b4-b45b-153174f5082d", "comment": "Malware payload (Mirai)", "value": "7a37e91898454d6cd75da964935b6bcd699fa8b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223272, "uuid": "c92ac7c3-72aa-402d-b5bd-1839597c366f", "comment": "Malware payload (Mirai)", "value": "c4efe24d5a285957d2fd5b372b49222dabc83753d169010be0907b2fd8031edbaef467af9b38aeb2b1be654ad120dcb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223272, "uuid": "b4c28007-e1b3-4c72-8819-8f525ba154c2", "value": "T1D8337CA2DEAA9E55E60C56B078308F394B53561097872EF756A9C274C003D8DF18D3FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223272, "uuid": "9f8a7a39-42a0-42d5-b622-4d24069d14eb", "value": "1536:7qY5R2uWnbBJ2jTwRh9SIOCFTRTCAT2bVR:7J/UX2yS7MVDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223272, "uuid": "344f8c8c-1074-414b-8778-9f2c655f8d7c", "value": 54480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223272, "uuid": "4a6f69d4-8fd0-4774-8e39-757e4b3021a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223272, "uuid": "422d8947-6367-45ac-977e-3b5878167246", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033d7d9b-ef92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768207084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207084, "uuid": "b70c86a8-7f1a-4fe2-88bd-40dbfd3b8268", "comment": "Malware payload (Mirai)", "value": "90fb54959f4e48b28058819e4085b12e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207084, "uuid": "47cbc35e-f421-40f3-a7bf-bf0db49beee2", "comment": "Malware payload (Mirai)", "value": "e8bbdb2911c7308678c83e058efbb910a27d7c397d625ba88c9aa48634f0e24d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207084, "uuid": "b0b512a2-7d74-48a0-b5c0-d82f41c4c5d5", "comment": "Malware payload (Mirai)", "value": "32cd7c760dfbea1050f2efda77fd5f31d5cc828e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207084, "uuid": "e12f3953-cc1b-4302-aded-13e63665453b", "comment": "Malware payload (Mirai)", "value": "b9ed12c6b6bc4870b474041db88c0e1bf79d018b44eb9c06168171cb5c65a61442488b78104726784c893df248f4e3d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207084, "uuid": "537df6d6-e151-4027-9402-872d10924144", "value": "T10FB3F9DABC819B11D6C565BAFE0E518D33134BB8E3FA7103CD149B2A678A86B0F37541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207084, "uuid": "665776c2-25bf-4048-ba1d-c73d0f06c2bf", "value": "3072:nwQ8jzEXYTEddbEuwb7/Q3W+erIM9M30V3fO49TAN:ngsBEu53W+erIMy30VvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207084, "uuid": "7a37e6f2-19c4-4a06-a202-ca0b198bc606", "value": 108100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207084, "uuid": "d63a928c-b6c4-4b4e-a327-888a62cf96e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207084, "uuid": "7d0676e0-db76-44d5-9a4b-01c3874e636d", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1961f9-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216734, "uuid": "adb385dc-db15-4085-91df-c833a8fcf8e4", "comment": "Malware payload (Mirai)", "value": "20bed8a584b3d0150374c49fc0cd6d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216734, "uuid": "9ac3cda7-192a-4e5a-b11e-f141be219c32", "comment": "Malware payload (Mirai)", "value": "e92795e5c1b34a77a7233a5d184e29fb7149c120a05c3d105c998e2be63a2b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216734, "uuid": "95ab52f1-d6de-4bf9-97db-1345a6f28e3b", "comment": "Malware payload (Mirai)", "value": "c587e86a3a92cf842a065810622b5d68a1129817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216734, "uuid": "696884ad-52fe-4fe4-af0a-da2a587fa82e", "comment": "Malware payload (Mirai)", "value": "8d0818e9203b795b70a27b35ef888e746b496e278736399fc3233e62c7d28f7531e9e2022ed284c72604f30c792adfb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216734, "uuid": "d83754df-32df-44cc-b6e5-de6e0bd1adfc", "value": "T16D13E2CDD088FA5BC82DADF9485F0771958DA047338FDD4E331A8C94AF46F5A63980A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216734, "uuid": "927660a2-14fc-4f0f-959f-e40d1278bd1f", "value": "768:5x4mYFaluq7c2hrjYJO5AhCA7ks2Q4kUx85c99AOi1nd0CVP8WL4EfwTa8TWHt:5xhYYuqYZJOFE2ac99Pk5J4Ekaht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216734, "uuid": "3b9698a9-acf7-43b5-8aad-e361b99bb131", "value": 44604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216734, "uuid": "d26ece0c-bf89-4030-b1bb-6316505d542f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216734, "uuid": "6ef1458c-5685-48de-8e61-6aaf40cff0e1", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0711fe-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217511, "uuid": "f2960e45-c69a-4bf8-9fc2-f2b6cd9317b8", "comment": "Malware payload (Mirai)", "value": "71bc09c8815355a991885b6387fb248b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217511, "uuid": "b93e717b-7a75-4800-920b-19516d08e9db", "comment": "Malware payload (Mirai)", "value": "ea808c67db03a35b910088c81b2442cececf0f8e049c30d26e467dbde17d70e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217511, "uuid": "f29e92f3-bb1c-4c62-a27b-0a213e8cd4fd", "comment": "Malware payload (Mirai)", "value": "e201ab1bd3fc606fbe97e505261063ff462f0113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217511, "uuid": "81736f6e-2e17-4234-ad93-4c55ce571a10", "comment": "Malware payload (Mirai)", "value": "e42efcadc086bdfb018c4cd365ebe7ee9bb6c37fd70963cef1bf10577214cee9fa5a370a98808f296cbd67370176d885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217511, "uuid": "2ad06cdb-9265-4e18-a6f2-f3a726e663fc", "value": "T16BB3F9C9BC819B11D5D566BAFE0F518D33134B78E3FA7103DE149B2A278AC6B0A3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217511, "uuid": "afeb2d4e-34c5-4046-8377-f8abf3318745", "value": "3072:djqs99DWZ6XE3Uf9xqIstqxVSyz6n6z1MAeBvEVX8+wtT2G:oZjCxqIstly6n6z1MvBvEVM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217511, "uuid": "1b489010-5cb3-4488-9a2c-7df09500e42e", "value": 116920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217511, "uuid": "85c8c4c5-b2ac-4c14-aae9-d58aa0c92624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217511, "uuid": "84059bcb-24e2-4d7c-8929-9112eec4e1b5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716c4aef-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214571, "uuid": "b84e6d60-1b98-4569-8e96-857d13042d2c", "comment": "Malware payload (Mirai)", "value": "ee0f019ea193f0986f10babfc5f3e807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214571, "uuid": "be58d51e-b2ca-4c09-a6f7-5e4699ff16a7", "comment": "Malware payload (Mirai)", "value": "eac54b2fa0d4fe5468d384c97eefe368b10853afe981d2251c40fa9db6f4c9bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214571, "uuid": "6083c5ac-bff8-45ef-b2d2-01ffffdeb356", "comment": "Malware payload (Mirai)", "value": "81f1d2fed2d8539a133aafc2a0c7750b78fa7bee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214571, "uuid": "e7f30031-46af-4cd3-acfa-3b9c0da199e2", "comment": "Malware payload (Mirai)", "value": "2fef0281060b2cbf844f54478077439e06405daa47878acb39d034b6fc6a241f42e516a3a1c3cf2127cdb20e3371e9e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214571, "uuid": "ba876a38-8ca4-4e54-b5e4-96501b093d8b", "value": "T16C537D77C11E4C80C75846747416CFBA7753B74958A23FFE6A488A19840BEC8F58ABF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214571, "uuid": "b8f7d6c7-8337-49a8-8c88-49aa75117c1c", "value": "1536:V8y4LdWCksoQ9bhKtGcTuTIMpMbW84AECkqL:kdQXsbhEW1pmW84AEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214571, "uuid": "0a41d128-efc6-4f61-9382-29f6164bbba0", "value": 64424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214571, "uuid": "18b9dffb-ac96-4f5e-ba66-7b073366bd18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214571, "uuid": "e18c5137-7084-4a9a-a156-8e147e01ae4d", "value": "shadow.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8beda55-efbd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768225857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225857, "uuid": "0605ccd9-ccbb-4b10-b0c2-12827d8f7cc2", "comment": "Malware payload (Mirai)", "value": "7dea41a5e9fbeac2c7316b20265cb034", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225857, "uuid": "8260976c-2125-4d16-9552-781df255d919", "comment": "Malware payload (Mirai)", "value": "eb0306d24388ba1c88e8ca35cdfda29e28887358f63c6bdc447596657e94dafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225857, "uuid": "fb6b837c-e7b8-4ad6-b404-16f635c4c3f5", "comment": "Malware payload (Mirai)", "value": "5b54f602b7dc536163bf67757cb4e7a88590469c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768225857, "uuid": "afec94d1-fb6e-4a06-b48c-b32d6ae73279", "comment": "Malware payload (Mirai)", "value": "528fb5942aae16ad7ff61d8fb1487c544e001cb1415cdd2965ca4759fc4cd4a6b8fbcf7566e192cf53cbd795ddd54779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225857, "uuid": "b4b533af-43fd-4c76-b286-5938786f4ac7", "value": "T1E463078ABCC5C702C5F060B6BB0F658E376643B8E3E2B157CD19AB29674F8570A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225857, "uuid": "55c33a24-e545-4c73-b9de-9fb06c465ccd", "value": "768:00l65psNeF+FMVxubW9r4s08B8J2z31x2/R35PkBnykz+DsoQ49LpQcdlQKh0nhx:gYVAj+p/m5+tuK5xjm84xSBW1IrKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768225857, "uuid": "74a53395-39cb-4d36-a00f-31090e1a42df", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768225857, "uuid": "0493c1ff-f0ac-440f-bc7e-9c33e226d9ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768225857, "uuid": "1be14d5a-f868-4e5e-812a-3100c66f807e", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6632ed-efd7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768236928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236928, "uuid": "ae9903b9-99a5-4963-be30-1523aa3ebfbc", "comment": "Malware payload (Mirai)", "value": "9790b2dcff652f85f252646b5e7980b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236928, "uuid": "6b49fcce-52fd-40f3-9f2d-ac481858fee9", "comment": "Malware payload (Mirai)", "value": "eb1495c43981f1a0e1145a68655d82e49c76d23aa52385f5c7e3a08ff25c0bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236928, "uuid": "521a7eb5-a323-489e-bd9d-4a0d1b777cc8", "comment": "Malware payload (Mirai)", "value": "7471b1ea78170b8b5477b748ea8faf7a021d60de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768236928, "uuid": "84729ac2-8545-467e-a416-ae78741c140d", "comment": "Malware