{ "Event": { "published": true, "date": "2026-05-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-13", "timestamp": 1778716982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e3c88e12-0203-4ab5-9dc3-c1156392cd5c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab0bc28-4ee5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778688374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778688374, "uuid": "22fcbed3-d839-43af-8b65-f349d685074f", "comment": "Malware payload", "value": "6ae8e47ac2616eb92e04dc5b90d84761", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778688374, "uuid": "ff033f37-8aa4-4585-83d1-346718b52e59", "comment": "Malware payload", "value": "0108820e0b2208332046b40eae3dd53946b274867662c55351682d0e8390b308", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778688374, "uuid": "1c229916-065b-4dbc-bdb2-40c982007c3e", "comment": "Malware payload", "value": "17479e73331a15d92db4df82c39eb0db173d2104", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778688374, "uuid": "09a87c2e-c08d-4262-956d-214407696060", "comment": "Malware payload", "value": "6d450c63c499e4e6102883fd9f3e18f925109d2f7fd9262e26d66364b9fc42d39ce9bbd149c386aac7f85f8adc30222d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778688374, "uuid": "65e3f741-1299-447f-8c79-e5dc7165f5d9", "value": "T184F07DDBF53AE232FA49452CA30B21523587AC1F8C549D1C25C1F4447A1DE1CB007E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778688374, "uuid": "c2ead784-855f-40c5-b350-bbf1b2e1608a", "value": "12:VOtEB3YC3z7yg7TFqfNaD7N27zN5A0a/NSm1pyJYIlFmgIsu75MQlea:VOtEB3j3nv5QNaPNeNe0a/NS2pSYIlob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778688374, "uuid": "7eb33c56-8d43-479f-8a9e-fe428c49dda7", "value": 631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778688374, "uuid": "dd6f3eb6-bf38-4701-ba68-34c019afbb8a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778688374, "uuid": "a1c0c1d9-bc81-4b5f-9e08-87429b15ab50", "value": "0108820e0b2208332046b40eae3dd53946b274867662c55351682d0e8390b308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa28fd40-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778638686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638686, "uuid": "acac6d7f-6e39-4e10-88b8-bfca8b0f5bba", "comment": "Malware payload", "value": "2e793d675f43982b073ca9151b0c6ffa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638686, "uuid": "bb9570dd-88cc-410e-ae6e-9ab2c76f9533", "comment": "Malware payload", "value": "0183d580c03f0d4b9698f43596fc1494cc2ddd794ff7c6377aec00a6cb65535f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638686, "uuid": "56685012-3dac-4def-9fe9-acee2c224d59", "comment": "Malware payload", "value": "7c46db058fce4cc755fd101956a51b95d13bdbaa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638686, "uuid": "2d0ece4f-d279-4f22-80ba-6b4bf77944e5", "comment": "Malware payload", "value": "0acea216428e4453eb75846acdaeb9b93ca4d533cd4f50dda710c63a95ea0a3f5c467cf6f443756ec65e4d04f4563b1e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638686, "uuid": "eef1af44-cfc2-458d-b4a9-a870cb95bb95", "value": "T11EE51701FEC680F6D5425E3100BFB72F9B34690A8B354AABDEA07D5DF876B51683264C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638686, "uuid": "3af706e9-6729-4e17-9849-02d21c67cb77", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638686, "uuid": "6409b94d-1279-4d38-b135-540619731f17", "value": "49152:98lZH+qdxYJZ2LOgwT+L9GVuf0CA/torfEKLbQHV+:+l+qTYj2NwaU/8ErHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638686, "uuid": "f2a3529a-ec7b-4405-a608-5dcdbb131539", "value": 3109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638686, "uuid": "142642b5-c4fa-4707-af23-8a69cf11a88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638686, "uuid": "26830a27-f41f-4b0e-b096-0b8196dc6470", "value": "DlQdq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c06bdb8-4e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778639628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639628, "uuid": "4eac5dc6-6872-4a99-a1b9-c7b05bc10a94", "comment": "Malware payload", "value": "29365db976b8a769f023ed42896dd864", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639628, "uuid": "b29c5782-e2be-4c51-a180-940f7a27be80", "comment": "Malware payload", "value": "02b7ad4d2d5b1cb84d30125e5b17023e9e4388cd154f1db84751737970800b79", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639628, "uuid": "4b6a81b5-07aa-492e-91e9-4e5bf3ab0277", "comment": "Malware payload", "value": "a59a72b70bf2d0a2a6daf4ff7ad54a90978fdd4e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639628, "uuid": "249479ef-9c26-4d00-8adc-7b2e3a9210cb", "comment": "Malware payload", "value": "82f64662e5d8bf9bfb1925026cadb5d787388c35c88243f8adcc76c74dff0bb4bc7bd5425c5fa41133e7501258153d4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639628, "uuid": "43f08c0d-1eea-490c-a568-fa18c35183ca", "value": "T19A3690D87AC457F0A929ABDC9287B4CD0744717D6FBB680C02E458BC3D1AE1766E0CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639628, "uuid": "65746df6-53b9-41d9-a649-a5258b223937", "value": "24576:erpP8gGo3PgxRHjkN9Euz6B0KYGmo+SYxg0mFTwzpsSQ3zq6Z/pxDZASqZ+ZeeYy:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778639628, "uuid": "8e619ddc-3c64-44c5-a336-c5a9304ad481", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778639628, "uuid": "7511a907-aa0f-4b36-b44c-20b55768630b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639628, "uuid": "b059bbd7-892a-4b10-85db-710b8386345e", "value": "62156906-0062-4804-b4dd-c59dfc5449fd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5e211a-4ef5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778694978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694978, "uuid": "4ce5a18e-590e-4825-ad7a-1fee5ef5864f", "comment": "Malware payload", "value": "a939e14ce379de8489d9aebf2761727e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694978, "uuid": "6e09f965-faa0-4058-9c08-2d65178c94ac", "comment": "Malware payload", "value": "0326930673e913315b6432d4e1412418b4d2d4209454a1a76b35e0960e6c35a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694978, "uuid": "099e8ec4-46e1-4178-a4bb-0be7b5b59951", "comment": "Malware payload", "value": "09eaa78c8e215abb739892ea1f6e9dc8583cdc40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694978, "uuid": "ab871fa9-5d41-495b-a52d-a9fe18d9fbde", "comment": "Malware payload", "value": "3960104f25e0a70fe7a916aade928bae6fbe30a87b0d7a51e2f070dbf18379826a08ac69f18fcef2af83adcb47977d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694978, "uuid": "30587d97-3ef2-4d85-a0e3-7e3bf0150413", "value": "T15A83E652FE81CC52C5D838BAF95F42DC3387036CC3EE75029E169B3566DF59A4A3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694978, "uuid": "ccc35f26-39d8-416a-89c5-abc0aafb6bb1", "value": "1536:BHhrNjiDOjpTg5kvEr4C67krvo7iWB/2lZheP7:LIeTfvEo4r700Z+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778694978, "uuid": "58ab3996-a7b3-4ca3-bacf-f30695bce659", "value": 81420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778694978, "uuid": "4b8acdec-e945-4f64-bab2-bfa3ee7a2e8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694978, "uuid": "2d0c66ff-f101-4cd7-b285-f77f61ea4a66", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e71153-4ecb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778677179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677179, "uuid": "9cfcf5d0-dfae-4f81-8409-76062269cc62", "comment": "Malware payload (Mirai)", "value": "01068a90bb63b7ecdb9c182f5dd241d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677179, "uuid": "3f7ce600-fe58-479e-acf9-42291eb72d90", "comment": "Malware payload (Mirai)", "value": "041993417ec3f066c694280a4a31d2edfb072c0f59fd74c5e3211cd1128a4873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677179, "uuid": "b1f9f774-327d-4e90-9b47-cf444e2ac157", "comment": "Malware payload (Mirai)", "value": "d0c4c4a4b8598d2e1a63d3e564afdd34682b2592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677179, "uuid": "5f158820-d752-4dc6-8a6c-c7fc29a713bd", "comment": "Malware payload (Mirai)", "value": "8d584a609d72e708979881f57f71a34ea74600013bc7d733c9525192a1759766850db3cee6f289c2aaf31b1e1715931d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677179, "uuid": "3dee42e2-09a2-4f8a-9152-195dc1997cde", "value": "T10944C60F6E228F7DF3A9C77457B38E25975923D626E1D680D1ACC5005F6038E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677179, "uuid": "d1c956bf-3c0c-4c72-8c39-abbae46dfd61", "value": "3072:yC4f4y061YP9EJUlXXHhvGD/LdRzhNI34lS/oc6Ni774WkTmLXbj:yCM4y061IIUpxMj3gIBc374LWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778677179, "uuid": "48041cb7-1879-4a1d-8a82-966d34ba46cd", "value": 263136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778677179, "uuid": "48df8879-d62c-482b-87b4-46330559e46a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677179, "uuid": "18d5acaf-040b-41ef-8a53-1400cfef3db0", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d9a824-4f0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705604, "uuid": "e2f957a9-cc4c-4bc4-a7ab-6396d75cb16b", "comment": "Malware payload", "value": "65d77a33f57ca2fae69c3add65416313", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705604, "uuid": "2af17c54-bff0-4a2d-9b2d-1a03bcfede80", "comment": "Malware payload", "value": "04d2cbdc23ea67dd1f7942fcd5659823db6180e3f3864e7134c177f2b2378666", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705604, "uuid": "bb8d0775-e2e4-41b0-9ed8-7385fde5e170", "comment": "Malware payload", "value": "c88298b3850f562518ecfb91226b947dafdae0bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705604, "uuid": "8e5a7555-da0f-4fcb-bc24-8a6ab42db08a", "comment": "Malware payload", "value": "ec642c5d34adc486717dff75cefb18b7ab10cc7207f6dd64776d6d3bada4ca110d8a939a9e0262512e634df9941c6434", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705604, "uuid": "44d28598-fa6d-47c1-a67f-05e0b87dedb4", "value": "T19441D6CC1099B443E0AAEEC7BA64C94795069AD16DDFBA79EF902833D4DA4407037729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705604, "uuid": "1f566342-55ca-4071-99b5-3091a2ece958", "value": "48:Z7ft/Qct+ztp/tBPtyjt161EWVtHrtQqfWDtNrHztQiQztH6Eta1NtpAz:t+c+//O4VBfWD/HzKzwEONwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705604, "uuid": "2929304e-d435-41ee-b1a2-9d93bbee4576", "value": 1877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705604, "uuid": "f5d49167-c1bb-4df8-b92e-246a3b53b2e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705604, "uuid": "3ab735de-d556-4ddb-87b8-757d6996eaf6", "value": "load.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f94897-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778668562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668562, "uuid": "006322fa-df81-4bb9-af0b-0aa2d5fa6834", "comment": "Malware payload (Prometei)", "value": "0ff2644ab91faa0226b69074f8f0a332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668562, "uuid": "feb301fe-a4b5-4879-a726-1a5422ac6c1a", "comment": "Malware payload (Prometei)", "value": "05413abbb6f19bbb2e39cff51402d7aec665d4aa4fe4a8fc57ebad86b349e26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668562, "uuid": "ac852495-b68a-4f31-b936-c57558f9dd46", "comment": "Malware payload (Prometei)", "value": "520cee73ba593cdcdc28ae817fa12065f2626b08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668562, "uuid": "40d86360-63bb-41d4-8e2b-1e8e5bdc2605", "comment": "Malware payload (Prometei)", "value": "85e6b466137dc52333361f3089d32795d0a70c9ce7029963adcb45b75dc973eec7c310ea45224111b55e97fde4eaf96d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668562, "uuid": "ed7462bf-e66b-428a-9e9e-145d3c632f68", "value": "T10B9423FA5B8DF3FB09127F7027A0980181A47470F99E775986CBFE9A0FA52679CC4118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668562, "uuid": "9d8e46f0-ba88-4f0a-81e4-5175c5a94076", "value": "12288:4a6aYYIX2dWVxeJAaLYxAOfUhjXb44UfhlBeLg:V+2WejYxUxsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668562, "uuid": "67367cfb-0cc5-418f-84b3-261a53ff2a46", "value": 428382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668562, "uuid": "c72aaa00-a5ba-45c3-936b-d0ed900023b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668562, "uuid": "c4c4dd87-2656-460a-9bef-c2244cbea1ad", "value": "05413abbb6f19bbb2e39cff51402d7aec665d4aa4fe4a8fc57ebad86b349e26a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56aa6ce-4edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778684553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684553, "uuid": "cec04efe-cb91-4738-aec5-944f9c636e20", "comment": "Malware payload", "value": "1da8283e436fa123a81a42c560c197ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684553, "uuid": "8495a158-8870-48d3-ac44-cf18ac8ca951", "comment": "Malware payload", "value": "0720242fa3cc69692a38563238e6438f57fb771f47a12e2b9c29823013a3d808", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684553, "uuid": "fda47903-1562-431d-b027-f1a900dbebb8", "comment": "Malware payload", "value": "c16709651ccac5a17d3269636b2c982ab9728cf9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684553, "uuid": "eddb3322-dc93-47f7-98cb-ba2639b18420", "comment": "Malware payload", "value": "ae395e515f4b18960c7842574cb1fe3b6569e3ce86ee7fa551aa845133230209903193e9ef5d225a71b70d1e6700bad9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684553, "uuid": "63340776-b59d-4c38-84d5-b2bfde5d3aa8", "value": "T195322BA9360C04600F8984FB1CFF531634BA6799564AD9CCA439C3885F29F4FC4A7E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684553, "uuid": "f1957ac1-a6e4-4c47-b935-8475164a7bb9", "value": "192:nYn8Hltjqozv/ZHyz7qEPCCdaIpP3rxkkXYroi/UVcBpa+qHyB+5yH+ycR32:nFhqoD/ZHyXPJNdkkXYrH/UByB+5yH+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778684553, "uuid": "1dcafc38-d8e8-4590-bd73-594c4c2bc4cb", "value": 11020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778684553, "uuid": "7100218c-97b9-4d81-ac22-55c9bae60bf8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684553, "uuid": "0349691a-ab22-43da-9b7b-a502f60b474f", "value": "login.