payload (Mirai)", "value": "82b91bf87ae492508527cb0c9eb06c5e3555664b36f6e734c7d1780773848a53539985ab6cb7bea826df043be3c20f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236928, "uuid": "03d656a5-ef32-46d2-ab16-5d0e37b793ee", "value": "T1A4C44B55F880DFA1C6C4257AF75E829833174B79C3EBB20699145B343A9B87B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236928, "uuid": "7d1cafb4-8781-46a0-b590-cad7b2fda2a9", "value": "12288:1k0Tg0XUrFvFj+heN9OKfk2JI36gpZ/mmg:3gJhOeN9rfk0I3dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768236928, "uuid": "6944c776-cc87-4c9c-94eb-ae402a47b229", "value": 558364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768236928, "uuid": "c58d5949-a521-451f-a17c-d097d8cf43e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768236928, "uuid": "02e48fef-3592-4e86-8016-94247069c501", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fffb47-ef5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184485, "uuid": "acee81fe-bb81-4112-85ad-3a4f21462a05", "comment": "Malware payload (Mirai)", "value": "25b3c2a04e943f430bfe362824b494f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184485, "uuid": "d466075c-58f4-4ada-9760-32ee12418f4b", "comment": "Malware payload (Mirai)", "value": "ec1459afcf77c8ee24d38a42b20393f3e2129da8e95c7fdcfa64cfa471a92f8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184485, "uuid": "07a5670c-bfda-40c3-bc77-c054aaa30ee1", "comment": "Malware payload (Mirai)", "value": "bd6efdd530fa6d535e1d5de18d436f36628e7803", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184485, "uuid": "399328c7-8460-47b6-91d3-23be1bb4283d", "comment": "Malware payload (Mirai)", "value": "b5cb15ffbdd70b651abd457f2074a8c10049a70fdc51faf8469272c3db0cb274bc4b76377903f8ee26de89aaf5439444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184485, "uuid": "6382fd0b-a673-420b-9a9c-9ae49566f012", "value": "T129630ACABC848B11D5D525B9FE0E254E33234B78E3FE7113CE185B2E678A8670A37915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184485, "uuid": "e521cd38-bccc-4540-bf62-b59078da8a9c", "value": "1536:T9nUj65hI7MdOHwpXFMs6ExdhuV8c7+P0XGsUEe8IbwM7iCwN2VzxT:n5hIhQp1Ms6ExdwXGjwN2VzxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184485, "uuid": "559e9580-3687-42c6-bf4d-cac566409bc7", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184485, "uuid": "90ca174e-20be-4fa1-94f4-bec99a45e4ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184485, "uuid": "3cb08f1c-1c15-495f-9d6c-b4e6121a9caa", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50cf1e6-efb7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768223274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223274, "uuid": "052b6576-2de9-4991-b091-0f43ff19783e", "comment": "Malware payload (Mirai)", "value": "79ad38f0fc9a9527a66ce47f7764b1de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223274, "uuid": "2d504733-9802-4b42-917d-b8becb67c690", "comment": "Malware payload (Mirai)", "value": "ec51b7acec1dabce2452847fa72f763950dabef921fa49c526a7764f250ac0e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223274, "uuid": "1fbc83db-ac86-4b9b-ad22-1c4730ac4054", "comment": "Malware payload (Mirai)", "value": "1ee3488514f16be67df8491c7771fbbb6362a712", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768223274, "uuid": "639290e4-b5e5-40e3-8219-2b7d8bb5e394", "comment": "Malware payload (Mirai)", "value": "8680e194bf59ab01a87f83d091c6183b1d5c1e6bdc934a04877f0d87b22bcd922159f6cc526fce0ddce43f31f780f252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223274, "uuid": "8e067519-b6c9-420b-9773-ac1ba30942dc", "value": "T17CA30BD6BC81CB11C6C556BAFE0E61CD33134B78E3FA7213CE185B29674A86B0A3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223274, "uuid": "66e38a44-547e-4b8e-9750-fa13eba4c854", "value": "3072:LTD+YFn6aJbEA3fmIYKfWfCT39GUneuBttaV9KT2:SaHuIYKfWaPne+tgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768223274, "uuid": "54c816a9-5c78-4cd9-bb56-2c7351f9d190", "value": 103628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768223274, "uuid": "30f37a35-1167-4ad3-9996-380c2cc7a52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768223274, "uuid": "bcd34da8-f55a-4799-9998-9d257739c66c", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e08e08-ef5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768184481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184481, "uuid": "6f7c9d92-93ec-4327-9b02-fc3fd9f59b0e", "comment": "Malware payload (Mirai)", "value": "d72e8dff727802c1a23f3f448c5a76f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184481, "uuid": "b3ada622-470a-4f89-a493-f6c251c59d40", "comment": "Malware payload (Mirai)", "value": "ec7b1fcba126021046c39010bef31193cfcecabc68db119443ab98d094809ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184481, "uuid": "11cc6fca-5174-4613-9700-b941cdc40511", "comment": "Malware payload (Mirai)", "value": "b3867d74997db7c3d0eb17061d7fb6c57d8cc3d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768184481, "uuid": "ef7754e7-c54b-4d82-87b4-f3abacfae6ef", "comment": "Malware payload (Mirai)", "value": "7208439f119f5cd31d33602440af435503bfd02b47f355667a11bb368db8e1553be94dee5c473b5a919f9ba64c593dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184481, "uuid": "17653ae6-8dcc-471b-8123-a1046724371d", "value": "T1FDD27D85B6A2497BC6BF0B7560C21C05617AC3CEFBC7CB23942851349C39976BAD9F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184481, "uuid": "ba2fa4c6-6e66-4846-ae72-3815b0875e6e", "value": "384:ldrQOacX3IGDvKgekNa8OWXEdEJCGJCAaUy4MIBoUikDIhG0sO/s/1bkdGXMP:lmOPn9vpIh7gy4M3UikDkG0ls/1bkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768184481, "uuid": "349bf9f4-cf1f-49a5-8fd0-e3862206335a", "value": 30436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768184481, "uuid": "ff645098-a647-45bc-8fb1-34b9d22a12bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768184481, "uuid": "5cca62a0-f9e5-4bdf-ba37-5f3adc398216", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9e9b94-efac-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768218344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218344, "uuid": "7097fa04-5a4f-4e6d-8d9a-5989fd4f2d78", "comment": "Malware payload (Gafgyt)", "value": "f082ff44afc3e96c6c8a6c0a00312df8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218344, "uuid": "d0412d74-2351-4ad9-8f96-78e1342b3f4e", "comment": "Malware payload (Gafgyt)", "value": "ec88d0f4046194b4e5228003ab195786112ff53f2178714d705cbbce4fca2847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218344, "uuid": "d313c750-4878-4d22-ba0f-f8e85c15e86e", "comment": "Malware payload (Gafgyt)", "value": "fc31b8c8b0f3e60c72200432f0f022f3b770d20d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218344, "uuid": "4ee8cae5-77dc-43cd-89e6-4ce7620c4a14", "comment": "Malware payload (Gafgyt)", "value": "5ad085d02f89bf307ba82dc9e0fa288897cedae0b93ee2a45514327066af6ea3a15ebcf62b95a39097829e37bbbecd93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218344, "uuid": "17afccb0-aa09-4a32-b666-029f8752e866", "value": "T15FB32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218344, "uuid": "0e778b88-7246-45bf-8624-071713ac04bb", "value": "3072:b6an17WtsWhdgYJ50D6mbPbmTQOWsXAOn:Wan17WPJ50D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218344, "uuid": "507a4f08-3479-4a2f-912f-4c15b2bda366", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218344, "uuid": "b55d661a-b8bf-4cbc-9088-074f7ee69dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218344, "uuid": "07555723-ac70-49f3-bd6b-ff81e992d218", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc38dfe-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214564, "uuid": "935ce572-1815-4c91-baf0-afd12847c265", "comment": "Malware payload (Mirai)", "value": "7b07eada163d7205b6b8eafb1ce37818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214564, "uuid": "47cc4a3a-2008-4a29-b622-4b2d378d647b", "comment": "Malware payload (Mirai)", "value": "ece8169e85724bbd18d37aa6002464d13fb3772456caa881c8e63ce6fdd5fc71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214564, "uuid": "70d44d5d-629f-4776-b4d8-79949e934b6f", "comment": "Malware payload (Mirai)", "value": "87ef6a246580fe5f28e69aa80567cc4cce5c3d3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214564, "uuid": "a9e02fc8-1b5a-43df-807f-a59ef7f47d54", "comment": "Malware payload (Mirai)", "value": "3f3f687a744cf848f6f05d0f7fd55e71c5a3c46ae376b3e0ce19aa7504631b03dc3d1e0279af9457b3976f66a62e6b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214564, "uuid": "f5c6979e-b3d9-415a-aa7e-35924018c137", "value": "T181634BC5AA03DAF0DC2D9130D0ABFF3E46BBB57E0019D98FC7958571E463B02A65629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214564, "uuid": "159a93b6-cefa-4184-b245-6414d308a946", "value": "1536:aoewCGVcccyapvSq/7gCHieXMzXtJLXDZfSR:ayVcc3apvSq/UCHieXM7tdzNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214564, "uuid": "761558e2-18d3-4b2b-8211-caf8a64e6477", "value": 67236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214564, "uuid": "3e9019a7-65d0-4f92-b596-cd8d5fbd14c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214564, "uuid": "0eaae536-fa84-493b-93cc-d15667af6c7e", "value": "shadow.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f4f0f7-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1768224586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224586, "uuid": "f6fa9e23-e11a-4ffb-a1c5-ac81dae7e9bd", "comment": "Malware payload (Vidar)", "value": "d5bf470fb1d60242547c841bf7a53f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224586, "uuid": "9e267d96-bb39-4aff-8712-8a2bdbf913ad", "comment": "Malware payload (Vidar)", "value": "ede41efbc1f4da057f99e5ecc2a5fdb0a23746893ccc92f8653868666b970497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224586, "uuid": "d817c4b9-6690-4725-aedc-5bd508430cca", "comment": "Malware payload (Vidar)", "value": "bee8c0e5f15638c8f7a9e1e0f974888282e42d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224586, "uuid": "6b444892-cce1-4f94-bf50-81ccb89f39cf", "comment": "Malware payload (Vidar)", "value": "3ef41ab972eb5c51f7cbc3aa64b0720e71255f01ffa44171b21cc6cbf52b760196ac455c34f35799ddeaaeb9b47f86b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224586, "uuid": "b5bf4f8b-a8c9-47a8-9cc3-17b098bbbf14", "value": "T135865BE2FA408675D6DBF239D8A1205A6230F448133515D7BF660BA49C6FBC4173BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224586, "uuid": "c0af66b9-b6ee-48fe-a434-43f61ffe3bd0", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224586, "uuid": "a54494bf-c71b-484e-805f-516f4fd926e9", "value": "49152:M+zvZq+wxhrb/TVvO90d7HjmAFd4A64nsfJMQJYGrtjk6riZhrD9slIzfAj2VZ9K:MpxcIphb11jep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224586, "uuid": "cc623356-7c8e-463c-9bf3-edc1d033e2fc", "value": 8339072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224586, "uuid": "c38d5b85-8691-4901-be02-df4325c09941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224586, "uuid": "f881e34b-6501-4d95-836e-91d2c1244d50", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692f6e5f-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214557, "uuid": "de061adc-b5ea-494b-af77-a761bee8d3b1", "comment": "Malware payload (Mirai)", "value": "e43cd15af3fadfb70c52ffd90817e062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214557, "uuid": "7a4016d2-a34e-4281-afcb-18fecf9378fe", "comment": "Malware payload (Mirai)", "value": "ee03a880c9b11fa00e0fee2a08994c02a8bf39d694a8af42279ce7fff33d3777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214557, "uuid": "b4cb6cac-f852-4263-b85d-4acf1c581848", "comment": "Malware payload (Mirai)", "value": "aa2a3338bd0b859f8e62d7e18d30f6d486b908a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214557, "uuid": "c41aad49-9e97-41a4-9983-4a181fa26d71", "comment": "Malware payload (Mirai)", "value": "9f012e1f7444c11ac428108cec12515b60f5406eadff0227442f6f1207b1c438078b341ec1ad17832e065fdc5b494ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214557, "uuid": "f02acd4c-d84b-40ef-a5a9-6123452f3ebd", "value": "T12EA3C6197F725FE7E86ECC3B05D81B45248D270621697B3AB938D534FA0A75B0AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214557, "uuid": "9c8c0f06-35c7-4e49-b482-6ece6bde2d34", "value": "1536:81pYFHp0i5Lg7AHfF+HPEKwCmWTP1vcEBGAkMz5EcvNnamDvwbQCXq0GBbpvpfv:89wCmiJc8QMtEc1namtBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214557, "uuid": "f8f4fe95-c5e3-4c5e-ac29-baee24cbf032", "value": 101056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214557, "uuid": "abf44706-eb0d-4b9d-9419-80cee582eda1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214557, "uuid": "eea9a5b3-5595-4ba5-a2dc-c3e2d65a076b", "value": "shadow.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e871c59-efba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768224444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224444, "uuid": "218daee2-81bf-4afe-8018-6dace51f1148", "comment": "Malware payload (Mirai)", "value": "9a5ecbd8ef9488924bae92d72d809f2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224444, "uuid": "ea030287-f920-4592-a0c0-96bf6abd8c2a", "comment": "Malware payload (Mirai)", "value": "ee1447e1d6b2eb90fbf5617d2c6e72bd857fe40292e4bcf91d2e42f595b2f570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224444, "uuid": "afd01af3-d099-461f-8295-7d53a6259941", "comment": "Malware payload (Mirai)", "value": "dcc2638078c0a1f3685f04397203d21fd442b7b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768224444, "uuid": "d4b84706-b433-4a8c-9776-189d2778083d", "comment": "Malware payload (Mirai)", "value": "44f987f709027a665c8acbaa9b07d1959eae1d188297d18f16a1914d4f77c24fd8ab4a0afdfb88a67fcf79d2a84d9869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224444, "uuid": "b2f4cf66-018c-41fe-9599-5c80e2985c8f", "value": "T1E173950A6E719FAEF66C823587B74A30974873D637E1C685D26CF9044E7034E581FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224444, "uuid": "8fee1809-d44d-4dbc-bbfc-30f1caf8846d", "value": "1536:MuaFuaSpa7I4M7eSqo/v9Y1tJmmmmpnAe27tXbkDc8pT2bVRU:B4MaSqo/v9Y1tJmmmmpnAeaXd8pT2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768224444, "uuid": "6ed6fc4b-8d19-4a53-867f-a0c7a2014628", "value": 80684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768224444, "uuid": "dfb0da10-228a-43db-afb8-1a23dfa7760a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768224444, "uuid": "e8d8a7c2-adc1-4684-909c-f4dfd90a1ea9", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a16b74-ef92-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768207088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207088, "uuid": "48f1518f-931a-4f27-bc0e-1aca29e91166", "comment": "Malware payload (Mirai)", "value": "1bc641960b673572150096a6e1f91941", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207088, "uuid": "3e25aacc-a5c5-4964-9d71-ba696c0c9a75", "comment": "Malware payload (Mirai)", "value": "ee7f1822458b74e8745c0a57a6deb92f38ba98999595a022baf3ad7aad82defb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207088, "uuid": "390df20b-68c0-4c7d-9598-7b85b7ff86c4", "comment": "Malware payload (Mirai)", "value": "9f66b79db24489b27cd2aca73592a19f978c765b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768207088, "uuid": "7f61497b-c8e5-4fa0-9b1c-59a90d2ed0aa", "comment": "Malware payload (Mirai)", "value": "e4dd4fc815428d3fb125462451c998d719f7ec9cff2fa59d875229d2632f2ee5b6fd4d23a9ff1e40d052763a085c4be4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207088, "uuid": "4ac8edf1-01c3-49c6-9da4-cca37a3bab30", "value": "T11183E84AF9819B11D5D565BAFE0F51CD33534BACE3EEB2029D249B24278B92B0F3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207088, "uuid": "ae1fabec-83d1-4b72-ad44-7331f38e4fe9", "value": "1536:e9n0kK0rCIsc5j3m/Jp2n4qOizt0GXs+FClsYiAmzVqeZhYmWIT2bVR:UK0rCIPmihOizt0GXtmmzVqe7SIT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768207088, "uuid": "f8c69b2c-cfd1-4c08-986e-5642e5fc8d41", "value": 83316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768207088, "uuid": "9b3927cb-625f-4d7a-860d-dff99ba2627c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768207088, "uuid": "c7ca4db7-4905-4d42-b69a-17d873bacfdc", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbcad58-efc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768230855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230855, "uuid": "c76d3a69-2748-431e-ac2b-a9da442101f0", "comment": "Malware payload", "value": "a048a0b8031f4e187e73fb87299ebcc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230855, "uuid": "9df076e7-91d2-4fa8-b657-0656002d6e00", "comment": "Malware payload", "value": "eefe1513f0fa80bd22096035d091da648eba5395dc8e3523b5975fd7f46f66a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230855, "uuid": "46820fe0-743f-42a3-b9f3-026caa11d164", "comment": "Malware payload", "value": "0f237f79f33b5ae448282bac3eb7f2920ebcde96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230855, "uuid": "27f5bc10-bf9b-45f0-96a7-0a4c5c52a5b3", "comment": "Malware payload", "value": "9e0fd057899cf9752285d74daa39c804aa38adb8402cd4e19752873b3e973670d770f0c2c476b3262a5aa762c4f5ef44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230855, "uuid": "6463a3d5-b9e9-413f-b0f9-f350609647da", "value": "T1A4F51943AA9B0DEACDD667B461D71336A734FC708B295E3F6608CA351D536C0AD2EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230855, "uuid": "4be71e30-7609-48e2-ba65-bcc5a3adabdc", "value": "658ea1242e4500d0d3d3a70b81bada44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230855, "uuid": "5ce3cf97-2e64-4b1d-ae95-08ba7ece3745", "value": "49152:wVpN6aNswzE7JO6Vff1obHXB7xIJZMUomRUmEvnZN9he3:emO6Vff1obHXB7xIJZMUomRUVN9he3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230855, "uuid": "2d1ddf1a-dd47-4da1-8374-7046a6aaf81a", "value": 3324455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230855, "uuid": "8e1d63a4-3075-4ed7-b430-254e4a73be0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230855, "uuid": "0a58454b-faf7-4a52-8c10-6848656f427b", "value": "WindowsUpdate20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2602c912-ef56-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768181373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181373, "uuid": "c62931f3-8560-496b-bc32-0847a413a25b", "comment": "Malware payload (Mirai)", "value": "8e6328787c23628d8091ffb9d4c8cf79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181373, "uuid": "e35bf220-46f6-42f1-b165-84432f52a54a", "comment": "Malware payload (Mirai)", "value": "ef27007b9363316d7a94eb900524e781344ab4e375288b171e446c5b297867f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181373, "uuid": "ca9ea724-11b5-4946-8cfe-2c5a9f9061be", "comment": "Malware payload (Mirai)", "value": "759a4060d2494d29457f5cd90af56e772d77adb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768181373, "uuid": "b89ba0b1-379e-4332-8031-89ba97f85e7a", "comment": "Malware payload (Mirai)", "value": "98f665e91db3e4d16403e70684cc4f80bfd0dd6addeac29263093bf2c5a179514e0286e55e8f6a6e20ace3bd49c52f50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181373, "uuid": "24ef540c-848d-4bb2-886d-8ae61acd0994", "value": "T14863178ABCC4C702C5F061B5BB0FA68E376643B8E3E2B1579D0D6B19674F8670A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181373, "uuid": "b797ac21-3c7b-45b9-92a7-0a3e1c350b87", "value": "768:/s9V3vp5ma6UuuDBZlmbiw1SJ4xrQ/aStCHb9fFyrnniivSzu1GLs9Gi9/9yPd4c:+P1Jf7ui6U9yP84HaFxC0Be3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768181373, "uuid": "3070c07a-5f5c-43bd-b0f6-8f0ade873695", "value": 66764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768181373, "uuid": "a74078c0-c947-4d2b-b288-4c777f164cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768181373, "uuid": "e58082de-1637-4fa7-bf06-58d0e34975cb", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fe10cf-ef58-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768182331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182331, "uuid": "3445be19-f581-4491-afc2-410026287aeb", "comment": "Malware payload (Mirai)", "value": "be6081d07ac36060143a73f729ee89d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182331, "uuid": "c254b4a1-4eaa-4c68-a8a8-ee397ac153d7", "comment": "Malware payload (Mirai)", "value": "ef2f93ef1a99bcf4c73cb89f6d1ce533d4e5e76488ea3d9cb58e620e5c13d92b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182331, "uuid": "de159b80-561e-4528-be40-e8555c1dedc9", "comment": "Malware payload (Mirai)", "value": "a73cf0da2ddf8b060c798476da7cab547dd62f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768182331, "uuid": "90ca3f91-5418-4c1b-97a7-ca3623a0776a", "comment": "Malware payload (Mirai)", "value": "bd267ff4ebdc68713f19ac1e586b4d0a486d8350e075a65ff0d1cb3ffb43301d5fc18d83adc0022d6618441f012e5c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182331, "uuid": "2c3afe48-90ef-4d7d-a2aa-b04cd6d999f7", "value": "T16534095DF880D77ACBC0217AFA5602CD33735F64EBEE320589356B383BD6A15993A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182331, "uuid": "bd98cbba-fb86-4925-8d35-33c6c8a96ef6", "value": "6144:3j5AMybHx+kNjFQ6N0etDmzh3A9VHWcp+B9TuwIXy40BLDW+KfS37+VJdik:lAy3A9VHiu9+LDj4Ldik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768182331, "uuid": "3e3c4d46-81e9-42a3-811d-b916cd650827", "value": 248600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768182331, "uuid": "9ed1bd6e-b224-4335-b445-065a843963a1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768182331, "uuid": "f0a66ac4-ef22-48ec-b888-072e0ad07d4a", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731b1e33-ef64-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1768187515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768187515, "uuid": "d586a510-4d84-430c-84ec-bf0f1b44eb8c", "comment": "Malware payload (Joker)", "value": "94ef0f0a04b7da589ff7d940c1845ae8", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768187515, "uuid": "8d0a3e21-a5ba-4d2a-92a0-6c669bcd351f", "comment": "Malware payload (Joker)", "value": "f0220a2322cfcd0b7721f07350f83775572bc1e0a97e90d2fdc0c696a9a88e85", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768187515, "uuid": "dcee8572-5047-43bf-b02b-fa1763dc12f5", "comment": "Malware payload (Joker)", "value": "49b5386a2de42d5542d81b449486d000a77c1083", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768187515, "uuid": "e26a201f-68fd-448c-b678-82020668d7d7", "comment": "Malware payload (Joker)", "value": "df4d084dfcc2145e19d73f95ec9e7cbbeb819754f6b33f5f31bfdf343a5d22c2b33dee233641e328f0c8233cab355d42", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768187515, "uuid": "86b37458-94b2-4d3c-b83a-2f6035b77254", "value": "T1AC271209EF0CA82FEDD6B07D8E590361B52F7015A641E797A911816CFF837C89E19BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768187515, "uuid": "798b4668-268c-4e25-a9ac-84aed11a2470", "value": "393216:oPLgXrHJSsg7/KDZWpNgXTcMThF4dAIh6JZOI3b+p:eLKHJSd7/KlLTzIRwKI3ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768187515, "uuid": "e74769d0-c8e4-40cf-93fa-7f4138ba000e", "value": 20397856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768187515, "uuid": "e6cf658c-c5cf-44d1-b1af-efd9cab9ea4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768187515, "uuid": "10034035-6d67-4fca-940a-b48abe30d683", "value": "Cleaner+Junk_1.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5032d4-ef72-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768193543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193543, "uuid": "9e792d36-01fc-4955-974c-1a7913fec21c", "comment": "Malware payload (Mirai)", "value": "e78d147056b4b5bee79be84d70d12615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193543, "uuid": "f0418f91-daa4-4348-ab0b-bd4e5d00813e", "comment": "Malware payload (Mirai)", "value": "f1a8fda33b529805f19b821128bd84a80883c50fa93a2923ae3a6b185a6526a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193543, "uuid": "96ae76f1-a9d5-4787-afca-33fd59c1dd91", "comment": "Malware payload (Mirai)", "value": "ce727029675a0028766f93797de7c7d75b9586dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768193543, "uuid": "5c6a864c-fc56-49fa-911d-3c34afb04cda", "comment": "Malware payload (Mirai)", "value": "2f96ed3744686df0dc55b10282733edef9460803afcc0dc3ae47f6256d7c6c3778fac28e9a1f804b067e5307ec2e293c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193543, "uuid": "89de4167-31a7-4e76-bf36-30372404521a", "value": "T191831955F890DA62C6E025BAFB5D528C33631B74D2DE71029D24BB3537FB95A0F3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193543, "uuid": "d81d8cb4-0a75-451c-9279-6b646425bd78", "value": "1536:3EWYislozMX5oA5aiiyi544C/42nO2NZckisWM4AFpoelv89OOH9OBIr:3ECzMX5P5aL54OoZosaANvq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768193543, "uuid": "d27cfa62-4afb-4f4d-8f89-a5ac0caeb9d5", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768193543, "uuid": "3b54eeb5-10c4-4c5e-a1cd-faf2ff566c02", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768193543, "uuid": "bacb139f-0668-44d5-ab89-d698fb2c411f", "value": "catgirl.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08379f1-efb6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768222810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222810, "uuid": "20be010b-59bd-41f7-9d33-69468e1d051a", "comment": "Malware payload (Mirai)", "value": "87f0632625b7158b0433c431f3239ee9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222810, "uuid": "2c65dbfb-abd2-4689-9992-19a8d4dc328f", "comment": "Malware payload (Mirai)", "value": "f1c82eefe50320f32196561c43ef589d1e8ea150a9515af08b52b67b9336e357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222810, "uuid": "a6bd03d8-5d85-4512-ae1b-08dc66314ffb", "comment": "Malware payload (Mirai)", "value": "f09670bdbaecd68243a97a41357c3c66542f2d74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768222810, "uuid": "6d3d9d3f-fa62-42b1-8a06-a7f7a5252cf4", "comment": "Malware payload (Mirai)", "value": "c92dce26c073c0fcea75de5504ddd8548f9c7f35bc66d2eb38f7de1bb69d34e56430ff19a724731d24deff6c608a72fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222810, "uuid": "667e9db0-b559-4b72-82b5-ae730fdb9eeb", "value": "T1C1A33A21ED396C27C5C0713B51E34530E5B6539926BC9A5F7EB31D9CEF14220322FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222810, "uuid": "fa75ce5c-496f-43e6-b612-e1ced7645ebd", "value": "1536:NQ+lMSIEuUa6efhmCKTQ/HwbJufNOzyZewOdFQtshzm7uhG:qXyDaRhSgfNOeAXrzmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768222810, "uuid": "bcb64508-e25f-4d78-b73b-5754ca51a40a", "value": 99900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768222810, "uuid": "a61e98aa-eddc-4ce3-82a2-0aab1fa21407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768222810, "uuid": "615104c2-5221-42bf-862b-db1b32aed5d1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab933c7e-ef8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768206078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206078, "uuid": "b1155283-c871-41af-9937-61721bd4866e", "comment": "Malware payload (Mirai)", "value": "de0ffa5878438b5b26c7e01c6ddb8ee7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206078, "uuid": "50aa64d5-7206-49b5-b519-4242587ddcb7", "comment": "Malware payload (Mirai)", "value": "f263c0a17552cdefe56541857ab1900b5be654196dabc66de87ff0688896a587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206078, "uuid": "fa571f5a-c2d0-45d0-b1d4-394675dcbfee", "comment": "Malware payload (Mirai)", "value": "6a85840c20857d0060a86a3d0a9fa600baf9ccc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768206078, "uuid": "40c60ab7-bbff-454f-a88c-fb11895e37cd", "comment": "Malware payload (Mirai)", "value": "3dd3cf1d418922d2aa9b9d716b4acf6ab03fefcef1c6a3e8842efa9fc184aff3826b916964cfc67054e40b8be7612ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206078, "uuid": "588d1016-b4bd-4d1f-901a-e80072d7936d", "value": "T1B8833953B400DC7FF81BE2B394571B01B62477E59E122B27B622FD6BDA3E1681C1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206078, "uuid": "465cd43f-3a87-454c-9765-664244d1ae26", "value": "1536:koJaANXfhAYJMZLZaPaYJvcYtTJBjg84+CNR9eJakP0OZJNdP446J/E8AfBWTP6:koY2XpAYJMJZ4aYJXXs59ulRNR446JC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768206078, "uuid": "8f1696ba-6170-4f16-9085-d3b50652caec", "value": 86448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768206078, "uuid": "2484c380-766b-4c97-b446-5bf1a0a88bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768206078, "uuid": "e7452a1d-ff18-42d7-8c58-703884ad5e5d", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8398e89a-ef9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768212024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212024, "uuid": "0e301eb5-e08c-4cc0-ac18-0b86213d11f5", "comment": "Malware payload", "value": "031e0ef1311a7a08f2a0a9c9c4205d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212024, "uuid": "03c8c709-2a94-4e20-a808-4a5aca587458", "comment": "Malware payload", "value": "f271df2b35ec298d61eac0a36c908f52db2f6d4e264c648a712239a799622cd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212024, "uuid": "8aec013e-69b7-4fd3-92cc-22716913b079", "comment": "Malware payload", "value": "030ad496a1a91291aca11848fdfa391aff487a3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768212024, "uuid": "b5f7873f-f61b-419d-8931-774994ba655e", "comment": "Malware payload", "value": "a42c9140b0d1c54be84786777022df9d1e76a026aaaa221e3f8d1f09d4413726f018821af5a2a2c4abf2b76b374d5474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212024, "uuid": "62d601ee-cd09-4933-8c5a-8e82d5451c73", "value": "T18D0523510C3FB355AABAAD1930C871CD737697D91BC3BC5B72B9C5A54F8248E0B1087A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212024, "uuid": "93f08280-4a6c-4130-9555-c17215c1f34c", "value": "24576:H8vQ9Krr5486Zi6gDwBQ+Fj/v7nUXbgZk0g:cvpHLxaXjLnUXyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768212024, "uuid": "04c91199-3fae-4a6c-8631-b67d71da3b5a", "value": 852436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768212024, "uuid": "e72ba4a3-14c1-487b-bdf1-426d82eba9c1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768212024, "uuid": "c55f265d-ddaa-4e2e-9ece-4342803b6e2a", "value": "client.