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0fcfa1-4eed-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778691710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691710, "uuid": "c0e14359-7e8e-4603-8178-b46d9395185d", "comment": "Malware payload (QuasarRAT)", "value": "7cff155303a2b7f1f6500e1c2cb34b19", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691710, "uuid": "1bb911e5-64a3-42e1-bb52-cfa63787c060", "comment": "Malware payload (QuasarRAT)", "value": "078cb93f2f55e14d90efd11536f642c9ed7cd1030369d1045418953c1d430604", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691710, "uuid": "59e61826-505d-4889-9eae-6b6f3af135ec", "comment": "Malware payload (QuasarRAT)", "value": "44f4b16e2704d3537f3f7dd6bb6269f43608b660", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691710, "uuid": "e5a1b9f4-bd54-4337-bbcb-b076792e2edb", "comment": "Malware payload (QuasarRAT)", "value": "c2a0e801c5530ab59775e0151c5ff6d1380495fe72cf6862cb57dd829fe9807c27d033cde60b19e5726b443f182c3829", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691710, "uuid": "a2a50d12-7318-4d5a-ade1-d8998fbc87bb", "value": "T1F0E55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691710, "uuid": "7fa08bd0-b0de-4493-9a4d-cb1f492bb5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691710, "uuid": "103e7753-423f-4094-b65e-05fc3317bb8a", "value": "49152:bvXe821/aQWl8P0lSk3aKA3Z+nghxNESEwk/iALoGdSTHHB72eh2NT:bvO821/aQWl8P0lSk3DA3Z+nCxHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778691710, "uuid": "55f5c6dd-2624-4c79-ad4c-a2aadf6a30bd", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778691710, "uuid": "15e63037-ef5b-402c-b805-1444a3f5bc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691710, "uuid": "23f94aca-6ecb-4bb6-b2a7-3736884023de", "value": "1doiliemkhiet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b91732-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1778698219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698219, "uuid": "21bf912c-344c-440f-8e29-4be3f650fa03", "comment": "Malware payload (DDoSAgent)", "value": "d6cb943f0c5cec3c320a2e65eca3a627", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698219, "uuid": "02908104-9f2e-49e0-b261-ba931f37e0d7", "comment": "Malware payload (DDoSAgent)", "value": "07e01bc4a373b397dddaf837d78625dd21ceaba633eb9aa326800ff02efb4660", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698219, "uuid": "446ba4af-766f-44e9-a551-f152d56ee5ba", "comment": "Malware payload (DDoSAgent)", "value": "0d32f37a00bf7d98ff3ab39cb719967348376f10", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698219, "uuid": "8b1cdbe8-3021-4089-a5da-b3f9ca66e401", "comment": "Malware payload (DDoSAgent)", "value": "9b63a5db307ff969e9961d6256654405a3ec266cc1c2eebe41d5a98a9e6c15cf519e134bf49d018c5f876f0b8eb8833c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698219, "uuid": "5432bfd2-c568-4bb4-860e-f53b73481d69", "value": "T103864B137A28E70FC62821300CB2CA94276A1C9682D7915BB745F309F9F61BD5DAECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698219, "uuid": "4cd25d25-bc9a-40a0-8004-4a11e50b8333", "value": "49152:PNu7vyafxvoTeM3bZN8lMCtlb5KoOVvtUzAbGHHR/9rgHo2+LELlvzmrljwia5pl:6tQ4IcjwiQ0TJVCBknUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698219, "uuid": "2e373be0-4637-474a-b5a3-dffc86bca21d", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698219, "uuid": "dcf52ef5-8ec7-416b-8acd-16a034ca5383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698219, "uuid": "2e55378b-00ff-4d47-8187-ceff5185e0fd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c0bfcd-4eb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668766, "uuid": "8e26839a-6dc4-42d4-86c6-4a0d9ccd83f1", "comment": "Malware payload", "value": "41732b3c2115855b19e44b582447d8bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668766, "uuid": "c7ab569c-7cda-44d8-b50a-2e45538e32ec", "comment": "Malware payload", "value": "098be7f80aa90d2fcdd2996d8d4126f7a7fb759d429cc9f6327c9bdd48afc1b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668766, "uuid": "30152fd2-331f-4565-8a0f-8882a4d09aef", "comment": "Malware payload", "value": "104d3e373e97e17688871d7d3e9ba2d58634c6f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668766, "uuid": "7f3ea69c-7ef6-478f-a805-90984c562997", "comment": "Malware payload", "value": "2c470581f91c0a5c5e9573a5652d8c52910e4c950fc455670c448172fd821a67350d57e2d8181a005bd8171d91edf2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668766, "uuid": "453ebf91-81d4-455e-8a1f-4be38bf4a472", "value": "T112565903EDA455E9C1AED6308AA29113BB717C691B3163D32F50F7282F77BD06AB9344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668766, "uuid": "c19278d2-2ae2-4e40-bcea-4fada2f000cc", "value": "49152:Bt0SeIWjm4pC7V7Ri68j9yDwyVO0EPldjjv289zgBjMKlK1Kcal/f7k0J5E3:BtkIElZ32jaWf7ksE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668766, "uuid": "45edd418-132b-43db-8692-21c1650478ec", "value": 6004898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668766, "uuid": "7f0f9122-095f-4664-b946-9d7f30c1bc52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668766, "uuid": "97c70ad1-5c00-49cc-bae8-687d8014418e", "value": "agent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad3a0a7-4ea5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778661020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661020, "uuid": "4d46652f-c535-4c85-ae2f-99682a6ce237", "comment": "Malware payload (ValleyRAT)", "value": "8795d8339496d8d138522a5b22fa9056", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661020, "uuid": "a9f1247c-b84f-4579-9679-a73d42b3bd82", "comment": "Malware payload (ValleyRAT)", "value": "0a1a7313ccefdc64ffbf75dc088d9f864da55c1beeacc2a8bfa9360b4e8296b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661020, "uuid": "f6e058d5-3641-46fa-b117-0e744587f034", "comment": "Malware payload (ValleyRAT)", "value": "984d67818a5fe83412ad5b42efa7a493853c14eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661020, "uuid": "06a842cd-9ee3-44eb-9514-32a7582b3014", "comment": "Malware payload (ValleyRAT)", "value": "f07bf4ba6c206a881c4af37e568bf07daded6a8d298c6ce6d0f1fcc9aca1787cc9fb3cc9a8752801bbeaabf75848e0fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661020, "uuid": "9871ba2f-72d0-4823-8120-a71422934ac6", "value": "T1C266AF11AFC54DB7CA23EB3C1916A06CB09E9C2417B5C3E3DADFBDEA1C344424968766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661020, "uuid": "de463c19-7ca2-47cf-a654-46889d0b793d", "value": "0570f232072c2676976eea801785ad17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661020, "uuid": "4560e6b4-7b53-479c-a616-cdc1d9679da5", "value": "98304:9zsmPeG+yhB0DhlL3Yi0x9+5FZLp9fj0pEd+2MiV+Uyg:hsPyhB5i0x98tpFel8Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661020, "uuid": "5d3d3b54-0f1c-415e-b0b6-d6024785b6df", "value": 6678464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661020, "uuid": "afe38808-3796-4709-a0be-624b67dfa1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661020, "uuid": "35bef59a-349a-48bf-aabe-87b324cc553c", "value": "0a1a7313ccefdc64ffbf75dc088d9f864da55c1beeacc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5374a713-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698106, "uuid": "1ead45bd-aeba-430c-b742-a9985cad8f5a", "comment": "Malware payload (ConnectWise)", "value": "2d010c9664f9905a3cec8b0a605365e2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698106, "uuid": "e4ce2682-564b-4417-9c6c-160271e8a779", "comment": "Malware payload (ConnectWise)", "value": "0a87ca87a3d93286a61ae239db29c91a9d60430d1377d80603e2f77d60b2c2b8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698106, "uuid": "59cbc130-8936-4b20-a2f0-c3251a954e0a", "comment": "Malware payload (ConnectWise)", "value": "0152a542b34122a58d206c8d7abe5a7d6b756563", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698106, "uuid": "f711bb12-dfbd-4143-8727-8f015e06fe4f", "comment": "Malware payload (ConnectWise)", "value": "3103e9c23c497d63906cdaa679783a7feeffdffa16d857726145787de5e8201855fe7a4a9cea454a8d31fb8124ca9446", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698106, "uuid": "1d7b8de7-8371-48f6-bcaa-e44415fb8ff5", "value": "T141646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698106, "uuid": "e09afee6-8107-4ad1-9555-4da75dc208d8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698106, "uuid": "dd9c485a-3a43-4e28-bde7-48b7e156b2a1", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698106, "uuid": "cb1d7fb2-bf80-417b-8c66-eba37bee9bb7", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698106, "uuid": "dbaa4a4b-b949-4b07-90f6-0f96c8d1af3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698106, "uuid": "fb66f22e-1755-4d7b-9370-2ae461ef25ca", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624bc6d1-4eed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778691688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691688, "uuid": "15d98d24-ecae-41f1-bfac-3070d635063e", "comment": "Malware payload", "value": "50b2dc538ec30ac683d5f795755d42f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691688, "uuid": "e85f3589-ce36-48d5-ae9c-a4b81129b99e", "comment": "Malware payload", "value": "0bc58e58275d6ecca05335aac681a0352173e19d8718230c1902c2bf99d8782f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691688, "uuid": "7e2df798-4709-494f-af9f-b034a5615bf1", "comment": "Malware payload", "value": "7e36b5c294d0f6b24df53b9c2cd9b0cfae8ed445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778691688, "uuid": "98839fa9-0dec-4a33-8f2c-60a8f5e22d0f", "comment": "Malware payload", "value": "6a8b1498aaf61d27030dfca7ef9b0b36cdaed6ea7b2aa09acc2c34327efe912eba26767b8250af825ecdf45202d7e92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691688, "uuid": "22c4b10d-ba17-4306-b1f2-37538e946f1e", "value": "T10F665B73905514D8D1AED974C6152213BEA8388B673873DBBBC076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691688, "uuid": "e9763371-6ad4-43ce-9177-06e8e46aec77", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQT:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778691688, "uuid": "1341849d-a4d5-41fc-865f-f73a601d5cfe", "value": 6520832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778691688, "uuid": "c0a92576-5b23-4e6a-9b01-8ee748734f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778691688, "uuid": "d0da330c-5d30-4a27-8f61-eaa39f15a157", "value": "0bc58e58275d6ecca05335aac681a0352173e19d8718230c1902c2bf99d8782f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4831a0f3-4e6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637098, "uuid": "ba0a82ee-728a-4422-9194-bf299fc0469e", "comment": "Malware payload", "value": "ea0280b854218e14cb094449bbe324b9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1767", "colour": "#3C0807", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637098, "uuid": "dfae2ad6-810d-441c-b939-f706e5de5d8c", "comment": "Malware payload", "value": "0d979ff0969d734b927e9202dd97d21ee8d8a63397c0884175bed15b2e0e1d27", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1767", "colour": "#3C0807", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637098, "uuid": "f6a527a0-648d-4ce5-bff1-547273d33f7e", "comment": "Malware payload", "value": "43ae6be9ab813f154a6c0f2d48cca2e308ea526b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1767", "colour": "#3C0807", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637098, "uuid": "94fbfec5-5ff4-4f55-9aeb-83cf453cc55e", "comment": "Malware payload", "value": "e3456782d4b5e61fd6ca86226a2797e72c05ba028222cdb673777a03f698245db17c9daf645c73e5ff035dba6ddd9637", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1767", "colour": "#3C0807", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637098, "uuid": "27b0bacb-c1b8-44d9-ba6b-dcde7f22e92b", "value": "T1210733258CE3DAF2E3F9B699B651C8B19F1BB1BCC11114605B5F73A13F0AA39F425A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637098, "uuid": "9d5229c6-7b89-4766-99fc-6fb4725557a4", "value": "393216:c6HVtjPiLT2tNj5hlV1XwSd16QXP+wy0CEiYiLBfpqXsT:LCLTKt5hfGSWQrkNTqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637098, "uuid": "40fcd7c5-0957-4262-9c8f-0c317bbc944b", "value": 17370275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637098, "uuid": "2327e500-10bc-4f85-88fb-8845ab66d2ba", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637098, "uuid": "132bbd89-1634-407d-9b72-345ba7c60a8e", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197da071-4f0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705740, "uuid": "7e432135-a913-448a-ab94-001cd3b57dce", "comment": "Malware payload", "value": "373bcda39a840934174fae7ce769c224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705740, "uuid": "af6208ce-89d8-46ed-abba-15d47608aee1", "comment": "Malware payload", "value": "0e83dae54a8ab2f0a8f92af035711b896f884d5f6e0553f74c53633e25069e6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705740, "uuid": "9ef0443e-d365-47c5-a732-d83b87ab342c", "comment": "Malware payload", "value": "67696f268898dd381dac605063b4c8995e823f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705740, "uuid": "29ad6112-b585-4f6a-ac78-15e9361c68c0", "comment": "Malware payload", "value": "9a688ea9783054f62462b483b93a454242a51d68f6352cb0f0722952fdea25d65486a82b6bd0fbd80b15b9584748d678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705740, "uuid": "e4101a42-635d-4e68-8f1f-1c90a2ce4fa8", "value": "T115B3D747BE04FFABC03C4F709AA9C7120094A5C5B6A5A13F72A497DDBE792131E439D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705740, "uuid": "81011f60-7bc4-474a-802e-f10ecefe40fe", "value": "3072:bhC0BpoZxXbp5wrQLITxseIRIfmEq56oJXD:bMaofoS+amM56o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705740, "uuid": "1f476623-6ac3-473a-9c46-9629669d83e1", "value": 117836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705740, "uuid": "e5abde7a-6795-428e-bf9c-8139a6d92feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705740, "uuid": "6de8a446-a3a7-4574-a141-8bda9fdbce28", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b77eef-4eb9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1778669201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778669201, "uuid": "2371bebd-282d-4ecd-908c-84a40c62cd00", "comment": "Malware payload (RemoteManipulator)", "value": "904167ef373ae8b98b48f9076253bacc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778669201, "uuid": "ba3f6dd4-ca3a-4491-b377-a219b364f92d", "comment": "Malware payload (RemoteManipulator)", "value": "10ac291868de15712fb32100f25f5c0331fba5e70ef0347b953474d9b153bb81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778669201, "uuid": "d8a95496-9356-4774-8d2b-ae4483860701", "comment": "Malware payload (RemoteManipulator)", "value": "f619d145ec2b1c5c126eb8e738a42e095b7bfea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778669201, "uuid": "0a7ddc51-fccd-4190-908c-f61ddf249977", "comment": "Malware payload (RemoteManipulator)", "value": "4fb7723eb29e199734d42802a967c8d98c74cf45c5db799d3bebca4c4ba836d4c832665ba24154ab89f50938edec13e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778669201, "uuid": "3681cadf-3cb8-4f32-9551-a62eb2ec8869", "value": "T161364931769BC53BE56219B1692CDA9F5069BF650FB094C7A3D80EAE44B08C34632F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778669201, "uuid": "f39dc8da-f167-4cce-b587-8ba3a48e13f3", "value": "d25b29054fccfd62c3ed5a8a3d014883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778669201, "uuid": "29b0ce90-44e7-49f7-a9ad-c9a378546eb3", "value": "49152:yR5CbBq56hIF1XrwzMtmEMQh2Uc0RB6lxSDfsWBxTh28h/kY:IEThIF1XrwzMtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778669201, "uuid": "09ec33d9-5c14-46ed-b4ad-8631b77358ce", "value": 5000784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778669201, "uuid": "d8c2dde0-50ce-45a4-b7e2-2f77e4fdf378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778669201, "uuid": "f0568110-29aa-43bb-a4f8-a4badc29a077", "value": "aptos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aa673d-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698251, "uuid": "145ad96e-6e82-4f00-835b-a33e16f0af2e", "comment": "Malware