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5de607-ef50-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179105, "uuid": "01271575-4ffe-43af-8085-96077975ce97", "comment": "Malware payload (Mirai)", "value": "684942a08da81bea3a7a0cbf1d5075e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179105, "uuid": "830c0c81-b489-44ea-a633-5cae3e712d92", "comment": "Malware payload (Mirai)", "value": "f33de3de0f6d04d2ae1bb5a819f18a3cd32cbe2924635c96ca9243ed504f7955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179105, "uuid": "5fb5e746-b3c9-4a72-8c5d-42f0c017e08a", "comment": "Malware payload (Mirai)", "value": "de9d7fc1c046847a70170bd9ffa5f1c470242d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179105, "uuid": "2b73af6b-eeb0-4912-969d-8ca52fb1fab1", "comment": "Malware payload (Mirai)", "value": "5d9404fb70aca92cb87fe07d7a9d5f82529abe9f3e47a5709ad104503d117b484ca5da74acded1aa81afe87e620527f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179105, "uuid": "b5311d48-b61e-4e86-8fdb-b6e6530dd6db", "value": "T1B7433AC18143E8F5E8192574753AF337B5B2C9B842B8FEF3F72896B24016A647146B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179105, "uuid": "e959aee1-2d24-4d87-8250-4f5f67ae8060", "value": "1536:zPqM2ySHPpkYAHL7vD+EPXh2HAwG7L3U2QRQuVpB/RNe7i:zSNySHPa//yKXUAwG7A2mbj/Tki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179105, "uuid": "69483f1b-976a-4a8f-afe9-2e43ae66a850", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179105, "uuid": "480d7612-ea98-413c-9c07-933908e88291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179105, "uuid": "d2b067e0-385f-426a-8fe5-1ce84fa52edc", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50d30cc-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204779, "uuid": "664b9381-9d5e-4fbe-8811-b7f8a1167720", "comment": "Malware payload (Mirai)", "value": "dae44f856c17c4fed843343aff8d8142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204779, "uuid": "ff15989e-b89c-400f-9dd5-f3afe84a39ca", "comment": "Malware payload (Mirai)", "value": "f351aa62524274f073be404b1ce1a273262f4a817fec5cb1de9502f1e3a59701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204779, "uuid": "e1026fda-07a2-47cf-a5d2-5a2c867ee2f0", "comment": "Malware payload (Mirai)", "value": "c98abaf38607371d7d4c95aa835a416974ee1b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204779, "uuid": "65233417-da7a-4951-b06c-38bfb81e6f8b", "comment": "Malware payload (Mirai)", "value": "48bbbfefb599c204a18322dd1759006e48a82c5e3aeab3ac1f4c3fef4ca5a8ba1bd143f508e834a450bed5726e2571d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204779, "uuid": "74b27f1f-29db-4841-b243-59a56a850df1", "value": "T16E835AC18687E8F1E80905792176F377A2B2E97541A8FEE3FB54863264119E1B18E34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204779, "uuid": "9db32db2-410b-42d9-899c-a43670068052", "value": "1536:aY5IqYs+tzkYITuNfUZ+3fjA22p1J8cf97jvT+rXZs+hMsAsozEdu1itbX/rSXRR:agpYs+toHCZvjip1J8aVL+rJ/hMsAs6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204779, "uuid": "7475024b-e7ba-45d2-b3f4-8958d295d1a0", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204779, "uuid": "c4e7c170-5e38-4906-8616-49896042f386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204779, "uuid": "3f6ae2e4-02ac-48e9-bbac-a53ce521a875", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b0a4d1-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179392, "uuid": "0df9616a-7100-4e7a-9000-80c1ec892a28", "comment": "Malware payload (Mirai)", "value": "7cc15b1c2faefd22c8142be4bdfe7cfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179392, "uuid": "24a2bb89-60a2-41c0-95a0-75aab22bf5d5", "comment": "Malware payload (Mirai)", "value": "f4bf8747277b370338eab23de51f884b58d0a8f58c89d7e4c955847a0cd0f582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179392, "uuid": "e21490ee-d406-42d7-9d51-acf8a3be7650", "comment": "Malware payload (Mirai)", "value": "190697c999ed86a5ca1aec4e44e1847c83fe0165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179392, "uuid": "434bfd37-dc19-4f0b-8fb7-587fa049e78f", "comment": "Malware payload (Mirai)", "value": "a839a73bbb133d8e227bcc5d209d1a0da42a07bba6717285809e28bfb2ce27298f6966a1ef05e8303d244ae710518bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179392, "uuid": "b39769c2-8d04-4661-b1c7-20637d35cd04", "value": "T1FC146C07FA82C1F2E19306B25097CB5A5734C9311316CD07FB899E79BC7560A8A1B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179392, "uuid": "42b44470-8667-4e45-8bbe-70f7f31d0d6d", "value": "3072:KIz/wVP5qzZjy+V84f9chytjo3cH3XdtvaaF4tYPhE0R+LTEeTMBGLRijz2Sdj:Vz/wVP5kO+ezWjo3cTD5hE0de/ceSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179392, "uuid": "93547bce-c650-4561-afce-90b6f3d5bbb3", "value": 206000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179392, "uuid": "f553a4c0-02c7-4ae5-8d8b-67dc9258ed4c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179392, "uuid": "4e851d9f-2c24-4787-a6e3-77effec3a5f0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536659e4-efaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768217527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217527, "uuid": "e148dca2-8696-4f74-b42f-20819ecede2c", "comment": "Malware payload (Mirai)", "value": "5ffd537638ad73bfb487e7743b97735a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217527, "uuid": "df944661-f79e-456c-b867-c44cf31f7578", "comment": "Malware payload (Mirai)", "value": "f50738b140aedf4b8a7d3f9609ced1723b3206f853fe2a9d23511781480e2825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217527, "uuid": "6684c770-6bb7-4e58-b60f-c47fa184d66b", "comment": "Malware payload (Mirai)", "value": "c7cc3d7fb4b4f667b4f33b66ede4777fe2b3c067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768217527, "uuid": "06bca925-ec27-4320-9077-95774a50857c", "comment": "Malware payload (Mirai)", "value": "23a82578ab7144fa7a402b31a4644ff3995fcb9ca4a770b4bada4332b49b93fce3ceffbc07d7edc3e3dcaa72b415e10e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217527, "uuid": "8824933e-5f60-4892-bf12-4970ae4d6f1b", "value": "T17703D04EA5AD35C9CDFE1CBC40A45717ECE121D5F209DB445F414CC0E36AB9BA68C1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217527, "uuid": "7d9031c0-66b5-472c-8ad8-bf47df813b96", "value": "768:bZ4IdsZFL7km31N4+NplLvFiJoGaootyW8TROH/FcQwdKNWMg:5uZhkm31NJRcawdTYdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768217527, "uuid": "1fb35103-2e94-440a-855b-edd7eee81838", "value": 37784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768217527, "uuid": "5e80e3f0-7b99-477d-b202-a7f2f40637fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768217527, "uuid": "2179d369-34e1-4fdc-803d-6ff8837d3c7f", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3854e6-efc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1768230349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230349, "uuid": "d525bd6c-c97e-4d67-9960-1d2a8605cda2", "comment": "Malware payload (Adware.Neoreklami)", "value": "ad8b42e67adae6ae7eb923c37f6e218b", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230349, "uuid": "edeedbfd-52a4-4581-a9ca-78ff4f42450b", "comment": "Malware payload (Adware.Neoreklami)", "value": "f5fc71e8e1958a42cc1093b9f85279f935b5d77164d6658227fa6dd4b95bec35", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230349, "uuid": "fced7573-0252-4d5c-9aa3-082cd3dbb09b", "comment": "Malware payload (Adware.Neoreklami)", "value": "f45c79b39173b03ff7dcd1e5c531f19d43028fae", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230349, "uuid": "a8ac6ff3-0cec-451e-93a2-4789ccaa0579", "comment": "Malware payload (Adware.Neoreklami)", "value": "04e36957ec0295fb16356a3d4c600eb5f8b72e8caf978a253c2458b5dae971f39b34740a41ed903060238d4e5913758a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230349, "uuid": "151eb71a-fcef-4865-9cea-25a3af45509e", "value": "T18576331036DB82FAD36582358DB0DF84C6BDCF1D0824AAD7775C5F86182E59DC21AB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230349, "uuid": "05c33df7-904e-4318-99b2-fab9fa95985e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230349, "uuid": "46a53ffd-8f6c-46b2-9e5f-cfdfeb4fef7d", "value": "196608:P1OV4kgSA0LUu2fcsDym2KLbPNnnB80zCRIgOw/NSPomvqh:tOV43Ir2EsDym2ynBZzOmwgwoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230349, "uuid": "c2d21a0a-f61d-4e3b-bd6c-89233e0013a5", "value": 7567250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230349, "uuid": "16c11aa5-7b5a-438f-9496-f11349f3582b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230349, "uuid": "64dd3d24-c1a7-451a-84ee-4dbd013cd441", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9960e3c3-efc6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229670, "uuid": "346f90ef-a553-490f-a81d-233ed7963ab7", "comment": "Malware payload (Mirai)", "value": "47b2f190d90e2bf54334fd7842f4a2ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229670, "uuid": "84782539-96fd-4a3a-af98-afdb213833f0", "comment": "Malware payload (Mirai)", "value": "f6112c1992d46adacd960355d3b5c2322cbd5849fd89fc1099f19fbe9a7dfb8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229670, "uuid": "35b2e80b-a1ef-4bc5-a503-81ee2f99520f", "comment": "Malware payload (Mirai)", "value": "b282dbf1e3f46ea9798c021d86a428f8b82a64b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229670, "uuid": "fefb9c48-0657-4040-8e30-2c778b4e877a", "comment": "Malware payload (Mirai)", "value": "0d73cbabcecc2156905ced1895fed1c3cbc217196a80faf8498d5b5c09b606943eaacb6fd5e476aa1b6e75c5a44ff117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229670, "uuid": "60a0ab89-ce8a-4e60-a80a-820f4d8b1f9f", "value": "T1A3B3F9C9BC819B11D5D566BAFE0E518D33134B78E3FA7103DE149B2A278AC6B0B3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229670, "uuid": "79caa967-8196-4b27-a563-c480bea935b5", "value": "3072:djqs99DWZ6XE3Uf9xqIstqxEJyz6n6z1MAeBvEVX8+wtT2G:oZjCxqIsthy6n6z1MvBvEVM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229670, "uuid": "6fa1d8b0-2eb0-445e-ac2e-7a98950d1cff", "value": 116920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229670, "uuid": "fe41cd9e-4a7f-49ea-8ed6-4f7b1e22da21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229670, "uuid": "983835fb-9db0-4006-a480-b417b2bd2b10", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc816cb-efac-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1768218346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218346, "uuid": "83fb702c-48f1-4659-91d9-dc73b35408b6", "comment": "Malware payload (Gafgyt)", "value": "c49e655e2ca59eb2112ff4e2856e5f4d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218346, "uuid": "37b9fced-2503-4d47-8444-24d579d7a91d", "comment": "Malware payload (Gafgyt)", "value": "f6148d1226a2a3818ee51b0f3e7d868ffdd704f5ae3a27ba8dffd3e7da99246b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218346, "uuid": "e7d40cb7-df32-4ace-86c1-ca9cc8469ca4", "comment": "Malware payload (Gafgyt)", "value": "1ad018873cda0a4831350dc189471df44183ad59", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768218346, "uuid": "5c1d234b-56a5-4e49-bf31-43ed68438386", "comment": "Malware payload (Gafgyt)", "value": "0317d872f67e0534be19d299cfc466fff7b8ff6049f9581e2d708f5333dee72b1d87874c75d597770b5c5ca1bfc72172", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218346, "uuid": "11a11e04-b6ee-471b-9a9b-17743b7d01bf", "value": "T16A414AC7E29509F06CA0E85333F55480B4D0A6CEA5CA9F0F7ADEFBD8488DDC86655682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218346, "uuid": "ffa3bc59-0394-4dcb-a53b-ed5796e0a0ce", "value": "12:Gn0FJ75eO0FJ20w8S+0FJsUR0FJUob0FJnZqy0FJ2w0FJnZk80FJs2f0FJhH0FJQ:1VAL00dS7SDOoolS8hl2GRLcLsGRlyld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768218346, "uuid": "2ffc0b58-d87e-4bbb-a41c-481e098ce670", "value": 2140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768218346, "uuid": "eb8f32b9-b6ca-4017-b117-c1b231dc0cf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768218346, "uuid": "c6fd588f-b983-439f-9e94-0dee13c4aef9", "value": "SnOoPy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6015815e-efa3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768214541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214541, "uuid": "b513c6cd-b082-4d1b-9d0d-fa881adc0479", "comment": "Malware payload (Mirai)", "value": "6ae8ea9f4252f0ceac2a18f7bc752c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214541, "uuid": "724960b2-d910-40e1-b07b-2671898ce724", "comment": "Malware payload (Mirai)", "value": "f64d2dbacbbf706204864a98a57860d54571450299053598232c9dc8c340c9f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214541, "uuid": "debd629a-8a6f-4111-b534-d2faee624e01", "comment": "Malware payload (Mirai)", "value": "58138102f877b1c992e48bbcf3908098c0eb510d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768214541, "uuid": "45fa389b-882d-4bd4-b29d-638fa084a8b2", "comment": "Malware payload (Mirai)", "value": "c0e6de147050ef9a024bd452e56dc1c56cc2d53ae75b21be66bdf7ddc5a8bbad3a959d36fd737e50dbd9a7a3a17b09ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214541, "uuid": "96213394-9a27-4ae6-8b60-54686174b083", "value": "T153732A5B749440FDC458C2380B7EB03ED575B8BE52BDB2FA27D4FB066982E205D6C429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214541, "uuid": "43286896-97e5-4edf-8187-1605d8105559", "value": "1536:zeBh1Ud8l2uNEN/Yx29RptlGqiE0+xE4yZ/cgM/ujdhcFve2XYqUGTyDTC2jbjyb:q1Ud8DENA29ntlGqiE0+xE4yZ/cgM/uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768214541, "uuid": "3e7b1b17-d27b-46d3-bfa1-a44e0c7babaf", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768214541, "uuid": "8e4fa086-e4b2-4ac0-9c2a-e4fddb38bd9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768214541, "uuid": "a2be5963-78a2-48de-ac5b-edb5d3a3cc1d", "value": "shadow.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf151b2f-efa8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768216848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216848, "uuid": "9ab8e016-39b5-4ef0-b33b-0c1ac174c5b8", "comment": "Malware payload (Mirai)", "value": "f8db0e361233e693ffcf1139390cec71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216848, "uuid": "ca75a818-00b2-49c2-ad59-5ea950b19b7b", "comment": "Malware payload (Mirai)", "value": "f67525ee75a3a8f8309e3b221666567e9577c4cdb494106fb0d7e25082d4fa7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216848, "uuid": "e23f4a2e-2f47-43d6-940e-da20dc03746f", "comment": "Malware payload (Mirai)", "value": "9e436f7e18170f019b8dc4a3a5f0d0cce74ef88c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768216848, "uuid": "4ac4dab0-12c8-4ffc-a175-730f6e971fcf", "comment": "Malware payload (Mirai)", "value": "ff76928fb01cb9d0f8fdffa67d723892ab7a43b04abb2203eb51e2e8f8696d929beecaa895f39e9c0a026822b94c1e35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216848, "uuid": "67e81da4-79b6-44ab-9d27-5ca6a154d682", "value": "T1C5A32946F8814A21C5D512BEFA1E318E331357BCE2DE73129E18AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216848, "uuid": "b4c5a904-9ac7-4815-88ed-1e741a2acee0", "value": "1536:gAnTSlOe7kf5J7ZLBpqppMGBgfQxGc3k72aRrtOXrDxRiMpux/V8v7Ph5GYWW6:SlJbppMaMak72aREpux/VULhULW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768216848, "uuid": "50d1a4ea-c932-4243-b77d-b125594f8b3d", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768216848, "uuid": "f833849c-067a-4ac3-8d45-c248fa36c73d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768216848, "uuid": "3e983529-f530-4c9f-85d0-979422b38267", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdf98c5-ef51-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768179371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179371, "uuid": "cb0f73ac-422e-4f26-8b0c-2812466a76fa", "comment": "Malware payload (Mirai)", "value": "a5916971505895aee9f4e1f2b0368a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179371, "uuid": "f642763d-4fd7-4903-af15-02539c1ad897", "comment": "Malware payload (Mirai)", "value": "f7dd0e356b1dc0835a89d852d0c251ae829a616cec96235aa2a5fbd2787666f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179371, "uuid": "1c49586f-efcd-4bb9-bcfd-dbf9715c26d3", "comment": "Malware payload (Mirai)", "value": "1646d298221b75870690f408c985c51f86b03fcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768179371, "uuid": "e1f5c2b9-856b-4ac8-a12c-1212c6cc8378", "comment": "Malware payload (Mirai)", "value": "cdb7c5582e851bb12a795ca47f742a9174ac7b3bd9a1a330c16d38301d7102a10d75aa9e6238cc1cb2156f5f1198fa76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179371, "uuid": "2154e900-a921-4d77-b357-78d38b595a64", "value": "T111431865B8009C3EE82BE6B3D0031A49B1217BE589127F37B626FD93CE7D1B42C56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179371, "uuid": "0b248ecb-45af-40c5-a8b1-3948cd4a4434", "value": "1536:eEprA+qfvnoJAObZglg42zMRmHYTlkJYWkHzO5XzcqwBlL8Zze:eElJqnnoJAoZAg4Tbh+Qjue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768179371, "uuid": "fab47cc6-5d5e-464e-ae0e-3a42507fa85e", "value": 60528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768179371, "uuid": "22e18954-5fc8-4baa-a825-af4286de04f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768179371, "uuid": "6ac74429-6dbe-45f6-a45b-cd26ad8ac57f", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d01485-efcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231669, "uuid": "903bc7c3-5bba-43be-86ee-010be287e8ce", "comment": "Malware payload", "value": "3e362b43c0f671ec4a3c952cc63ef3f6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231669, "uuid": "43c2c84f-1cea-4c30-b415-eb74304c4f87", "comment": "Malware payload", "value": "f80ca2888173faba3688e8b52553cb6eb67014d63752582f32a2fdaede558a87", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231669, "uuid": "0a1a121d-211d-4d2f-af30-6927a8c6ec86", "comment": "Malware payload", "value": "01ba993954b463a6169ffee4b121abf8e476f8ca", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231669, "uuid": "20560455-6d49-47bf-b429-20a76deac634", "comment": "Malware payload", "value": "84c81b638d739c0245438ff390c90fd6cd8ed59247b94353dd1959c46e04e9c0aa3d5b7800a41f6f8969fbc422d0c29e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231669, "uuid": "05cac484-016a-4ba6-8bd9-3c087ad05fbf", "value": "T1885188100EE60268F3778B315BFAB3628977F865DA395ABC018C86801733610E4A5F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231669, "uuid": "91c210f5-576d-4488-bc8e-62d9f13d2d12", "value": "24:8lw/BHYVKVWt+/CWjI3lqbDUBsrVbPLpbIx94Czqdd79dsrabhmY:825a+I31arVrLpC9ZzqdJ9AaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231669, "uuid": "f2151f91-10b9-4f53-940f-2324e74ef76d", "value": 2880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231669, "uuid": "bd27778c-67fb-4246-9da1-5488e5b721c0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231669, "uuid": "3d8e0851-328a-4190-87da-cad01313cbd9", "value": "ooktest.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91b05b6-ef83-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768200974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200974, "uuid": "1c0d205a-b854-40e9-b879-d4abf43ba653", "comment": "Malware payload", "value": "338bb5b6850f9fe8cab7efe3eeb52be3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200974, "uuid": "082c1167-970c-405b-9998-c9308ef931a6", "comment": "Malware payload", "value": "f81d01e7361d276658306125e375453244f28d9ecca6c855e48e6fab88826267", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200974, "uuid": "066fa803-3864-41cc-aa5b-0c77c78c6cb1", "comment": "Malware payload", "value": "c8531883abca63036455964072c56b316b28021f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768200974, "uuid": "bab34cf3-34ab-4174-9cde-ff4b1e801da2", "comment": "Malware payload", "value": "4edce24644367cc802191990834a86afb14afde07cdedd90f244861b98dc74c5fd6c41499057f5d0b6327be3cba5265f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200974, "uuid": "e2943d5d-d947-4dd3-87ca-57c4c63a21ca", "value": "T1BEB5E001BB989F1EC8B791320D4A5336645AEC23CB43C387D8752B5D28AF6F44F156EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200974, "uuid": "beb1f455-50b5-4bb4-9a48-7a852eb8364f", "value": "49152:WTqaSlNFZ/k1U90aGnYZaTCchnNLAf5T9sp8eNeHu:WmlNFZI1aGnTTCctNm5T9QjN4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768200974, "uuid": "c7185f1c-59c5-4c28-a89c-ef24e48d4b88", "value": 2404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768200974, "uuid": "5fb353e3-ad1f-445c-a621-d9369090411b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768200974, "uuid": "31333ec4-21b6-45ab-abee-c7e16e3c937a", "value": "foto.