payload (Mirai)", "value": "72e3996a1c3cc9ccae6bd0addf51da74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698251, "uuid": "3b0918c4-4625-442c-a396-792095589f58", "comment": "Malware payload (Mirai)", "value": "124cd5cb907ce33f0735647bb22236e0eee8a273caa0b3c8720ef4cc5d6a4ccc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698251, "uuid": "b8f7be1f-891c-42e3-a5b8-98654c26cc3a", "comment": "Malware payload (Mirai)", "value": "d3bb45117b2fd798a678b484bb25efc43c0af0ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698251, "uuid": "853ff645-ca29-485a-97d3-9c58d95efd5b", "comment": "Malware payload (Mirai)", "value": "9b14de601ee0a225f0183577b1ea5c2439ac8e4dd26953b4e6c8b1997b3d9973c295d9c7f967d801b2593f01f8a85e62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698251, "uuid": "31eecf06-9c4a-4518-bdce-c62e0f17b792", "value": "T120F34C47AA414A13C4D6277AF6EF42453333A764D3DB33069928AFB43FC669E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698251, "uuid": "5e5ee3a6-35aa-4cba-ad8e-cdf6abd6de1b", "value": "3072:0hiKQ8ykCYaJ8sWn3N/mXqGxBFEFrEgkM/9eQemr0iBXdV:/TJYaJ8sWn3dmXruFrEjM/9remr0iBXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698251, "uuid": "7cb43cda-f5c1-4acf-8834-0747c7f221b7", "value": 166936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698251, "uuid": "bd2b5eac-017a-4aa0-943d-8f66e19581a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698251, "uuid": "722ac064-85fe-49e9-af9d-10a0c0a03768", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfad7e20-4ecb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778677242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677242, "uuid": "b5e6949b-f58d-4d1c-a964-aee1eaab372b", "comment": "Malware payload (Mirai)", "value": "1e8b2404614f931275e3cac806c79dca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677242, "uuid": "f40d25a7-e344-45c8-be40-3db4796ef04a", "comment": "Malware payload (Mirai)", "value": "15359db300ba151241e46942e008d55fbb48a790e42b7e6523a659458f4b5b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677242, "uuid": "b7f264e1-6a7f-4548-9786-e98a6808cb9b", "comment": "Malware payload (Mirai)", "value": "586d8b0a2a57c757f2798b01d09011f860207500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677242, "uuid": "4508efa3-ab19-4534-a606-01e37066bffe", "comment": "Malware payload (Mirai)", "value": "0ecec3a28fb7a298b8d35f55f5860eec39fa656588bee4595d76c259d2c1905ac46d253b40385b34889a4ad3c20caae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677242, "uuid": "908bbe4a-edf9-41f4-9ea4-77efa39cdaa6", "value": "T1CAC3D7467E04FFEBC03C4F709AADC716009065C5B6A5E17F72A097DEBE792121A43AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677242, "uuid": "99f66c72-6092-40bf-9f50-141f145cdb11", "value": "3072:OKzBFJy4ZfB0viWw38I8w7XE8PO5Gnuq:LU4VoiW097jSGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778677242, "uuid": "5f249bb5-ad8b-45d4-9128-79b794b34948", "value": 123836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778677242, "uuid": "3cd4df61-e698-4940-81b7-8dff5354f679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677242, "uuid": "ec3e8128-d008-4761-a02a-9ff25ccc6ccb", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3704ff-4ed1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778679785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679785, "uuid": "39e5bf8c-23ff-4b90-9d42-0573ee5925f0", "comment": "Malware payload", "value": "5fd5ad405d5ad89fd52a010efcd2383b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679785, "uuid": "3f259d0f-9031-4ca8-b70e-f5d3464db063", "comment": "Malware payload", "value": "15816a85abbcc64085fc9cd88b5e1e116bb60dc33d53df8d71a8e2ffe157fd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679785, "uuid": "ab57a5f7-ad92-4bd4-a4cd-7f25a4f740ad", "comment": "Malware payload", "value": "b8325953f7e6310fe356534c3bef961e4ebdeb8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679785, "uuid": "6dfae07a-b811-45ad-beec-7bda4e149c8b", "comment": "Malware payload", "value": "aa5bd857386be7539c6b5ccbdeb2b2d0c9cca2310cbcdc66db16bb929dc704a35d3c44c1144d7c272c9680a7081ba5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679785, "uuid": "364d08cf-c552-461d-b3be-7cdb8c1dcd0e", "value": "T17C0373C9BAC2B265D712B02F2E2BF496E63D0CC1F6484044FF65B4A9FD60304D97AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679785, "uuid": "b69cc6a8-08a0-4979-8063-c6d22980bb38", "value": "768:lNyuFQjkkb+M/u8fcG5U+RWsFUB/hH0FCF6m17Xg7nO7hedsG:CuFQjkkb+58fXi+RWs20Cr17QToh0sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778679785, "uuid": "b7bb4b88-fb89-4e30-a205-bd7f33299eea", "value": 39891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778679785, "uuid": "de4d98ab-3b66-440a-b9b0-6c2200ffb38f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679785, "uuid": "1018a22b-a634-4959-a78a-9fa528d8629e", "value": "Payment_Advice.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7b87cf-4ea2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778659334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659334, "uuid": "77d02491-328c-4c77-996c-7b7f3dae0a60", "comment": "Malware payload", "value": "7c0847a8dbcc83f1e5703d71b5091ffd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659334, "uuid": "8099e86f-e316-4139-befd-ff8f3dd33178", "comment": "Malware payload", "value": "165f9ab0ad4932488a29ccd4cf9bee729942d52ea27dbadc098f26a589722480", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659334, "uuid": "255bc8f4-cf93-47f2-9663-651f674d06ca", "comment": "Malware payload", "value": "191073f92cbe1e33a49b62a239570b01cb74e90f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659334, "uuid": "d7223417-724a-4a1b-a353-955c9aac48c3", "comment": "Malware payload", "value": "10d4cb2886bcfc6787821664118e0e5c29126d91218ae0a727e54b3609e81f25d25f346614c862f019843af8d134dafb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659334, "uuid": "d496bd68-ba8c-479d-9969-6f15cc767caf", "value": "T151F586885681C027B6DD669BBF496EECE16B99F5C7CC650B88D0BE9C18BC507D0B2CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659334, "uuid": "22bda2eb-829b-4c42-a947-99d767bcd15d", "value": "49152:m67JEkQ3zidm3iR0ezawLksg5GDuWUqAzPaQxjKazTlrziuGBPyZp4ZC9jqDnJMW:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778659334, "uuid": "a7df2e31-9a09-49b3-90ef-ed2823a8bbde", "value": 3543974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778659334, "uuid": "4e2b5195-11ef-421e-8a8f-91dd7930b617", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659334, "uuid": "ed3054a2-c58b-4156-b4f9-2b8e2aa701eb", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf215c1-4e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778654392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654392, "uuid": "c1e308f9-2e1f-4d1c-aed4-8ee8d3d0fe41", "comment": "Malware payload", "value": "eb0e35149a7325712a09bef36421df8c", "object_relation": "md5", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654392, "uuid": "c6e248b0-ef5a-454f-9c33-183fc8661429", "comment": "Malware payload", "value": "19aacecf8d31a4dd7fef2b059d1dafcc2a124b26c86124a515ef875b81736518", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654392, "uuid": "88fd06ca-778f-4291-9828-a700c2676023", "comment": "Malware payload", "value": "6fb91c18f182c5a3ec7cf60b4cc9e349cdf0b507", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654392, "uuid": "a1088196-f4de-4aa2-ab01-59decac70769", "comment": "Malware payload", "value": "bf6783c0c9273fd0244967db86a0b78253f224049671376078c3d7d3ae650cac6b6087192374d659cef289523580142e", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654392, "uuid": "3a9b858b-e7ac-42e7-9146-3ddcfb9bfa53", "value": "T196A002DF70D1217D4350C9703BE11F464F412944B94C46E86584AD91A8315881388932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654392, "uuid": "fe1d2ca9-edb2-4dff-9252-c42af5b029ab", "value": "3:rhxKFrLcUotCzyD5RFK0:NuolwzyDPFK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778654392, "uuid": "3405b31d-22bb-4d3e-9072-886576f5a6e2", "value": 62, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778654392, "uuid": "9407c910-4608-4a74-a2e6-e343787b9b4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654392, "uuid": "7224bb0f-309b-4245-8e43-c0e698930808", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be798af-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778638044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638044, "uuid": "a5be6560-2def-4263-8bff-ced1758c1432", "comment": "Malware payload", "value": "018b82302109c573068460cca02928a4", "object_relation": "md5", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638044, "uuid": "4d170b53-71c3-4d3a-bbd4-8fa29bfcc1a7", "comment": "Malware payload", "value": "19c348e3c290ac2e315bffb89b1a848a322d0592543746535ab3e91e30130533", "object_relation": "sha256", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638044, "uuid": "24227d4c-e279-4fef-99c9-d26900b12806", "comment": "Malware payload", "value": "35457fab58ea92c0ffdd8d6f70310684edf4ab7b", "object_relation": "sha1", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638044, "uuid": "5872c25d-0e3c-40ae-9e95-fd4924221ce9", "comment": "Malware payload", "value": "fcfa0a579a0b240af9e6ffa9b6debcba12ee93b9f28be09fb320e1cdef5da58242e0c60ba06b44f2f7f545f78e3e2dad", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-55-25", "colour": "#5C685D", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638044, "uuid": "82fbd327-aa89-4f4a-bcae-fce88acd14c0", "value": "T1F3973339D0E0E53E0E3843AA5E04DB6E0567B034B7513BA18E89A627F59F49F04DF693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638044, "uuid": "5117eac5-6ba7-4f28-8418-16ceecd5d617", "value": "786432:4cAUdybdERaLzcSCYQNBihBx0tOLUR2kYehCumi8HYBpytNEUbdn2e:4cAQyZbXNC8iCa/YaY4Bpgywl2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638044, "uuid": "d6c05487-1eda-43df-9b42-bdd6fc4b06a0", "value": 40730499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638044, "uuid": "59f85e8e-e867-4eac-b9a3-529da155f090", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638044, "uuid": "5c77fc87-1816-4a21-9c74-c313fa9a9130", "value": "Setup_File_38.709.03277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b25c71e-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698119, "uuid": "1613b508-3e84-4b9b-8a1e-d8b5d9d20edc", "comment": "Malware payload (Mirai)", "value": "5f549997f04ebfd0e6e9c39d4feef9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698119, "uuid": "571ad7b7-d142-4608-ae70-7230d5d72ef3", "comment": "Malware payload (Mirai)", "value": "1a75f1063efdfaf08206ea57b219b8cf62418784010381eda4de21bd10dc0335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698119, "uuid": "760e3b77-1595-48bd-846c-0b5b8fe25669", "comment": "Malware payload (Mirai)", "value": "26087586cdf1909c9db3d76a90aa4c001026f99b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698119, "uuid": "4116f84a-aa32-46bb-be21-4e6fa75b137e", "comment": "Malware payload (Mirai)", "value": "7f2bc370517ec62cbdc99b8abe63ef87ae501de4a07c45f1dc12ffbfcf73d8b29b157b245b4bcb4e1cc85ea1d16c0846", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698119, "uuid": "09950c60-9457-4daa-b72c-e61545139972", "value": "T12B762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698119, "uuid": "4f6dee7f-61e9-4350-9be8-e87d16c57f65", "value": "49152:rDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJgWUhHEvmCLpR5ELf:f+4vq3QbRSP9ODiDoEv3mObsELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698119, "uuid": "6bffeaaa-c472-42db-abba-23b3adcc8f25", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698119, "uuid": "b01c9b1e-1bf1-4289-b0ec-6520c11205f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698119, "uuid": "634f0cf9-5178-4f72-92c6-b701bcc880eb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907331eb-4eff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778699497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699497, "uuid": "b7460308-f371-47c5-aae6-dc7818b38b1b", "comment": "Malware payload", "value": "07de0c936433ed95b47b671925cd56ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699497, "uuid": "82331d16-536b-42ac-be44-b5b35e576ed4", "comment": "Malware payload", "value": "1c2a32a448a3cbf99e2d69f6a4671fce90753808cdf29e441277d20832129365", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699497, "uuid": "8708b139-5e6b-493c-9ce7-8992e97b0173", "comment": "Malware payload", "value": "6251e869e6543c0f3fc3ff4f29190c589fa992fa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699497, "uuid": "0f50685c-f3e9-46c2-b02b-a3c24001641a", "comment": "Malware payload", "value": "f5548e3653b137403944963a7b1458fad34d98d97158aa4f696bdc9e3c28f676549ced732c940767c87cd1a1108ec56c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699497, "uuid": "3b161637-5113-4c1a-bfdf-d0022fc4a5d0", "value": "T1B9138D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699497, "uuid": "000ebf5e-5703-453e-8f66-c18decbeedc4", "value": "768:bU+19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bU+mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699497, "uuid": "e2c8ad2a-a3af-475c-ab26-576b33941e70", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699497, "uuid": "8aea139b-1776-46dd-aea6-0be6ec4c82cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699497, "uuid": "32057106-ed1d-4fb8-bbee-13d7b658715c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dd4e1d-4f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778707426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707426, "uuid": "c6be26f0-5202-41fa-9955-3015192fbcf1", "comment": "Malware payload", "value": "695fe1684c8876d8fcff9a041bfd64f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707426, "uuid": "2e1c8c16-9dd9-4c90-9469-6578df3a6782", "comment": "Malware payload", "value": "1c428f2d0967c722ddbe84ffa754a27f6055e900045419ee9754ed170c373819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707426, "uuid": "8550d507-832b-40d1-a11a-25e9c60b6dd8", "comment": "Malware payload", "value": "7b0919a82661bd63537f4ad8f15ac2bb9dc968c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707426, "uuid": "d789f143-5681-4571-8ad0-c1ebd596292f", "comment": "Malware payload", "value": "4929ba10c0973fe8309f3f5a2b33f5afe8ef1148b56c5682fe225baf2d62e177fecb0d519cdae65152376383d7164169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707426, "uuid": "825b1170-c7b0-4cc6-86f0-7d907069f453", "value": "T11DD39E97B6075858C82106F44BCB875D2B6321068F679AF77C1E323E6E3E9DB68053D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707426, "uuid": "c275927b-8804-465c-b0e5-4bed2144c6eb", "value": "3072:2Wb5oe1MZUFbahw+zYDqnLKgRC5G2orRjqp:DVQZUIhT8GL1C5no5qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778707426, "uuid": "d63313cf-da26-4b46-977c-7647b6ab6507", "value": 132816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778707426, "uuid": "0e32f318-092c-40b3-ae5c-b68ffac20a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707426, "uuid": "c0d7c2cd-371a-41ab-94b2-7c093ae016db", "value": "SecuriteInfo.com.ELF.Mirai-CSC.56765397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac734a02-4eff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778699544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699544, "uuid": "cd6d3e15-2706-404c-b354-fc10a0348057", "comment": "Malware payload (Mirai)", "value": "40d7b44f2eb922e8e261dda0f49496bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699544, "uuid": "8cd1ec8c-370e-44dd-9dda-9c77e2767665", "comment": "Malware payload (Mirai)", "value": "1ee38dc9659791a557a2f56556b0ebfa826009164d578669901f90b2fd8d1578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699544, "uuid": "6b08e904-b926-49b8-95fa-9bad58b2eeea", "comment": "Malware payload (Mirai)", "value": "e9354cddbb8a6a715be1a9e8bbd62507835341f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699544, "uuid": "50f6104d-ca44-4c74-8ba4-7fabe68011d4", "comment": "Malware payload (Mirai)", "value": "aa6030cea8a601b109907fd790909f8505e9d7e7f473c3e83b367839d739d7bbcbb3a997008223a82911cdaca45ba176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699544, "uuid": "5c46d016-21b7-46ff-b99a-d72963ab67ba", "value": "T1BA443B46EB414E13C4D6277ABAAF0245333397A4D3EB7306D924AFB43B8775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699544, "uuid": "1c22a9ef-faf6-44d3-8a20-5712ea1b4428", "value": "6144:7RWacRVMrOSrbQXygiaSsUuYPTIaNg85/QqrFsSV/GE0mw25dps:3YyNkXybaSsUuYPTIorBr/0mw2dps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699544, "uuid": "37f4a729-4288-4fc8-8863-7b313147d1f8", "value": 276608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699544, "uuid": "cf16112e-7b5b-414f-af18-2225a2577848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699544, "uuid": "04596089-c79b-4805-b649-8ba6b462897a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed024138-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638663, "uuid": "eee7ef34-9346-4cf7-bffe-7d5f04a8fa4c", "comment": "Malware payload (Mirai)", "value": "6d35508fca52221ea0a338083a4f8eeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638663, "uuid": "bee6baf5-5e6a-49b7-bac2-59ab4571d0a9", "comment": "Malware payload (Mirai)", "value": "1f3a59e1b76f41917f0d49febd29cac247a06252943e5a330236623869b4034e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638663, "uuid": "e7a67251-86b8-4084-b1f1-55eeb6aba5c7", "comment": "Malware payload (Mirai)", "value": "7f8b30cf6015dc3d31de8c3b42bf44c4ef60dee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638663, "uuid": "2295326b-7659-48fb-bb86-c438093d7f55", "comment": "Malware payload (Mirai)", "value": "e3251162ff0f89e6ef698083e562c54f521972fb2eda2dba0b7b43a6663645ed19a428ebedbed77b55687066a34cbc6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638663, "uuid": "28d3ea17-1cb0-4753-a401-80bfd1e13312", "value": "T17C333902957C2A2BC4D0E777116343B3E1FA2B854194E64FBD660D4FEF593501ABB6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638663, "uuid": "9a33f283-08fc-4d5f-852f-c47a5a7cffac", "value": "1536:GTPDALm++phGkhlXxmJNs18neeqiZCLyK0p:u7WkPAXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638663, "uuid": "65e71387-b60a-43c2-bc45-bd0a5edcb32d", "value": 53716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638663, "uuid": "8ddf35aa-5967-47c5-9016-e4dc6cf0b7fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638663, "uuid": "815a2e5e-bb06-4e4c-8384-9b4f3a8e1cd1", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5bb9e3-4ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778687008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778687008, "uuid": "76ad490a-94fe-4408-a0fe-ad7ac6c450b0", "comment": "Malware payload (AsyncRAT)", "value": "87581173eb8732828cdb3d2d74441514", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778687008, "uuid": "c6d8ca39-3676-4f44-ac4f-0b405a6ee38b", "comment": "Malware payload (AsyncRAT)", "value": "1f76814abb82051abc951a798741aed01f38447e439da88af814c94a07009493", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778687008, "uuid": "79635336-02cf-4660-957a-57d69b7e23ca", "comment": "Malware payload (AsyncRAT)", "value": "a770505f508672d78993e0745f669c8b012ba552", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778687008, "uuid": "83b28fa3-ee8c-4c86-9498-6728dfdc5587", "comment": "Malware payload (AsyncRAT)", "value": "95a06fb0112f4337f6b63b4523da2ddaf4bb87333b616c6baf274cbc03b882de0147790a6d585bf534b6fef6c5477d71", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778687008, "uuid": "7635fdbe-ef62-4f2d-9b16-916f36a791e3", "value": "T139D22B0473E8C676E1FD46BB883396008775E5574913DB6E1FC890AE2A63BCDCA14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778687008, "uuid": "d2c6dd8c-da3f-401a-b5d0-106a13abef3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778687008, "uuid": "7f977c70-8465-455a-88a4-c42435474f09", "value": "384:nxDKSTtbOz6z4Woy3Kh6h4fWH9qbuUsi/QxnCJfJbndnjJ9o7u9u+:nxD1x86EWfKqIbUBibnhOu9u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778687008, "uuid": "09388904-b5f2-4604-8051-0815d1f20980", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778687008, "uuid": "fa8bfcb0-1be4-4efc-923b-15cf91d368bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778687008, "uuid": "c94f3fe2-6724-49ec-a647-1c1df94aa41a", "value": "QH88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6206c4-4ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682743, "uuid": "8199329c-44c7-4890-aa1d-443d499bc111", "comment": "Malware payload", "value": "fe42e96e013688b343504698c491acc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682743, "uuid": "d84d7712-89a5-447b-a262-ac5517ed930a", "comment": "Malware payload", "value": "1fa15bcc25e702d940d76b98bd402d0783c25f60c1928ae7ed3612d1b9419d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682743, "uuid": "d3fe8ade-df8a-48f4-8676-9a527e161aad", "comment": "Malware payload", "value": "c3df1aa34cdea565b62e306a7d4177253ae030a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682743, "uuid": "5b3a16a9-2dff-4490-8f8a-b2125a7e0939", "comment": "Malware payload", "value": "c9e1ac4cb1664e851c353ed4a98e9b5d26357c394c123f8a49998e34e7168fb05405b4608c7447f501bee023e11da7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682743, "uuid": "8b31eab2-3f0e-4469-9f59-d6715884834e", "value": "T10FC402077A942B42CA6411B5C8E3E82503FAE98B32F3D74D7F4503869E417E48DA6B9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682743, "uuid": "6f9a7f62-b1ab-447b-a06a-d7d5e9e64ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682743, "uuid": "479b837b-8941-44ed-b0d0-e5c7fd4aba63", "value": "12288:yW7yNqbJTara8BQKGgZFKzdfKyHln0Idz6m:y49ara8BzezdScTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682743, "uuid": "d7e31d9b-8047-4e31-99c4-3c411869887f", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682743, "uuid": "7ed1db74-d025-4081-8f3a-0c85b40694c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682743, "uuid": "0dbec52b-f5e3-42e4-97f8-d0e67a19c8bc", "value": "SecuriteInfo.com.Variant.Barys.508189.94574519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c295ec-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638760, "uuid": "e2bda9be-138c-48e6-a1b6-c4a2ce32b957", "comment": "Malware payload (Mirai)", "value": "28af7ec4bcacd11bd885c7eeca489122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638760, "uuid": "dd43e680-27fc-400d-bc6d-304d4a864ba9", "comment": "Malware payload (Mirai)", "value": "201abace90a2c43b6168021d24760ace69fe14c753f881e1ad99f69735c29740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638760, "uuid": "8f4b5e3f-9891-469f-8fb7-b51308ed7eb4", "comment": "Malware payload (Mirai)", "value": "8b807fac97524a55d874a8f778a281e91d0d273b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638760, "uuid": "d46a0445-b331-408f-b2cd-df6934fb344d", "comment": "Malware payload (Mirai)", "value": "4a9030979e6dd876e75c69ac8d445a6fade80775c8861973c0581722d7e9738d7246f069140103258c1f3d69570c80b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638760, "uuid": "5c7ebeaf-1ade-4e0f-96cc-ba010b1903a7", "value": "T1C2935D02B70C0E43D1675DF02A3F27D1D3EEA6E121F4F688691F9A8591B2E335586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638760, "uuid": "e5b4dccb-e4a3-46e2-83c9-d010c77a9bd8", "value": "1536:mFsCCOHrTgbrkAcV4SKUgZ5VvHfNaoY04M1ybpAzKYjlRKVMuXyCg7EAUx3B/G:rROHrTZAcqkGAAz9KMVCEkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638760, "uuid": "659449af-60e4-4820-ab63-b523c22d3c06", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638760, "uuid": "4a1aaa46-ce11-41f7-a713-2225873d4f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638760, "uuid": "9bd1828b-a9eb-4b5e-bec4-5eb3495fe59d", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec92cbd0-4ed3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778680753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680753, "uuid": "d8313196-bf66-4213-b144-7636e6cd00ad", "comment": "Malware payload (Formbook)", "value": "96279499ac4074190921cabc43d47f82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680753, "uuid": "d50cd8fc-f55a-4a74-a7a7-3c52d0cb7529", "comment": "Malware payload (Formbook)", "value": "21c2f07bf95dfa8a175a6346e54113e6a0deb02b4569183d361c884617ff8087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680753, "uuid": "edc39400-b809-43d2-bcf3-1fb703fc1281", "comment": "Malware payload (Formbook)", "value": "64b5536088e88341e291cb2344714ab5d203f2e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680753, "uuid": "2d256913-dddb-49ae-ab46-334975dba2e6", "comment": "Malware payload (Formbook)", "value": "7d4965f7b1f4e3de88e018b5f330c5a93731acbb273c7f3daa931a3a568e02da23146d2d6448088be2f455eaf9386449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680753, "uuid": "f2bc7831-0682-433b-8ab0-1a5f6013de36", "value": "T1FBB5CFCAD16E44D29C053FC9A8142BC78B2546324B7400283A6FBD895F7B5FEC15EEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680753, "uuid": "22a7028f-af7d-4e59-a190-20d46f6ac016", "value": "24576:4PQiigl8rdq+8ZdnW1Qf7JO5w2yFjQrdGRzJYCsMxRfTof+G+H6SD69petb2YT9T:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778680753, "uuid": "02cb4696-ffe0-4e11-a43a-0de2b7ee1793", "value": 2282479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778680753, "uuid": "0503be03-e373-4e62-9a03-946448985d0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680753, "uuid": "af3b1b3b-a4fc-4c63-93ea-a13c7dd86e5f", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1a557d-4e80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778644861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644861, "uuid": "ac8632d2-d664-45bc-952d-5643e8cd4edc", "comment": "Malware payload", "value": "11eb4afdb20a673e825fa1b3392f6d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644861, "uuid": "962f5f17-f40a-443d-aa65-ff687f14cbcd", "comment": "Malware payload", "value": "2323b5a8e01c2ec1ac3ebc05317dac329c87d4ff54e8f2214672e81fd9728939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644861, "uuid": "6df55dff-67ce-4359-92fb-10d6f97213c3", "comment": "Malware payload", "value": "ff6accb4eb8fc07cbbb86d31c172350ff9af8872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644861, "uuid": "1b6ff72b-6f12-445c-b245-84c5dd958534", "comment": "Malware payload", "value": "bc7fdc3520b6b1f11ad9e86446583808a981d72ed821776f90b2519879c9e3d64ebb2e2db35942e894a043ba19506f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644861, "uuid": "6b3b479a-969b-4e3f-98da-6cfcbe7870c8", "value": "T1BB958C06B66541FCC09BD278C61A5657E7B17C86172097CF1290BAA62F73BE21F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644861, "uuid": "4f31b490-adf8-4219-8d3d-71bd97045c16", "value": "49ea913537e8846d169d32fce7302ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644861, "uuid": "b87b58e1-cdfc-461c-93a8-8e26f6b3352f", "value": "49152:a/7E4O8OBQOH7D1dCKAJg6PwcVPPmL7MyTq:aAJ9Sgc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778644861, "uuid": "62ccc5cc-9955-43ca-973e-62743f5d910b", "value": 1946728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778644861, "uuid": "8c6a56cd-d6f0-440a-93c6-803dac56b2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644861, "uuid": "33b11430-cc1a-4f12-a6ee-aac1ac524e3b", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87806ed-4e7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778644696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644696, "uuid": "e7bae934-fed9-4989-af2e-df52e2f8f3c4", "comment": "Malware payload", "value": "32d1cd06215241fd7c9b87e9134d8095", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644696, "uuid": "d68e438f-b418-49c4-a539-8b6d653f8f22", "comment": "Malware payload", "value": "240736de9d08d836e979156a5bdc29a94dba0bff0ffffab49e9887452773a8b7", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644696, "uuid": "1af22990-43b3-454c-a089-77559b9ec097", "comment": "Malware payload", "value": "fc496e15d1d03ca5c2394544ac83f3a44ef37bf4", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644696, "uuid": "8dcb5c17-ec95-4e2c-b6cb-78ccc7d80967", "comment": "Malware payload", "value": "ae51331ac3ccf40eeeb19311ecdf2c44cc675860338434363e3b1902f29cc0e2fc7f8fffb83c5519e167cb2ce36e129c", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644696, "uuid": "0221c341-54ab-49c7-99eb-74f32c1b39cc", "value": "T141262310BBBA68ECD159C0758B5B8A76AD31748D0B21ADFF52C043353F9AAE05F3CA54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644696, "uuid": "a680ccef-b7be-46ad-9d25-168d798f8ce0", "value": "99bdb15ed8de6c002c4632d26bd05987", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644696, "uuid": "715a0e33-1ef2-48e2-8f5d-2966b7d9d1ff", "value": "98304:R1vhbQdXgHOV3s5ERbRmol5T4jcaszhhehsWVGvvpJbRmol5T4jcaszhhehsWVGm:rGp3WERool5T4wh2sWV4Jool5T4wh2sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778644696, "uuid": "056941a7-5211-4169-8a01-95de33958eaf", "value": 4590872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778644696, "uuid": "de61a005-b98c-4422-a625-7ab1146f8faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644696, "uuid": "0c04266d-c6c6-443c-8615-e56c4b3cf25c", "value": "\u3010\u3010\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305\u3011\u3011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd90072-4f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778715837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715837, "uuid": "926740d2-5523-46c7-a607-87dfdef4d131", "comment": "Malware payload", "value": "0d994caa89bfa84da9cdd4a3295b46ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715837, "uuid": "f41a2ef5-2f6a-4300-9bb8-7667f29ed15c", "comment": "Malware payload", "value": "243f7b91836c6aa0df30d1bab2bf74685b6046ded163cedfc63be95a7578cf12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715837, "uuid": "56e4f3d7-fbe0-490a-bbcc-e72278c30bc2", "comment": "Malware payload", "value": "49d3b7d0595ea672841ed869f330789a60d147ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715837, "uuid": "89e818e5-8bca-4e50-9881-cea78ec2686c", "comment": "Malware payload", "value": "64ffb69f72e9cea31920fe5f482548fe2e8832741268c3b03cc5c1dbc7ef63291dfd7f017051440c34d0ae830935f63c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715837, "uuid": "002d9d4b-c416-46c5-8fe1-bcd2d4025b69", "value": "T1CE730991FE81D952C5D939BAFA5F41C8338303ACD3DF72028E019A35A6DF51A4E7AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715837, "uuid": "0d60ffff-410f-4fbf-88d3-b802e074255c", "value": "1536:GwR7rNjQGv5g/VkfSv+vkIpWqW7LuxvFi1wWOS/Z2Qxqb7:jJ5gNwVMi/8utFuw0Rqb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715837, "uuid": "8163d4ea-75a8-4ec6-b0c7-8eb87d6325dd", "value": 80436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715837, "uuid": "787df3bb-d955-4146-81d2-4f53e7b59631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715837, "uuid": "ef58c174-8289-4110-8ab2-ce45ecc8c244", "value": "SecuriteInfo.com.Linux.DDoS.2637.15987.3888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1ae503-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698394, "uuid": "55253a0b-c5b9-43f3-891a-b63ac3040c3d", "comment": "Malware payload (Mirai)", "value": "1516e0ae69e8a3a3c3d4705a3ff8e461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698394, "uuid": "ef6bb1d6-2def-476c-9a60-b885e78c0f03", "comment": "Malware payload (Mirai)", "value": "2542faa07ba4548f569005d9473b2595b0c1301fb9af74e2cfd78406f5e124e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698394, "uuid": "a7cdeeda-bcb7-489d-9b1e-a6777558c831", "comment": "Malware payload (Mirai)", "value": "9d1805d8395acd53ddd5b518ed761d0cf5438c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698394, "uuid": "954c36bc-cb81-4de8-85b9-b9139dd9d512", "comment": "Malware payload (Mirai)", "value": "ed0961086cb5869797800b1a5d03a8bfd7a80cd5f05524e4ca72d5d3221ddc6da74c2c16e29267404dc277d72fcb7845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698394, "uuid": "2ce2ce52-c822-496d-a3c9-92f3d62011bd", "value": "T1868302981E8517EACA16E27DC4BA2F935731DB548447FD305E83AEDDBB211B07981CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698394, "uuid": "d5e28cd7-e282-4f8d-b2b2-7105f31dbdcc", "value": "1536:SAFcUkeRA6xrvJXltZHFQII3Kctcj9FaKLXu0rAaRz8P9rVJu4:pcUNxLpA3KcWjVe0EowFrVQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698394, "uuid": "eaa9fc15-2a17-45b9-ae11-e9af8a295a12", "value": 83028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698394, "uuid": "353029c4-dbba-4334-9d0a-835564630b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698394, "uuid": "f70a67fa-4d9d-42dd-b7ed-67a6a2657cc0", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754fbe85-4e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778635886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635886, "uuid": "d47c92b9-1987-4501-b83c-1eadf7033e78", "comment": "Malware payload (Mirai)", "value": "0227f8a0c8539023ae89c05854a7cbe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635886, "uuid": "17a5e276-4fe0-4904-a2cf-593acde9cdd5", "comment": "Malware payload (Mirai)", "value": "25d1da7d3306f82334c4c8909a4ffaf2c6a6829c6a8ef0a3513b8d1e8fb3ff91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635886, "uuid": "f6ba44de-981f-49c3-b263-90d46bbfe109", "comment": "Malware payload (Mirai)", "value": "4406d4af43d86e02e3c7464c7d43facd3c21dbd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635886, "uuid": "e53847c1-e910-4e6a-95ea-08b7ca126aa6", "comment": "Malware payload (Mirai)", "value": "5a7622eb6fb507dc645e41e6f1acfa69af00af3905fc28743b119aa476eaadc7d95a384734163e5f20dca84489f6fcc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635886, "uuid": "2d02a6c2-de7d-4cd7-96bc-86711265a858", "value": "T163F31A45FD819F26C6D222BBFB4E42CD37261768D3EE320399255F20379A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635886, "uuid": "c9d361ab-c06c-4b7a-a85f-992f9552ee9d", "value": "3072:DJErYJVCjGcTMhESVlA3UQJdRhMMw7egIjT:DGryCjGQnolA3pJd7Ml7J+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778635886, "uuid": "5d3a611a-eb66-4a9d-814b-51ca6e78f65b", "value": 162512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778635886, "uuid": "fe9c6b52-1ee5-464c-8344-ba331e214bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635886, "uuid": "93f5880f-d3e0-4899-a0cd-509bbd0282a4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcf41bc-4ec0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778672565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778672565, "uuid": "338cd165-5a9d-49f9-adfb-a1e0cf92350d", "comment": "Malware payload", "value": "2dabd73055f446343d28a692e2bc53c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778672565, "uuid": "1a289b7d-3e7c-474d-9cc0-865a6f67f0c6", "comment": "Malware payload", "value": "2704ecc89e6ad0c86d02c4b0b415da2f215928c49c1f3dd407a26e87d1497a32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778672565, "uuid": "3c44dd4a-8ff8-43ca-b076-759473d9d9ba", "comment": "Malware payload", "value": "fde0783b13891fbbb12e45da50d5af4a259d86a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778672565, "uuid": "939a696a-deed-460b-992e-98626e5d0104", "comment": "Malware payload", "value": "af6bf5c4f6b1eb8ba21af07d1d73eabe766d7bdedbdb2af95481dfc133cb049cc45267538aa5b298f2bcafd3359da268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778672565, "uuid": "e60a32a5-e2ed-4b61-ae40-24568d6c945a", "value": "T1E3866C73945624D8E1ADC974D5141212BEA8388B573873CBBBC476F51BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778672565, "uuid": "792a68c1-2394-4d61-9342-40335bebf29a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ2:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778672565, "uuid": "4052bf9d-3ce6-4cd7-8434-4313242ca964", "value": 8060928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778672565, "uuid": "41730fc5-fe3c-4bb9-a6a1-19227c17320f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778672565, "uuid": "0329089e-8193-4f79-b3d0-8a19d3a17597", "value": "2704ecc89e6ad0c86d02c4b0b415da2f215928c49c1f3dd407a26e87d1497a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc80c4e3-4eae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778664808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664808, "uuid": "8e5814db-9ae8-4f89-a9d7-03b4eec05c95", "comment": "Malware payload", "value": "ff2e23a7d54c35fcb1f9ad91004ee5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664808, "uuid": "a4988e66-063f-44c9-a366-e25af069d34c", "comment": "Malware payload", "value": "2854493672f4e211dbe71886b701f4d799c295f0a22b6d76b1ed8bdb415f6825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664808, "uuid": "2b60caa8-06d3-461b-950a-c0962a6c0b37", "comment": "Malware payload", "value": "04c71c5ad56b0305beb50f117c0989a9c775a03c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664808, "uuid": "81a8e15b-d94d-4396-92c3-6d7b7da4e95b", "comment": "Malware payload", "value": "0b9b0daa848ce26c6c317bc4d75004118191cdc6d6afb506b0aa3ea228ccf0a544beb20a9a1818cc0ebb1be7bb21e3c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664808, "uuid": "012ae3c9-6f04-4be5-a15b-d22d0e74e0bb", "value": "T16C156B4AB2B374BDC257C43043ABDA72AD35B46402126E7BA5C4D7702E26E701B1EF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664808, "uuid": "5bb7e6ce-f37a-4530-a28a-6a9e5aea1921", "value": "24576:brOyf4mmKde64BD0v1D2GkelYKnHgZI5:54mTdUDC1AeCKnHgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778664808, "uuid": "bb65c18d-df20-4764-86fd-abc53ff2770e", "value": 905912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778664808, "uuid": "1ad6779d-6497-407f-a660-2ac04dbdd39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664808, "uuid": "7335b391-0451-4907-8886-3388c1803939", "value": "2854493672f4e211dbe71886b701f4d799c295f0a22b6d76b1ed8bdb415f6825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92829cbd-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778698641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698641, "uuid": "2b99d82a-9879-44b2-8d00-d35a42398b2a", "comment": "Malware payload", "value": "98922c57ab4f0737c36605bccacd7324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698641, "uuid": "f7e208ba-dfcb-41fa-a48b-9930f0dbb48f", "comment": "Malware payload", "value": "2a0c7fc4868ca76301b75424b0d7801bdb45da19e1882250c2a9a8b7ff34bd29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698641, "uuid": "2c1b16c1-07a6-4630-b5df-f7c629f89b85", "comment": "Malware payload", "value": "42f5b247896d2ce020ce377661de1d397a2a1309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698641, "uuid": "b3e9365e-ae41-49cd-8a5f-8e38b8351982", "comment": "Malware payload", "value": "0f20f51d9bd2e8542952c0d8729a285056d942f6bd86f38fdc8346c7aa50466a2305d2cde0b630495c556646429881f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698641, "uuid": "e3f53075-dae8-435a-89c0-2dfecf276a33", "value": "T1B0763B87B8924952C4E43A37BCBE81C432634EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698641, "uuid": "6b13943c-6c8f-461d-98f6-2db976221e33", "value": "49152:/5xNekq7aBHAYP59wlLVmCveTH2mkGh6pU+5cO78gyqo5E+:vNu7s9h9wlLVmCvewcO78zqaE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698641, "uuid": "0ce86fdb-5f24-4c31-ba07-0dc048d2db1b", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698641, "uuid": "b01d6a40-a4ee-48c0-9d9f-6f2548dfc785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698641, "uuid": "3b14000b-f632-4766-9b0b-f1230bfb1999", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82b67d9-4e65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778633475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778633475, "uuid": "c236b1aa-c354-4b24-8f81-539e95e54d3e", "comment": "Malware payload", "value": "0844c7d8833c8850f2d658f2198bd879", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778633475, "uuid": "5f8767eb-b9ba-42ac-aa4a-8d21d435f29f", "comment": "Malware payload", "value": "2ab774ff1b393b84459bab4dc312c0a0037f04a1a19fadc44491a746a0ee53c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778633475, "uuid": "4725bb39-ecef-4fcf-9230-eeb7a3fe7082", "comment": "Malware payload", "value": "3f06cdbd5871e167553b0d9e4aad549473aa1b0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778633475, "uuid": "41def5fb-5fcd-4849-8ec3-ea7720c80c6b", "comment": "Malware payload", "value": "9bea3b13f6dd51a41691a372ba2c52d7615d70e03c4304a560455456824d9106fe82763b866f6c04c268836db67df1b6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778633475, "uuid": "f536ebe9-8fc5-48cc-8b20-966b53aba663", "value": "T1CF136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778633475, "uuid": "0a395a2b-fa36-4eee-936d-d15757fbccca", "value": "768:bMXRWNGxVF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bglxAco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778633475, "uuid": "6894fae8-491c-426d-a4fa-fe506be73e30", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778633475, "uuid": "d203c5d1-c9db-45c3-b1aa-62bdade49c31", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778633475, "uuid": "bb06d580-cc6e-422d-b1db-934fae56c5e1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e623fcdc-4eae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778664851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664851, "uuid": "3e3f6255-7590-42cd-a0f2-2522417ad116", "comment": "Malware payload", "value": "51d6d5493c56693aca36d3308ebb1604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664851, "uuid": "3b78befe-5042-4c22-adc3-0e6223b4000c", "comment": "Malware payload", "value": "2b364088d1283c28aa5249eabd691c6735ed25c4f0f4e43a9185b6093e486757", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664851, "uuid": "25bad003-5d19-458d-903d-ae706dfcfe09", "comment": "Malware payload", "value": "27e32cc8e705434fa3e6363d6290830dd3c08ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664851, "uuid": "50298a55-f617-4663-bff6-b53d38efb978", "comment": "Malware payload", "value": "ef47bce898b4b5df5ec677a3cc5f83860d0c4c472366c73371c85e32cb72de09c1d99137516fc9be2d21c5b47c7456e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664851, "uuid": "4b8e0b03-880c-47d7-bd07-5a9bc7a90987", "value": "T155B4D09AF3133F46D4D7E53A0487C9804A5AF59723E397057B4269FB382E2724F2934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664851, "uuid": "325fd032-0a44-452e-9b5b-ab710d5daef4", "value": "12288:bP9LghLTuznTQPFNarCH7ZdGknfGa2r6pOaxy3:bFLGqznwzarBknfLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778664851, "uuid": "a5bfd083-33fb-46f6-9d23-34cc822dcbd5", "value": 529736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778664851, "uuid": "b25a1f2e-50cd-48e0-904c-5a9e0c12c9cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664851, "uuid": "6044c778-1165-4f83-a20b-cbd0f4876ad9", "value": "2b364088d1283c28aa5249eabd691c6735ed25c4f0f4e43a9185b6093e486757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66270408-4ef8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778696419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696419, "uuid": "6b0819ca-afeb-47ec-a222-4c366b047777", "comment": "Malware payload", "value": "2a909c54a9c73c9a0aa561500d85b44e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696419, "uuid": "5441f8a4-c0d1-4d8c-9505-4d6b14a04cf3", "comment": "Malware payload", "value": "2c33163b895c01ce3ff58ec47347f06a4cf5fe07791a08d2e1d74f3207aed102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696419, "uuid": "c6bd6dd1-3c08-4606-adea-993c1f08efa4", "comment": "Malware payload", "value": "72c728276ca75f6cafd6026b999cdef98ae099ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696419, "uuid": "a2805952-796f-4789-8e9b-70102a626206", "comment": "Malware payload", "value": "7e2cd074217a3d0645951badcda465124b5a378c30fc7010d99933ab31e2a5d27f4173228f0c3d3c462e87ad4afd8ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696419, "uuid": "32352837-63ea-4257-a5f1-67778ee95ed6", "value": "T119761957B8924942C4E43A37B8BE81C432630EBA8BC7165B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696419, "uuid": "86a56cfd-a3cc-4e9a-aff5-b0937f64573b", "value": "49152:bagRD+x5fl0OVbZyGENsVhsPWM1aO7DBBJtTpiB+MuO5EB:b/Dol0OVbZyGENsRq7JtdiB++EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778696419, "uuid": "514dd686-e1ae-40ea-8f8c-1deefbc5b7b2", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778696419, "uuid": "59153c6b-d758-4158-84fb-3777da2aeb49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696419, "uuid": "6e7f1a4e-c932-4793-8262-c076c8bc3e6b", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d731f59d-4ec9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778676423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676423, "uuid": "92d479c1-04f3-45ee-9089-a9cf9f12a082", "comment": "Malware payload (Mirai)", "value": "b4f84e3b02e83d1c512265138b73475c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676423, "uuid": "ab07eee4-e6d3-4f2c-9a14-9e582b49bcdd", "comment": "Malware payload (Mirai)", "value": "2c4417f528267ddb52bbb10e0be823c87b8e7b4cb2e59165b352ccaa19f9b086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676423, "uuid": "b618afbe-1c82-45d3-8bc1-9fad28ad42a5", "comment": "Malware payload (Mirai)", "value": "c8849c2c990eb9e83cb720a3dacddf94b621a759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676423, "uuid": "58c060bc-884b-482c-9f7b-2a5ad2b942dc", "comment": "Malware payload (Mirai)", "value": "72bce5ab36f76a9653e6ec9c37573b062eec3fef454d61f7c3b49d3d4d288dd87fdcc7302243a7e2379676cf7591d4bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676423, "uuid": "938490ad-beaf-4305-9783-ea326ed33970", "value": "T100831952FE81CC52C5E824BEF91F42DC3343076CC7EE76029E11AB256ADF5994E3AA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676423, "uuid": "83ecdadf-3871-4cbb-a493-65251a13f2ba", "value": "1536:1E0jrNjnzz4oaUQ9LCoScCOM+CTohudBQWwatU/m7:19ntgoaVCo5C1YWFtUO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778676423, "uuid": "8c7c68b2-7e2b-40c6-a26f-1a5bf8f54971", "value": 88012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778676423, "uuid": "28622f58-2055-4ca0-a8c1-a410d690fcc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676423, "uuid": "2d53ed3e-1fb2-4238-af4b-3cf4cd591416", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff456e68-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778700971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700971, "uuid": "158f2dc4-6dd8-4b10-88fb-80aed0aacf59", "comment": "Malware payload (PureHVNC)", "value": "f4c4efd3636904ac0d25722f893166dd", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700971, "uuid": "27359094-87c1-43a0-aea2-38c832d6aeb7", "comment": "Malware payload (PureHVNC)", "value": "2ead3b4303a43796d7de2cf5fbd28743b3e1cf9690626ae575d360c474fb0639", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700971, "uuid": "1f95d86f-6cc8-4605-91b2-de20c2eaa209", "comment": "Malware payload (PureHVNC)", "value": "87a49a0223e34dbbe70e2311ea3a4148d072ed6f", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700971, "uuid": "64831657-41c5-430c-8f11-159ac46ea5af", "comment": "Malware payload (PureHVNC)", "value": "3749798f23ed68c613b4139254956c3d0dd67ede77dc3693e6d360f94f461f130639afa98f6e77e055abe588d4ad871b", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700971, "uuid": "e44a9cc8-54ca-49f5-b6b0-3f359f5bcf41", "value": "T152C4028A7B84A702C6606EB6C0E3857503F69ACB7273D7453E1153D6BE013E6CE49BC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700971, "uuid": "257be0a0-a21f-4373-b02e-b052ad974255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700971, "uuid": "f37d2ebc-7561-4a22-b16b-f4f5c73a8cd9", "value": "12288:dPw4Bw1hbJVOCJz03VJcuEzd5z1EEfPN3bRgeeTacV07zMtpm:dPw4BkSozgVyuUB9fl3bqeeT56zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700971, "uuid": "4f02cb3a-17aa-4987-92e2-098c4b924b88", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700971, "uuid": "c9e33a27-1347-41cb-ae2b-7ce3126949fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700971, "uuid": "27455de3-0475-4613-ae15-7a1c70084507", "value": "mueiel09765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6321a16-4ec8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778675965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675965, "uuid": "3bc8ec85-7fa3-45d4-b1fe-9d0122a188c1", "comment": "Malware payload (Mirai)", "value": "7a168e13bded50b48973fc2aef9b1b28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675965, "uuid": "494e8da5-e9f7-4b89-a6b2-bb3db41c0a37", "comment": "Malware payload (Mirai)", "value": "2f1346492961a3bf7e1c4a87994772362e11e8f9d799a77607ce2ac139ae9efd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675965, "uuid": "55096dbc-8313-46f6-adbc-0b3bc791b185", "comment": "Malware payload (Mirai)", "value": "6f1bbf1635641db4d0f0aa524579780e5067bc1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675965, "uuid": "e53942dc-af13-4368-943b-9e94d42e6402", "comment": "Malware payload (Mirai)", "value": "3f2df0d66d20efedb82507ea85df1d85c47e9e7afc4aa51f3519320314d30f3f5e19da533c7a438606fc60408e3af41c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675965, "uuid": "839a3488-428d-415d-af3c-0ec45086b9d3", "value": "T141A32A50AB040C7AD5F75CB4147B432CBBD56BC302DA8815082AFB525BB1B73674AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675965, "uuid": "0254111c-01e6-4f72-8498-5ea21f6c23a6", "value": "1536:DrTnhdD6RSzfyQoVVTHbYtw2bV6L5+2aE/ASag+JrkZzIdLtXrESx8nPaZ6pbe:HTnXXaVVXYn4LFOg+JYZWxbESxQte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778675965, "uuid": "554d6a7b-6b95-42ab-8560-75cb1462064d", "value": 98860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778675965, "uuid": "307507ee-9031-4f79-92dc-0d4e135a373b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675965, "uuid": "e43edc63-69e1-411e-85c7-af6da820d0c7", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af325c70-4e78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778641566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641566, "uuid": "1ef7c499-8913-4363-94cd-35e5db6263ec", "comment": "Malware payload", "value": "cb951b4667ba57b55c38cbec22ba55da", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641566, "uuid": "922c65fd-1f69-468a-b75d-77290d01373c", "comment": "Malware payload", "value": "3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641566, "uuid": "1e973009-9f9c-4b44-b53e-5b8509354082", "comment": "Malware payload", "value": "77835e4a185cdef921f0dd6746b8b179b8dee7d2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641566, "uuid": "d488eaef-914b-47b9-9eab-7024e0fe0b7c", "comment": "Malware payload", "value": "900d78c6e26d236eea1f8b2cdc469fa67e17ab7b1c896cfce16df150de759d2c10b81c3202427fb97cadbea01f4e9968", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641566, "uuid": "08669f09-48e4-409e-97fc-30d71459b162", "value": "T123E51216F7D4662FD4BE92316D980222A331DEA1BB826B873608337D5CF71980F653D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641566, "uuid": "6acd0c76-237b-42e1-9356-76568783bdb9", "value": "98304:I1sMy5FdVTiPLJV02DxgvrqkVnNKiCmdY:I1sMy5FdliPLr0mgvrnVNKwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778641566, "uuid": "86fafc66-2099-4768-89cc-0129e14a964d", "value": 3164937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778641566, "uuid": "bb404d67-7b18-47bc-9e9f-ac8a190cdcc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641566, "uuid": "da6c4ef5-10b1-4fdf-a59b-8fc51e4c69e3", "value": "Install.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef2d46-4ece-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778678311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678311, "uuid": "2df80456-67a4-4061-b106-f28cda5e9f84", "comment": "Malware payload (Mirai)", "value": "27e8d5447476461b10bb242bcc74ae14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678311, "uuid": "ecc01b7a-4e6f-4d65-8432-79cc8191f4f9", "comment": "Malware payload (Mirai)", "value": "3625b4d1b0f004982f8502b397b2dcd62b794065dfed3a7b7b258fd82b429afb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678311, "uuid": "ff82ebda-8e10-441d-bb5a-cf70f873facc", "comment": "Malware payload (Mirai)", "value": "07976ad4967fc7867489ae984f38d494e12f60ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678311, "uuid": "30602afc-f16e-4f6f-968f-646e7aeb5803", "comment": "Malware payload (Mirai)", "value": "83eafd1879d54e396e30841769557f1596d1d474737faa28d3743746c8c1e203ab9ff0e95bd6f2bc5457a412299f8928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678311, "uuid": "acd0d20a-3cce-489d-b12f-3c29e39fbf27", "value": "T123731204E3E95C3AD97F27B6AD48C6A3336C8F067289DB2353479D26620216897C1EF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678311, "uuid": "80317dbf-4ff2-4f18-b13b-b4e52fc8154a", "value": "1536:PEAAWPb1EQV2kCqpaFSeEdtCzKbo6o18vu3lqt1UFammduqpaDBn7y4u+qgw093:PxPbBVzC1FSldkKU6Tvc1cmhCaD5y4uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678311, "uuid": "69d6be3d-60f0-4397-8435-1110dc5e8cb0", "value": 75804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678311, "uuid": "c85fc679-a6d3-4fdc-86b4-bfa65c700641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678311, "uuid": "40dc07ad-b2f9-4c83-8522-ee7fb87095ac", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ddd240-4e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778639692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639692, "uuid": "3aa57ae6-528b-4bb6-ac8a-109cc7183cb0", "comment": "Malware payload", "value": "6aa033bc7d9a540af94e8b60a6476b48", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639692, "uuid": "1eb53338-c9e7-4718-b63e-1dff5b580ef1", "comment": "Malware payload", "value": "36c005a6cb62dd768959b6841d9e7c596089d948e9f5f6f4eedf858c30017b9a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639692, "uuid": "834d9370-12ea-40d4-9657-b12e209c8f7d", "comment": "Malware payload", "value": "7d09dac022c6dc4f17af16f95d4662a988315ea7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639692, "uuid": "26e917b1-4853-40cf-964f-98f6a64a0a1d", "comment": "Malware payload", "value": "f6dbf184ae6f53e0d648c0a1a8441ce07d8696e6e4a3a1d8262457374fb8216c023f67483daaf5ac6f09db2c097686a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639692, "uuid": "d4e0e9fc-9980-47c4-be4f-c15febff575c", "value": "T15236F1756B5002F5DB4386BD8A03E7F6F92AA5015331149B628FD6479A138EC8333E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639692, "uuid": "e3e9613c-733f-4d01-9f05-58b9aa38a0fe", "value": "296befc1d5813ad1f4da38226f6eb468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639692, "uuid": "6a849ef8-4d7b-4576-9342-5b1129d1b048", "value": "98304:TG09u11llq84g2elwzVjmLSpUTLGI6xoPDAz:TG09u1sbg/wYLwULV3Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778639692, "uuid": "cb652505-4af5-43e6-9698-74002797caf0", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778639692, "uuid": "32e45984-4faa-4f20-9f2e-d458c204c2f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639692, "uuid": "b370b290-8e4a-4a01-bd8b-698bd071999c", "value": "199503092023212028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d5241d-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668552, "uuid": "f77d0fc7-fc11-45d0-a78e-c2848cb0f67c", "comment": "Malware payload", "value": "a113fbc2c55d21417f93f6b43100c74a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668552, "uuid": "2ce1bd18-d1c9-4cd8-894b-d274a748e7b1", "comment": "Malware payload", "value": "3736f8d8fa1b008b6d1183695da72bee5e1c24dbb99f893981ba808014ce5083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668552, "uuid": "7f5d65e0-acb7-4174-b222-88269cda6e46", "comment": "Malware payload", "value": "72461ea165a77c0b25be4282ad781ca37313eab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668552, "uuid": "29431b99-3344-4f7f-90dd-bd94343c9110", "comment": "Malware payload", "value": "0fdb83e36cc37ce4ac791ad4cf651b3dda97597aebc38eecd2e9ac66bf5fec4fd954de988b03f46a78c35d36fdb39821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668552, "uuid": "30da26e1-a541-4783-8783-935dee16c141", "value": "T1DD74DF63B6B8F14EE88297324B57CB0287A53FA58892D09E79B4230F28756544F74F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668552, "uuid": "6521f426-a5cd-4fba-a933-8d732c11c101", "value": "d9210cd966b2e5956644b71b6805e8d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668552, "uuid": "c3213941-db96-4730-b0bc-2211c6a1628a", "value": "6144:R+LQwhNI65MY5wH2l3D5YolYvRjf6yl/5JTFw1iKzHk2oGbksEb5iFe9:RMQwA65YHWDeXvRjf6YnyixGbk1oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668552, "uuid": "5d62517a-c2f3-41ac-9f56-cd27f64a0c27", "value": 348578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668552, "uuid": "4de75893-0099-4c2a-982d-1994186c8af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668552, "uuid": "b0792c36-5af6-473a-a59e-533fd97b1a34", "value": "506ac5f5fd9119e161b1a698f43a43bc2dd8c35b7f5ee92e62c35008d91de30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdc08d8-4ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682740, "uuid": "09c3252c-1b99-4857-93dd-565de49ce2ff", "comment": "Malware payload", "value": "34f60b8851d8b921ec0c34ea44216309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682740, "uuid": "a3c7f502-79a0-4342-a6ee-b2a08f3a298b", "comment": "Malware payload", "value": "383a693238e270a870386c253423acc54038ac1715f881c940c04ec2229b9c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682740, "uuid": "67c5ddc3-651d-49de-82ba-26358cb16201", "comment": "Malware payload", "value": "fb97da5a227bf99638366b7ac123c4e72b8c8e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682740, "uuid": "d959aa68-769a-41a9-a0f7-c4cfe220f183", "comment": "Malware payload", "value": "5446bf404db84a5898bab83c3a9b85d467a9f2bb240b51964aa19fb6d158e42766a9c7a3019270d78a0650d59abdbeb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682740, "uuid": "a30ca7ee-36dc-4c5c-8027-976bba084de5", "value": "T119D49E67B2574E21D2C89F33D08B890093B46A86B597F31E758523A6150A3FFDF062E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682740, "uuid": "dfea00fd-8881-47dd-bc4b-1824b3a9f297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682740, "uuid": "d8950fdc-c78e-4ea8-9275-f314a81f6b0d", "value": "12288:68lg68R4z4lV4EgEea3FB8lNECu28UaZRK:68yR4CJeawfECu2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682740, "uuid": "7d119e64-017e-4cd0-a031-a6e3b2356c8c", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682740, "uuid": "16ee0c74-18ab-4469-81d0-7b579a45ec8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682740, "uuid": "38381b24-186b-4f91-aa7b-514fa38866b9", "value": "SecuriteInfo.com.BackDoor.Venom.24.10909.8162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edacbb8c-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638665, "uuid": "21cc8300-16f3-453f-bf32-353d1856e9c5", "comment": "Malware payload (Mirai)", "value": "0b617e0905086a6037cf2b95ab340b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638665, "uuid": "7dc8ca99-675f-4c00-994c-99fe4c82f9ae", "comment": "Malware payload (Mirai)", "value": "3841efcc59b71c674ab46a730a22d3d169646d86975e3c885bf358cdb765725f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638665, "uuid": "2ed8e74d-4125-42f1-b1a1-3b3742957a67", "comment": "Malware payload (Mirai)", "value": "9b3b6dfab078d4d0d581f3aab7082658278d9961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638665, "uuid": "71b241ab-1680-4bf3-a1f0-7b6fb4ad4db3", "comment": "Malware payload (Mirai)", "value": "9815395daf22d4b55bef58081d650008c55de0df1f8383705ffcfad57f630e06597403141b5cdc7cae7bca09983bbfd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638665, "uuid": "cda52583-38ea-44b4-8bad-9082a8b330c5", "value": "T123935B13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA167E8DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638665, "uuid": "07f2e130-2686-4ab3-8bde-301817bab6c7", "value": "1536:Ac50J45j1WS60THxMpQV8ToeyxAwuV1h1ss6fuf55nulEJHWI9:Rf5j1W0THx38Xyx4V1h1ss6fS5ncEI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638665, "uuid": "ffd7f038-e5c3-4fd0-9bc4-9f7b8564e3d6", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638665, "uuid": "65743f0f-57c1-4588-97b7-6810f26308d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638665, "uuid": "a3a01358-cf05-4902-941b-69a62be6ff62", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8557e895-4ec2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778673279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673279, "uuid": "3604ee0e-b446-4dd4-9352-8f1bfa0f6816", "comment": "Malware payload", "value": "3917b8086934cdfdd691f5fb1b1de2f3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673279, "uuid": "f7745f70-5c2a-4c88-81e1-068ae66d9f09", "comment": "Malware payload", "value": "38dc430f58ab3fd90128934b8076b9b3e909a80cd8d52d5469c2f0bd2ff40cf3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673279, "uuid": "80a12f8f-13c0-4dd2-8a87-b7f21d631076", "comment": "Malware payload", "value": "86f3fa35c1e45c2494c324e3d7c0b226d5195e7b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673279, "uuid": "3f37be31-f1d1-4bfe-afdb-267cd94a527b", "comment": "Malware payload", "value": "4dbd0b33b53c4bfd33c7670fe55f9ff3bf3b28f789aef59cb699123d32dbd890bfb4cf56ebe5928d9969cecc2c89fd83", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673279, "uuid": "5d9d8a60-4d3a-4fae-8ec7-195e7f687917", "value": "T167E58B07B8A144F8C4D9B734C4BA7451BB21B88857383BE72A926F742F767C0AD7531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673279, "uuid": "07801dea-1410-4002-9ce8-f875f0cb320e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673279, "uuid": "e0f5e0f9-4f97-47f5-b61a-f4c0d1340eed", "value": "49152:cAv85fPhBR6ZGGP79LugsNc/zkkpowFYpq7bylwCdpc8:caA38RP7Nse/zk6FYtTdpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778673279, "uuid": "cc27b904-c591-462e-b811-812e5baddfe0", "value": 3118800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778673279, "uuid": "9ea430ce-588b-4466-b38c-b6b7c6ba82a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673279, "uuid": "f6567ea4-b766-4f67-a253-f1cc7aeb7ca9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72961b75-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778668523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668523, "uuid": "9823d9b9-d9d1-483f-b68f-896db564bad9", "comment": "Malware payload (Prometei)", "value": "70b4a5ee2069e27b4f45f688ae1cec4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668523, "uuid": "58009dff-8a38-43d0-9d82-3855b88dadaf", "comment": "Malware payload (Prometei)", "value": "39b1042a5b02f3925141733c0f78b64f9fae71a37041c6acc9a9a4e70723a0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668523, "uuid": "3c6ceb83-1b4e-494c-ae37-07140a24fcc1", "comment": "Malware payload (Prometei)", "value": "731969093cd30a876668c6f9dceec48f1352cdaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668523, "uuid": "3a28e872-92d6-4d14-a0ec-3e79088d43fd", "comment": "Malware payload (Prometei)", "value": "21d132cbf02ed857c0843dc0ca9bb1e907af2c4f347c76935a0811870e998c2f35e5a2663c9c43b289582c6417be78a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668523, "uuid": "4037b49e-cd0d-4539-ac4e-d48a92f6cc46", "value": "T15D644C33B141EC29C75105F06E6F9AA1D93E6D391F7402C7B3B01A6CD5F82D1AE61B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668523, "uuid": "c99646a9-c2b2-483a-bca2-e50c34deb727", "value": "7836eb969032af87cb60b32084b14c0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668523, "uuid": "d0bc3892-525a-4fd0-bb4b-295ce4cdb687", "value": "6144:ZDittdmoSXsyamsyxgLauS6v2rxS6YJB0SRo:ZDittd4syamsyxCauL2VS6Yj0Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668523, "uuid": "58dcdeb8-bd99-4bc2-897a-720459ed5d7a", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668523, "uuid": "9b3d9ac1-f7d4-4387-8850-cb69b02d1bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668523, "uuid": "8e6c0b2e-05bb-47f6-8fdb-a2665f4d40aa", "value": "39b1042a5b02f3925141733c0f78b64f9fae71a37041c6acc9a9a4e70723a0f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048f4c5f-4f15-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1778708711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708711, "uuid": "c24dcfbc-444e-40ea-b812-1690410dc216", "comment": "Malware payload (Stealc)", "value": "1f470b3d4e30ff3d5ee8bbe7ce051984", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708711, "uuid": "bb5217c4-9ce9-4190-adeb-f13db0c794e9", "comment": "Malware payload (Stealc)", "value": "3a9847d1e18edca8d344d263e0b454fecf2abeb377c63f335882d246d057b573", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708711, "uuid": "eddb0dcc-2d93-4c19-bc3b-9b27ad87059b", "comment": "Malware payload (Stealc)", "value": "0e94f392dd9e9ee6dfa120acfdf131cc5b141fdd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708711, "uuid": "c1b87764-c287-4e29-af17-525af92a2281", "comment": "Malware payload (Stealc)", "value": "747804e4ca1515709f2ac3c7c08cd3c20b28326ecb4579fdef8dd38c145854e7adb6903ef0ca44f1c9cda1aa845039db", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708711, "uuid": "257b85ee-12fc-49ea-baea-4a4fa0fec4e3", "value": "T19807123BB28B653DE06E5A3A79B2E250553FB661A4124C169BF4C84CCF254B01E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708711, "uuid": "c548d3cb-75a9-4aa6-aa54-c9db23bfb772", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708711, "uuid": "78bcd644-a774-4ffa-85c2-2a9cc54d9879", "value": "98304:85/YsIVHzN+RFR+9ORd3hQZMzA90T1KeVmWf4HkYZ3BEsUIB:Y2Z+7R+9kdmk2IAHJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778708711, "uuid": "6903ed09-39c9-4288-b474-7e95ef72b7fc", "value": 17289918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778708711, "uuid": "f0c7ca8d-0aa1-4c24-90f3-3dd70a4d9b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708711, "uuid": "1e698b06-e560-4b9a-8718-09d565939d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71c5ba8-4ef3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778694434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694434, "uuid": "6bb0ee80-e0f4-4243-bcfb-f024542acf4e", "comment": "Malware payload", "value": "ed0dfed21187955cef960dd8174fb430", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694434, "uuid": "1398c6ad-811c-4d19-bfc3-2da0097da4da", "comment": "Malware payload", "value": "3aaae158a84409dbc3202b174005ed9acf39ca7f3785dbff07c56be928ff011f", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694434, "uuid": "47b39b95-d087-4116-b7a3-5f6615f593eb", "comment": "Malware payload", "value": "3c51c51fa4d6226c7c7dddb17c0c9e4da49c4cb7", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694434, "uuid": "fc7b5a4b-9808-457c-9f1c-6e65c00706f1", "comment": "Malware payload", "value": "a2000f8745e2745c1a1d5b1190db89788c3e612a26606f7b5f268b5bfd6d154a098f28de9bb2071b8f8da59cfde39fcc", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694434, "uuid": "6916b7e3-70cf-4253-8b95-3cd75e482971", "value": "T179252335E7C90DDAC62AE31B78780A2B84C648DDC691B063C727252A5F43713DBA6DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694434, "uuid": "29cffe8c-c5b4-44a0-ad4a-d50cb6ba9809", "value": "24576:yacQnq6pJCt5n+4xUcZFNs+k68TRroTH+Jkqk5ANUI:yarJ45n+8pZFm68TR0qJkqk5Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778694434, "uuid": "58ec7166-4222-4973-9173-6bb9db5124d9", "value": 979120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778694434, "uuid": "2f50e17f-59d2-4a0e-a25b-848867f226e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694434, "uuid": "a355cc6f-cce9-4cb1-b2b7-9b0b74e64b31", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2d1676-4f14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778708697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708697, "uuid": "2493ee00-9e7c-4e81-aaaa-d4a8d1e91f1c", "comment": "Malware payload", "value": "21870888134ea1d9baeabec1dbeebaf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708697, "uuid": "a806845c-cb8a-40f2-b6bf-a30ce4f4be2d", "comment": "Malware payload", "value": "3b1b49936000bfc34d871a8b7c3a4a6499761e852d285d4ab7ad3531d4c24749", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708697, "uuid": "a06adaeb-4686-4070-b183-f2473e1af646", "comment": "Malware payload", "value": "e2422b16a37fd8cf608500a0282bcbbbcfdc360d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778708697, "uuid": "aacebd07-fcc4-47ac-8eb5-af3816aec84f", "comment": "Malware payload", "value": "2b3bff29e71a72a5e6e7ef6673a9c8ca0fe4cfecff7ecb229a86402752586f9690ef2b5de43c5ba3de93acea877ed74a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708697, "uuid": "a451ac84-7ef3-4c72-aac2-e5fc9e8d4e73", "value": "T1BF7385B6B60C6A8FB3A3195404399C475CACDD31B9F8B0E4FA5FA0A4F035D14926DBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708697, "uuid": "3616d134-fa81-438d-b937-cc2778b2243b", "value": "1536:TrGvy0E4PNIPMrzSh3tgW3tg0+s+2VCvFnRq/t8c0VMcGT3wbQGUb2BNUIcMV3wY:fGq0E4PNIPMfSh3tgW3tg0+s+2VCvFnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778708697, "uuid": "5ab8f8e6-33a7-4e9c-85e5-e3293e61be34", "value": 78464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778708697, "uuid": "fc629fa5-2ddf-4c14-94c4-d558c68f8bfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778708697, "uuid": "2a9b39da-bf92-460f-b497-dd8587852d00", "value": "13052026_1715_ADBC9-09931-289109-192.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5fdfa4-4f1f-11f1-a769-42010a9c0008", "comment": "Malware payload (DeerStealer)", "timestamp": 1778713130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778713130, "uuid": "493f4855-c1ec-42a3-a7ea-5670425538f3", "comment": "Malware payload (DeerStealer)", "value": "a616b798e873ea1feb632ca74020aaac", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778713130, "uuid": "106ad657-0951-406a-8104-a07fd8b9cfc5", "comment": "Malware payload (DeerStealer)", "value": "3b6ceb32c834f69500fba0a1c76a2362679ee42077ebedd2fc242537c4432941", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778713130, "uuid": "78d056b5-259c-4916-98c4-62aebfbe1a97", "comment": "Malware payload (DeerStealer)", "value": "b345b5192ff716932be4cd2b439289da0a65f575", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778713130, "uuid": "536f150b-ff42-4d63-be0c-8fc89920d006", "comment": "Malware payload (DeerStealer)", "value": "866d8c724a52dcf2a01909d76999f1613a82351229334f1a25474581911311d44584d838cee1a4ff19a2fba1a82f5810", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778713130, "uuid": "63236830-cbe2-4d67-89ee-ba0683aa2b11", "value": "T16D162A27D26D12A6D3E6C27DB10B67A3ED3A314426B5B2B315A25351333061CAF7C3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778713130, "uuid": "812830b8-05f1-4cbf-825a-434eee6c28e5", "value": "dc087b6d188be1d4ce16dd51f3db1953", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778713130, "uuid": "0ebfed97-88a5-4386-94c7-5e4ae631e6b0", "value": "49152:NgYF9ctqp18QFMJWuiWmIv73+yEx6iQvqhCjQkfVD15W6w22PzFHMFfCyEdAJgIF:Nf0/pTVe28bOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778713130, "uuid": "3cef85b9-73f4-4b6a-aae9-08394e7302d7", "value": 4302848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778713130, "uuid": "117bdd3f-0621-4d12-aefd-c16733df228b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778713130, "uuid": "ff05e7f3-ba08-46d3-8ad6-c0af788a4f14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe45dde-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682423, "uuid": "dd9eb149-c6a3-4420-84a2-6b7597a3bf2b", "comment": "Malware payload (Mirai)", "value": "097cc2da8664800df1c620a1c7a355aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682423, "uuid": "7376e135-9b75-45d2-956d-4603ffcebcdc", "comment": "Malware payload (Mirai)", "value": "3d3362c826b86a5e84f19faa5110fbcfc22b787dcba38a9d1ccb4c4046273e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682423, "uuid": "d1a11c48-7aae-4a03-9233-75be5eac8c56", "comment": "Malware payload (Mirai)", "value": "40cc349420289b620b463fd7d710330027fc3354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682423, "uuid": "c3896756-e22a-4a67-8e04-3e9ffdb8a3ca", "comment": "Malware payload (Mirai)", "value": "0407d99d13674d44718b43f00c6e960ba3928044f4ca98f3f1f7821dce1976ce139ef83c2aa39fb48f7121a0f75a0321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682423, "uuid": "12ee3ddb-d304-4f0d-8881-7d737fded494", "value": "T1CBC31849B8828F11D6D616BEFE1E1289332327B8E3DE7213CD146F2477CA56B0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682423, "uuid": "a88885bf-a5ab-4f1e-ade0-c6f41006f7ba", "value": "3072:HmYJ0FbnK5ktNKDuwZ0bzC+jYlp9vS0Tj3a71AwvPHY3ViBIYh7:GYJ0FXKD5ZuzCrlp9vS0Xa+QHYwBIYh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682423, "uuid": "1d12f53d-688a-41fb-b62a-8bfca141a9c0", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682423, "uuid": "0311fecd-ca89-45f0-9de3-3caa0c59e625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682423, "uuid": "e566c8e7-ecd9-424c-af58-fd47d5d29d7b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b3eb98-4ec2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778673325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673325, "uuid": "08600aa9-a0d2-4570-914e-bad49893188e", "comment": "Malware payload", "value": "0854e21fbb60982f9080edb2c5817ade", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673325, "uuid": "3de3b760-89fb-41a1-b6e8-2e974f9908cb", "comment": "Malware payload", "value": "3de94557b7cbe7e5b0000852011e9daa26381f2520a27b18ebc79c7c21fba006", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673325, "uuid": "fa5b89da-ce0e-4769-8ab7-81a91e289a9f", "comment": "Malware payload", "value": "a76f84a7ce073e7104de32e98a48487f9a703585", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673325, "uuid": "4cacdcb7-7002-4727-be62-ac34a67b9cec", "comment": "Malware payload", "value": "f2c770e085ecbf46f3d8ab1066c426d9be85a7190bf8213236edd9d9610b321f1dd415f215fb894fc4f72ce65f6170d2", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673325, "uuid": "8e791498-037d-4513-bfaa-a83973d92fb5", "value": "T118339E68DB329EA04195809D24E50701F0FC8867339C869CF725F9E96A9DEAEF53603D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673325, "uuid": "375b180d-8662-4baa-a99a-bf4d16c63c85", "value": "1536:cNh1t6poJhUdhubVslvayH4T+eeU/XISuVTXkNq6M/O:cNhLwodbVs9MrvIZkNDMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778673325, "uuid": "aded30dc-ec8f-46ca-8d84-eb6be184938f", "value": 52958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778673325, "uuid": "d323093b-2367-4f55-940f-64c7a60ea587", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673325, "uuid": "ab804874-f282-481e-8eaf-3ff3cd005f49", "value": "inuja.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2fa7a-4e9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778657714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657714, "uuid": "f62942b9-6ab4-4ba0-ab24-7b854c381a85", "comment": "Malware payload", "value": "5279c09bdabb12a3a28b0db8e838bf1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657714, "uuid": "a43927ff-2823-4bc4-b41b-14b4c79b278c", "comment": "Malware payload", "value": "3e5b62710a08bddd33170650ab185507e51d7062854ed308fec9649bc12c3919", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657714, "uuid": "56a4f25f-014f-4bc9-9eb3-554eef449636", "comment": "Malware payload", "value": "dcbd986d1b4b2c95fc3bb483c42f259e571a09a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657714, "uuid": "794debf4-26ed-4541-9246-efbe707ef6d7", "comment": "Malware payload", "value": "ce9359d265f5c2f6d21ef8dbbe1d75a56c49c58402cd3b925be4ed93e964740c4347ae2e885899fcfb3730acd41aee45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657714, "uuid": "17da3b1a-0754-4850-94d2-7fd6f4c14099", "value": "T10DE45B26B2F330BCC5A7C03047ABDBA26D75F46601126D7B22C4D6352D56EA01B19FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657714, "uuid": "128a350e-f745-4b2e-ab52-aebf85efb789", "value": "6144:cMS3T8dRhr8JjVx3hLjqSpdPY95e33Zd7drDKZnu77mmt0NXl/ys7HQbpyyGmhz6:iECHVP2e5JdU9Dl/ys7Hoyyth0EXzR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778657714, "uuid": "3b50564a-af0b-42eb-9359-3a6a3d1bb97c", "value": 715848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778657714, "uuid": "ad4c992b-c275-4290-95eb-3c723ab73038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657714, "uuid": "5bb9338a-c9b0-4422-a349-d16bb1f42174", "value": "sys_users", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bca212-4e6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637556, "uuid": "98bff178-2232-48f1-9aa7-a45a0669e033", "comment": "Malware payload", "value": "1554cbff8d036218472bf655806a56de", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637556, "uuid": "43cd6dae-5bd6-406b-b4d7-28bd37500508", "comment": "Malware payload", "value": "406ce35cf5dbd6db30dd8efc659c94215b551e84c9a822fdc361caae66938756", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637556, "uuid": "4d37adf0-529d-40bb-869c-ea7a01124724", "comment": "Malware payload", "value": "51cba503c582d06caff97d37d3b02d5b61fbcc3c", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637556, "uuid": "10dfa77f-8a9d-459a-82d9-ac7d4f0bb248", "comment": "Malware payload", "value": "12c3277c25976b1fddd7e5255d3241207603e15d3b775006847451ca256ac21384d0a28d23df537b684ca9f9c68ded9c", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637556, "uuid": "7ad7ee74-b585-429a-aa89-f60ae79eade7", "value": "T1B6B73339F4B5C6AFC3E95A78A6B01BD72750D34464A6BC13F96CC519EDCEA022B0078D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637556, "uuid": "8f5b4a84-444c-4b9a-88a7-dc337fc64a14", "value": "1572864:YwCCTJ2WmC0Yis0lh5Vw/D9sSKrhgyLvofUpyYy:JCCTsOisCXVw/D9snhgIvocgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637556, "uuid": "9ec70ea5-35d9-4c40-9971-905422bcf527", "value": 51437461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637556, "uuid": "5a7e2b5b-0532-444b-a96c-541773820f28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637556, "uuid": "faf50382-752d-45f3-aa19-0a266d578e8a", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20715b1-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700815, "uuid": "3dad9cb0-a46a-43fc-a977-e7005d17448d", "comment": "Malware payload", "value": "8cb289a7113ad22f6087eb2558b038a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700815, "uuid": "f79834c6-5d58-4216-b715-0f2a70391c25", "comment": "Malware payload", "value": "4171d455c5d92e5bce98bfb0b8aa138b05015add1bc1744bf5d54b94308940aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700815, "uuid": "aa195aca-00f4-4d12-851b-14b53ae4a55e", "comment": "Malware payload", "value": "937fb705954494e0add9cabe63da130567448ae5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700815, "uuid": "b3f540c6-e17c-48fc-bf6e-1a498b3cda6e", "comment": "Malware payload", "value": "04e28ebb6bac036766c06f617ccda7456f5b0b7950df22328b7a4df61649d1580d9c0db024ba0ab4362b38b909b32fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700815, "uuid": "a233bdcb-e15d-42b9-8acd-66c5956e1756", "value": "T16583D692FE81CD52C9D838BAF91F42DC3347036CC3EE75029E129A3566DF5994A3AE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700815, "uuid": "c8648a39-d59b-45da-ab78-9f9cac35fb56", "value": "1536:E9CNrNjY9TvjD4Qkx3mFMg7L68woSCD8PyKdlQfS7:RqdjM93mxG8L857Qq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700815, "uuid": "ee5e407e-9ce5-4a7a-8869-7dfed515225d", "value": 82356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700815, "uuid": "088650ad-cc6e-42b6-bf43-10cb1485d739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700815, "uuid": "388628ab-f4a9-4d33-b8fe-fa631b21f402", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c8ad5c-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778698638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698638, "uuid": "74b298b2-eef4-4887-bedc-ccbd924f3cf8", "comment": "Malware payload", "value": "12c4652a8be859e15cef3ba4556d5e77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698638, "uuid": "033ba077-2737-4bcb-87ec-ed3469e77d9d", "comment": "Malware payload", "value": "4284626f5e3d97c23262002366273090f3ffc65f2ff46451b3be14dce809d97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698638, "uuid": "9a96fbfb-5093-45ae-a176-b61b5b4778c4", "comment": "Malware payload", "value": "3efbb622c304088ee6556cfd08306a0eaab08356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698638, "uuid": "afdce087-2238-490b-929f-1f402822975d", "comment": "Malware payload", "value": "05ed735b54e84dbf0c7013df7903ea32ec3cd77c933efb277ebe54d1d1447bde6c136a4e62f070ba69ccda923c69d4ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698638, "uuid": "89f9d59b-bd61-44b9-81b9-d16318f7ed72", "value": "T104762A97B8924952C4E43637BCBE81C432630EBA9BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698638, "uuid": "cad67fd0-e647-4f5d-8a63-d41a43f19f81", "value": "49152:yvQ3F8K4V6I9k6QE3Qd9hjxw513d0+q04BOcSVP4GFsbmyWkdup5Ev+:4b6I9klEgd9hjxw51J4GFsKV/E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698638, "uuid": "9ddabce0-8413-4bea-8848-faf796c5f4a7", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698638, "uuid": "a9c225b6-d0a3-4c26-a86b-02a83ecd5e76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698638, "uuid": "09acc4dd-0cd0-4aff-b6bf-ccf8c60baab6", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650a8295-4eff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778699424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699424, "uuid": "d7b20a3b-f7ca-438a-aa26-4ab693b63b68", "comment": "Malware payload (Mirai)", "value": "b5f85c0c82c22e88b4429098ed5676a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699424, "uuid": "ba4be2d0-0f4d-41f3-8025-81464265133f", "comment": "Malware payload (Mirai)", "value": "44b341bf38fdd117213071e71574e97058afd67112f8f7ad1d08478085cbfd15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699424, "uuid": "513c63c1-c7f8-41b7-bc0a-9afaf8a86d36", "comment": "Malware payload (Mirai)", "value": "8974fc26003f8bf8d4b478d4ff8fe453a313894b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699424, "uuid": "ea84fc56-935f-4885-8fa3-45585cd908fc", "comment": "Malware payload (Mirai)", "value": "af2551d4c3d2b1b22810c90eea3265a305b3ae916a8f640f747447f078cffbb47156afa23b805ceed26b54a16f38148a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699424, "uuid": "28a640f3-5225-433c-b26a-8e4a139f4b2a", "value": "T175731260D0928E71D9E725A08E0015EFDF73586ED3EBED70DA012405FA368923BA8DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699424, "uuid": "afbdc8c4-5940-4e05-a857-4331ee246404", "value": "1536:lzxr5JFKA1IOulrPl6DdFDde4acWcT4roMWRKC9V9rh4u+qgw09p:lVzFKAmOAS3DI4Xf46RX4u+qgwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699424, "uuid": "6f8516f8-bf6e-4272-96a1-ec415fa0448a", "value": 75796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699424, "uuid": "7c6ce785-412d-4ad1-8aef-4b3a4e8cf70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699424, "uuid": "f5bcffa4-31b6-4c1a-bf07-4013af53573a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ec9746-4ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778677630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677630, "uuid": "09126c70-e50a-41b3-9046-494acdb7c6ec", "comment": "Malware payload", "value": "9706c2ea94eded5170d9271095452350", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677630, "uuid": "5c4be767-07a7-442e-8a07-6a664cdfe29f", "comment": "Malware payload", "value": "48b59f27da42cfe2d3b806a1c71cc8d8fce0441121a17cd8c1b30bf5e35ea776", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677630, "uuid": "d420432e-e9b0-4eaf-a5c6-3b9cc18fd196", "comment": "Malware payload", "value": "1891c4e9914bdd5bfe59858d02987f3e1047ce72", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677630, "uuid": "dbe7ef40-53af-4e5d-a915-5d3c094631fe", "comment": "Malware payload", "value": "1cfd896831add48cd0cb437179962a1138eea4417942645fccffd2677953c53b5be3a45b006bb6bf55117eae5bb16faf", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677630, "uuid": "f0535425-ec87-4640-aa92-e2f2e6ebd266", "value": "T1FFF312C6D976CE328E476190373DD878911806B0ACD6852BF7975CA3CBAF78EC810D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677630, "uuid": "55e0cc41-d969-4828-acb3-aea34f24fc32", "value": "3072:y/S0wiasJz6w1DocBUlFD+vzIBVht2eZKRlaGbowlZ8uCs56W6TCnW:yq03xhE7+0jrGNcwvIW60W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778677630, "uuid": "192dec9b-9c67-49b9-a2f6-7cbe1e6a2b63", "value": 167177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778677630, "uuid": "58195c5f-1444-4370-8226-5dab2c8bcd9a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677630, "uuid": "fba75330-4603-4e6a-aa1f-92cfd2558beb", "value": "Purchase_Order_75957356511.pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d62ea5-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682304, "uuid": "5b3a092c-f478-4ef8-ae44-455f9cff537e", "comment": "Malware payload (Mirai)", "value": "525c6b6180f72e2ff1ce4d271354981c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682304, "uuid": "25c21f7e-ca92-4061-825c-b31398f6e54b", "comment": "Malware payload (Mirai)", "value": "49479c9dd0e5ae5dc7ce881c8dc695989475370e577b84d80edec4420aa49be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682304, "uuid": "4ac62448-d290-4844-8092-dbdd587f0ddc", "comment": "Malware payload (Mirai)", "value": "b43f9a6c28d6888b3d1003c25467711c4f4082ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682304, "uuid": "e9767acd-0282-487e-b4c4-184d4745bbd8", "comment": "Malware payload (Mirai)", "value": "958cf14f8d396de26f644821a5fba5924c6495909b2d0190a62c5b0a2bb66426a67a8ca69bdc4c51225deb2595f01cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682304, "uuid": "d2df608f-0234-4c05-9bcd-e1718312e470", "value": "T102B3490379C488FEC4D5C5304A6FA13BCA61F41D12397AAB2BE0FF2A7A9DD601E1D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682304, "uuid": "57c5edc0-8a6d-4781-b7e6-5326fa304a5d", "value": "3072:C+lhMczG1DU6T5dAEy0KnZ7wkJNtHIzSiDP371wt:dlhMqG9ryvlQDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682304, "uuid": "bda403fc-3542-438f-b745-6e661015a880", "value": 116912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682304, "uuid": "459f3ae8-058d-4944-9e02-6865da6875ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682304, "uuid": "2033fbb9-822c-4a5f-b371-c42f0cc8959a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0946a40e-4e7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778642147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778642147, "uuid": "d5b3b66b-d1eb-4d41-b3db-6872376e5937", "comment": "Malware payload (AgentTesla)", "value": "82c32ffb327a0a2d20050d6db05408f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778642147, "uuid": "5c22f726-28d8-429a-b1c7-745e64354e0e", "comment": "Malware payload (AgentTesla)", "value": "4a4d0da0f8c4cd9a46178150f755a1348100b2c5b471874f8a898258c39a26a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778642147, "uuid": "816c0158-97f9-4813-9ed2-017d99cbfdb0", "comment": "Malware payload (AgentTesla)", "value": "76a487a95dd5aa6910fdb37aeafa824aa4edab26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778642147, "uuid": "49be1534-f411-4516-aa4b-1500dc14a176", "comment": "Malware payload (AgentTesla)", "value": "c54928af6050ed2e5f036f42afb86f5f47d5eb7a40a9d7812446ad8b27315e60627701fb69ac6b783b5ced2236a34e98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778642147, "uuid": "9b36dacf-4ab0-49e2-b519-07b62f39a41b", "value": "T1F9251258AA55D216DA544BB95D20F1B417BD2DEEB801D20B8FD8BDEBBD73F028D08243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778642147, "uuid": "777c63ae-01f7-4a6c-9020-afa4255658a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778642147, "uuid": "66431277-1fc0-4c62-967a-20c4c3a604d1", "value": "24576:/NlRUOfok9mqMueipkj7XroDsDdl2LgpFjhmPHr6xwD:l3U0oGmqCiQ7Xr/2LwFjEHr66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778642147, "uuid": "8e2e3263-51d7-40c8-a945-ad0ae4e715aa", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778642147, "uuid": "8b6b6373-e98f-4856-8ccb-5374a03daa6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778642147, "uuid": "2118bac6-9437-43d2-b22d-abbcff77fb3e", "value": "RFQ_Purchase_Order_Quotation_Forms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c633aa73-4eac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778663939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778663939, "uuid": "6f383b52-976a-4fdf-a017-2c47cb835289", "comment": "Malware payload", "value": "04cacbe2c91fff7670367e9be7390fcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778663939, "uuid": "e77f76e8-fef1-4a29-901e-abeb976a3f15", "comment": "Malware payload", "value": "4bced8b3aa05cf3dc9ad603663074d1d10b383f07c78064affc1ee0c5b90791b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778663939, "uuid": "5a21d527-8f40-41fe-a4ce-bb7b2d2a1502", "comment": "Malware payload", "value": "1f4e9ec22b68889d3e412848bb6bafde09fecc66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778663939, "uuid": "ad9c7f8b-d1f8-4abf-8392-2c78631eaa1e", "comment": "Malware payload", "value": "fec0d15a777cf0b345aa6a2a719f8cb9972bc76c953c7b4cf03164977cd94721859f47f38f4c05f35c28cc856504de69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778663939, "uuid": "a8d9b8f4-7477-4de2-af83-5700a2db0757", "value": "T1FDE43A59F8409FA1C6C43976FA5D86AC33174BB9C2E7720689254B343BE786B0B3B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778663939, "uuid": "6a0667ef-4846-4269-9e76-92c175b8acda", "value": "12288:lqSWS0XFpNeXiuF98bFCEB6JtDKCJfCuB/neDcGYbY805fg6pKOag:dDXxF98bFCEYHf3ZGA08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778663939, "uuid": "467c7c59-f3dd-4fc1-8e56-0464fa208155", "value": 660848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778663939, "uuid": "30aa1841-4e16-4fb0-ab2e-aae7620ae038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778663939, "uuid": "6fd054f4-7017-4fcd-867d-638fb0b07630", "value": "4bced8b3aa05cf3dc9ad603663074d1d10b383f07c78064affc1ee0c5b90791b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca02424b-4e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1778634310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778634310, "uuid": "babc8501-a731-4c18-8bd6-897bb7a4b1d0", "comment": "Malware payload (Loda)", "value": "a99cb838ce0cb9e891ee19b81dc6e683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778634310, "uuid": "cd39aee6-aa56-40da-8161-a30d31907b64", "comment": "Malware payload (Loda)", "value": "4c2fcbbfd4db7e673e816a4e38318efc9bbee1e25a657d086029c8603cc473c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778634310, "uuid": "ce36eec8-