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1d88b2-efd3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768235285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235285, "uuid": "f253a16c-9c0e-4d87-9c98-196c7123eb42", "comment": "Malware payload (Mirai)", "value": "52809e8c1a690c09af60e232648ea692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235285, "uuid": "69f7f211-4172-4ca4-bda6-0a8433b75745", "comment": "Malware payload (Mirai)", "value": "f8947dfc8bb7e7f32fee16ade1a9c2d1503d092c2961660774cbfc3e7d7a847d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235285, "uuid": "6783bb94-b20f-4925-908c-3aaaee717581", "comment": "Malware payload (Mirai)", "value": "5b550ca349cf65c3efdd32f141d45ff84bfc4f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768235285, "uuid": "d969cf0c-3e92-4a1e-a59a-a66bda76f85f", "comment": "Malware payload (Mirai)", "value": "882a2a3c20a0e4f02cd14cc38d8ffbb86ae02788859c93470eb42d3133be60d5414add1defd228daf9dafaa637187f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235285, "uuid": "a0c3d8d8-8ab5-4d6a-ae21-26f47fb14c46", "value": "T1D824B71E6A128F7DF268873147F74E20976D23D616E1D680E6ACC6105E7038E681FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235285, "uuid": "5ca8b61c-c3ae-4252-ace4-eab247c5bd09", "value": "3072:fJ/Hc53daglcZW8wdcs/N8XJxjUSa6hh16en9:fJ/Hc53HilsN8brcen9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768235285, "uuid": "9215fe7f-0ee0-4e20-8fd7-906520a1352d", "value": 212988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768235285, "uuid": "d0305f89-061a-476c-bcb4-702d16e6b343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768235285, "uuid": "1915bd6b-ab7b-4e60-842f-3ddf1b71bf9b", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249e143c-efdf-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1768240211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768240211, "uuid": "a8d9fba2-83ef-4b07-b39a-ce316d4c1217", "comment": "Malware payload (AsyncRAT)", "value": "d32a6f064743ec440d4d6327459ad1ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768240211, "uuid": "14e149d2-c24d-4eae-9ce0-2fdbbd2b9407", "comment": "Malware payload (AsyncRAT)", "value": "fa089b61dc8f33a89d00ff3611671b961018a66d8569dd1d12eb56eeeccd4bca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768240211, "uuid": "972927e8-7e76-49fa-a0ef-be6b30dae2a6", "comment": "Malware payload (AsyncRAT)", "value": "f77bb75ff90eb62b3585a10da30f7d135c59513d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768240211, "uuid": "21b94fb2-c215-4336-9e7a-5fa1a8494eae", "comment": "Malware payload (AsyncRAT)", "value": "b918df2bdd244d7f61dd7a3828cc5b5fd39ff875457a85717e258111c574ff8d5566756bfe4a726bb5e69c8a1b9d2ebc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768240211, "uuid": "6acf950e-05f8-4618-bb01-73e173918e3e", "value": "T1BF535B00279CC926E2AD4AB8ACF2454146B5D9732102DB5E7CC404DF9BAEFCA49527FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768240211, "uuid": "7483c346-411b-4c18-af3f-b8c469208674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768240211, "uuid": "2f870ecb-d612-4111-a819-b53cca82fdf2", "value": "768:YD7ZBqrViP3qHi29JNLcXveeObMbNCl1+6SCv7mqb2nIpwH1oKfBbBcUSOQ8G7Wc:YerGIbeeiMl8GbbXwlbBbnGbuVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768240211, "uuid": "a9902345-9464-433b-bfef-9057a46c476b", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768240211, "uuid": "c18b7571-8ef1-455c-924b-461a829c84a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768240211, "uuid": "c14816ad-4cf3-4faa-ad5d-9b000556a9ac", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb4971a-ef8e-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1768205622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205622, "uuid": "7aeaed8c-c18a-4428-a5ae-c29372272560", "comment": "Malware payload (GuLoader)", "value": "bfce28f25954ddd39a295e3fd3c3f235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205622, "uuid": "76999b02-c40d-4664-b229-0a27de600691", "comment": "Malware payload (GuLoader)", "value": "fa191e9b3dacae45a036c5e3891cef5bea41bafbc3edf621747bc52a5cee8f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205622, "uuid": "9fc3669a-6fa5-4d92-bb89-e14fb69a9470", "comment": "Malware payload (GuLoader)", "value": "7f46e8032233f62db6305fdcca724d822148c4e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768205622, "uuid": "f7c1aa29-b77b-4648-8746-f362d2bf091f", "comment": "Malware payload (GuLoader)", "value": "e8648ba24b70170f5d495cf056d1dba4c9f65e170a0edbe323e9416fa34191316fbb1af747952ded1d0088593b2c65f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205622, "uuid": "b680fb5d-b0da-44da-976d-0543f639ddf3", "value": "T1C7F423167A94C8B3E5BD47329F7F59B29E77CB8086242F5B13808BCE7CA1A54307E905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205622, "uuid": "b6277e59-e664-42dc-b527-0ae753fa0068", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205622, "uuid": "5104904b-0743-4f24-8bd2-df268a50453b", "value": "12288:jFcyz8jtPgbkLX2pEcBFIikrgXGKXMZcJ1US2GDCO3xJVQYEzHi8LjlHuP:jF4ZPg4X2qcdpGK8ZcXGOhJV2zHzL90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768205622, "uuid": "b9ce3854-0f66-447d-9cd3-280b252b12f6", "value": 730008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768205622, "uuid": "4fc0ada0-ff0e-4245-afc1-f5a707315a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768205622, "uuid": "bfe03023-b51e-4a17-b3a1-144707a09ba3", "value": "img20260107_10522882_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296beb4d-ef8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204571, "uuid": "7fbfc89d-8655-480b-8a05-92e312cb59ab", "comment": "Malware payload (Mirai)", "value": "1b5474f4b01377248805b8e41e66dd43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204571, "uuid": "6d430be1-0de5-477b-b233-173b8bb06edd", "comment": "Malware payload (Mirai)", "value": "fa90a83c003d17dbb685bb7fea7ab8e64eac4446704cacdf7d223daf7c0de976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204571, "uuid": "c4200126-35a1-4abe-b983-360201a3ef7f", "comment": "Malware payload (Mirai)", "value": "dac5c5b23bc787865d7e278e8b1e4ec4b675c652", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204571, "uuid": "7a266410-df20-4404-ae5e-4a42af00d2c6", "comment": "Malware payload (Mirai)", "value": "04b27500dc032b179828368bf5af7ab80bdd2c3ffb71576a47e8b6b2000785cf790dc12043214586ba88f7dba97b6fc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204571, "uuid": "8773ebec-632c-4b97-86c3-e458e124ffd9", "value": "T1BD92E13812B13523C3FC1777651B6CFB6B6DF0919C6C82B95C03A89980AB5E5FD9C644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204571, "uuid": "80c8b1e5-edde-4a2d-9d98-7b975a99c83b", "value": "384:Q6W0+Uzhu+iVeRHT7KaGutOD/qPg9hIex9aqBxujYJHzJiUh5Y4ha7Cp7pW195o1:jW0lzz6art8+g9qexrxuj0JdQ4g7C09S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204571, "uuid": "bdf368e5-ac26-406d-8784-2423ece47807", "value": 19352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204571, "uuid": "5ef92c43-2f2c-4d53-a47f-aa770d86d6c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204571, "uuid": "0511a874-017e-43ce-8311-357001f2b970", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6e7840-efb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768220951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220951, "uuid": "6eee1ed6-39f5-46e1-b7c6-004fc0ff7c06", "comment": "Malware payload (Mirai)", "value": "c665f57d15c9747a4cda9256550fd43c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220951, "uuid": "bb5798c1-c956-4dd9-b82a-9aa80fdae7ec", "comment": "Malware payload (Mirai)", "value": "faa35c4125347e72a4804a5060866eb7775faabfcd02a50c815245bc3d96df5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220951, "uuid": "3e25c825-0f1e-4a94-81f8-49906d154726", "comment": "Malware payload (Mirai)", "value": "ab4cad7dc661385df319436ec404c4d1ee613847", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768220951, "uuid": "a6a813db-aa34-4cd4-8ce7-71521a4a656f", "comment": "Malware payload (Mirai)", "value": "1c55344da71b8f64a3159d452dc2199a025dbdbbdac6132d2afb2fcdb4d8996e3260fc4d0debb8280d05b3531876d790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220951, "uuid": "1555191c-6299-4558-8a1e-f38eebcef2d4", "value": "T11CA3198ABCC5C612C6E0A1B6FB0F51CE371643B8D3E6B147CD19AB29674B8570E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220951, "uuid": "e65614d8-f469-40b8-888a-0a5872523ca3", "value": "3072:4GLceSkvsd/OgyE9ctUQ+e18BOs9VsT2:zL/vsdGHEGtl8BOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768220951, "uuid": "4e75823c-33e4-4283-8c1d-cf13b90a7e19", "value": 100448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768220951, "uuid": "721692af-daa1-4b12-9cd1-e5c19db7b84f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768220951, "uuid": "ec09ebc7-2bcc-4cda-b0ae-92ccc8bcb83f", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517c4cbf-ef5a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768183164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183164, "uuid": "86b80b5f-f508-4304-be7c-02b05ccd2dac", "comment": "Malware payload (Mirai)", "value": "2819dc6c92d0203151f175d2be98b6e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183164, "uuid": "1f1f70d6-388f-4886-b76d-5f937c0ebfa7", "comment": "Malware payload (Mirai)", "value": "fb42c678f8a1a478be8b8fb0cfa7f1cef26dabada704fe321aa7f8ebc51882e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183164, "uuid": "8033d746-b511-484b-bfba-7c02e67f27a9", "comment": "Malware payload (Mirai)", "value": "c03d54626fee3c4906ea2d63a5f3c264959741f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768183164, "uuid": "45fd2166-a7eb-403a-8888-e244619a5ec8", "comment": "Malware payload (Mirai)", "value": "e4dfe2aee4612084ec8feacafe663e279965580b5df32acd0d9ad22ac3090f1d4cb1bf8e355a8ed00001f5addfc77c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183164, "uuid": "1a37c622-12b6-4075-ba5d-e7cf9d31b1d5", "value": "T1AE83E889BC849F10D5D525BAFE0E218D33238B78E3FA7113CE185B2E678AC5B0A77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183164, "uuid": "fce3059e-f9e4-4ef3-a273-3398e26d7c21", "value": "1536:+6nYx+Puk4HBCLAbNljJjEaj7uV8c7+P08msLZRF4xIhlM+C2/2lSPibKCMIHTMQ:G+Pu9kEbNJJjEajC8mKH4xIhlM+bmKCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768183164, "uuid": "d650765a-d7a2-487e-a40a-73183e665d57", "value": 83820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768183164, "uuid": "babc57d7-756f-405a-aa88-c6065d9fd2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768183164, "uuid": "977e9d52-7c10-4f38-8a88-8e61aed4853c", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0522e63-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768230245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230245, "uuid": "a3ea8505-76f6-47e4-a85f-dead02667d17", "comment": "Malware payload (Mirai)", "value": "81d2174c036fcabe048891f31b2a01d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230245, "uuid": "fc982a22-4930-4e7e-b35d-3aaa1fb7ad72", "comment": "Malware payload (Mirai)", "value": "fc820385402d22996044f55478ca2bfc6f7b56e221cd326161857f9970229a0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230245, "uuid": "6e720f32-eeaa-4837-ad34-57df527ae08b", "comment": "Malware payload (Mirai)", "value": "dea053a53adb5cd32d756c4b7b0fbcc50baf5a3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768230245, "uuid": "3555970a-984d-4b3b-8fab-124ee662843e", "comment": "Malware payload (Mirai)", "value": "e4755e34acb1898e769b3064c98468776a8142c75636344797efe927ff795daa69cfc3c3ac459147ffb2320e4d949523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230245, "uuid": "822b68b8-d7d8-439e-8682-1ce028596680", "value": "T16FA31288C2F376C3D15875F4C1579FA74A308D36D0B21E8DCCC7A90846AAD5D2953AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230245, "uuid": "8c61a5a8-36cc-4b6c-ad35-5e909f2c177a", "value": "1536:ttJF+eAIxuPoiowpRsWAUX7Veo+NxtRVAb4OG0smKlnhaEgz+tdhbtO6du9H:ttq+UJoXnU5yxt34GMoaEgkdhbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768230245, "uuid": "f69e7d4d-68b0-469b-b401-85c4b390b2f9", "value": 105448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768230245, "uuid": "3070ec0c-f1b4-487a-bb3f-22097c249b6d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768230245, "uuid": "76a15ac9-ec16-4a1f-9d0c-d1681ad89ae4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37037456-efcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1768231652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231652, "uuid": "5eec9927-4753-43c7-835b-2bf29e0be41a", "comment": "Malware payload", "value": "69558218c36a8634446ad158e52208f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231652, "uuid": "44ba6acc-4cb1-4bfc-8b9a-533e236a3c44", "comment": "Malware payload", "value": "fc99b9ba0d92abf2e3776b68ceeef409c7ce9235bec4d1d267a71d265471742c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231652, "uuid": "ee06aea8-7767-42ac-b585-591a537a8d85", "comment": "Malware payload", "value": "6163f96717da2ad767a697083d1cb0c203791350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768231652, "uuid": "5bcc8f7d-49dc-4ea0-a001-5873af6a093a", "comment": "Malware payload", "value": "f069cad5892c51ce0380a19c6fd6a13459b3638e03ba077435d9025bd417eaf7a182b029bec10fecced42071c8b1f733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231652, "uuid": "eccd97a2-4140-4708-a9a6-25086adad39e", "value": "T196E24AB4E695D1F1FA4541F0066A27FBF43AE7324764A4D3C7729CB08812BFA427948C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231652, "uuid": "203b7db8-8132-4154-a0a5-4dd5a315aa9c", "value": "768:cdm0jKJM6UnEK7oT6C7elyRyZfooQreF/XRFJIKKTksk:oi0T66fUydlX/yK0ksk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768231652, "uuid": "6081f6d8-8090-4785-b082-2129e66f6275", "value": 31552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768231652, "uuid": "3c9ec61a-5e08-4bc1-a7bd-88208e32649d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768231652, "uuid": "d320ef99-1723-49d6-b62c-0b39b6650309", "value": "photo.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1021b4-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768229975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229975, "uuid": "03ee7226-69c7-4311-9db6-c3eb54184291", "comment": "Malware payload (Mirai)", "value": "9c6fae6a8bbad8e91c4d1fbcb7bdc76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229975, "uuid": "61db2808-0962-461a-9822-34095c8942e6", "comment": "Malware payload (Mirai)", "value": "fda350a0a447f3677fd5f9f8329f4a77f91c8ed11955aba71c36b27c643eb297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229975, "uuid": "31f9e8eb-8b24-47c7-8f28-1684c7b5f042", "comment": "Malware payload (Mirai)", "value": "505b5f074eaee98891deea334dbf1d162fc19cb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229975, "uuid": "97405e1f-bc66-4820-ada6-c79bfb49de8b", "comment": "Malware payload (Mirai)", "value": "f249757b295cfea454b708ebb35f9cc56ee2528a7ebc89936c3905a8f123a9a679710e29f9bcd4c7de948c0cea2250c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229975, "uuid": "956112db-802f-4885-a067-bec75dd48956", "value": "T1F7644B23FF0C6432C8A29E712D7B2BE6A338D9E161B5A10554196F2D2F327B0598777C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229975, "uuid": "cd6ea0b9-b1fb-4176-9274-b0643e439de9", "value": "6144:N9sQQP7+SuqlcT5/h0iR3FbjdHJXwHF01oX1np8tty:N9PS1eDhV41np8tty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229975, "uuid": "0bea2998-ea1a-4ce9-87aa-27eece2832c4", "value": 312760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229975, "uuid": "c7315ebe-9518-4816-9c2b-617d2687cce7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229975, "uuid": "5ae8786e-3d14-47c7-8658-faeebf22a124", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4100142-ef8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768204052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204052, "uuid": "279ed9f7-c072-4a34-8cfd-f3f25aeeea57", "comment": "Malware payload (Mirai)", "value": "e85dfb5bee6ce7da3c0cb4fab4f91d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204052, "uuid": "a91b878e-daf9-4f10-8ae6-201fab47a3c0", "comment": "Malware payload (Mirai)", "value": "fe40bd490c351bc88cae8db71e8c53f4fc674989af035e2f5b56443c6870d603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204052, "uuid": "929f72bf-8e1f-4cda-b2f8-62f22fead2d6", "comment": "Malware payload (Mirai)", "value": "8e8a0307e0c2e80f4cb5db950abe078a23a622d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768204052, "uuid": "c855f96d-3bf3-49c7-b7e1-4b83ea040d6b", "comment": "Malware payload (Mirai)", "value": "a2cbe8f2b5f14728b91dc0ef3b9d08b3dd53e527d99786b47e0846cf0ce43b846eded039a254b0eecad61546124237ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204052, "uuid": "39947c82-7bf7-4a47-b280-0c98aa69d39c", "value": "T1ACA34A12ED396D27C5C4313B51E34531E0B653AA16BCCA5A7EB31D5CEF18320312FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204052, "uuid": "90f3f392-ff36-40b6-93e8-2e9e6b0914ea", "value": "1536:wZIRzQuPzcYrsnsFGh/CBALQ1rHri/P0+T+flrzyZewP7O4+XZzm7uh8:QIWOClh8OP0+T+flreJC3zmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768204052, "uuid": "3b3cc66a-97d2-4cf3-b7e1-b128021ed7b0", "value": 99548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768204052, "uuid": "78ba1c1f-946f-47ed-9b65-7b0213bf3b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768204052, "uuid": "6ec7ea9b-c70d-4b5d-93c8-17f2375bef9f", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eaac0a9-efc7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1768229920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229920, "uuid": "cb205bfd-2491-469c-afa4-d9be65f3b6bf", "comment": "Malware payload (SalatStealer)", "value": "8d59f1e1a0723fb942cdd4597a52359a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229920, "uuid": "70fb381d-93b0-4497-9499-1da36bcb7deb", "comment": "Malware payload (SalatStealer)", "value": "fe6a4ddfac61b6a0477e2916d3b9f575105293a7d2d55e9dee18aed9ef6d268d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229920, "uuid": "35eae6ca-4725-46dd-8aa0-977f290c999c", "comment": "Malware payload (SalatStealer)", "value": "9b89ca4a53c9b79673c29b7c5b9f5b4f0a3acc16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768229920, "uuid": "36bae959-3eb7-41df-9593-0190695a2897", "comment": "Malware payload (SalatStealer)", "value": "62bf3dfd62b5f2272ea9c4631df6b66265373b649aa39e10b1f631884726b2ec27abbf45e5a6148adf01a73704c729c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229920, "uuid": "08c8debe-c008-4ea1-9927-110b97cb7c5f", "value": "T1DFB65B51FA8B94F5E9032831416BB23F23345D008B28DBE7EB547E6BF87BA911D36605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229920, "uuid": "d5fbff38-b06d-461e-830a-8f477d01f6b4", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229920, "uuid": "8689b042-5eb5-4842-9f19-15ac407d4a28", "value": "98304:omobR/dMh0pzvX6AL2KBQekMCls+/mFBDhX6VV8UAlhhGSn/8aWQK:o/M2dCg2+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768229920, "uuid": "4757d8c1-a7f3-441d-8cf1-fe2b7ccef387", "value": 11399680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768229920, "uuid": "ea4c2da1-83ac-4a11-90db-f9de940f971b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768229920, "uuid": "fb07eada-5d68-4931-90df-494b352b7c4d", "value": "0ae38e165ce11b7e6805f8f26850b307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c7dde-f001-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1768255047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255047, "uuid": "b6c9fe2b-d46a-477f-a1fe-1add848568b7", "comment": "Malware payload (Mirai)", "value": "cd522452f09335b6112c75880415facf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255047, "uuid": "397a4f43-4201-4157-b194-4d9ace489cda", "comment": "Malware payload (Mirai)", "value": "ffe7793c6ba162999cb894973c722f9d3281f2b8ab42eaec3b01d43a6dddf356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255047, "uuid": "037004cb-9fd2-4d66-87f1-644c25f72365", "comment": "Malware payload (Mirai)", "value": "de16730d9d9a191fa5788ff0fc93217b4d24b400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1768255047, "uuid": "6486bddd-469a-489f-9f6a-2e4ef490c15c", "comment": "Malware payload (Mirai)", "value": "8cfa26844d56292a7c382ae316aba66453771d9c4dd1ea513a31bd48dac552ed81a2ab1f8286b5b0363b5e42c90da5cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255047, "uuid": "4110a7b5-5902-4049-a2b3-493c6a16698d", "value": "T16053F846FD819F02D4D522BAFBAE014933537B78E3FE7101D9216F50638A99B0E77A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255047, "uuid": "e0c3aea3-581c-47bb-b2aa-72fd54da5200", "value": "1536:hZnahtwshwaEQ5DMEE+e06mOmHdlwkiL3Xt4HLH:SIKwaNDMEE+e06m0h3XGHLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1768255047, "uuid": "d86050ad-cd14-47e0-a96f-4bd17e06761f", "value": 63120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1768255047, "uuid": "bd78dd7a-279d-4b93-8d94-eb8de6d5d166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1768255047, "uuid": "3bdba22e-dee9-4e2d-b637-95907e9cba42", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }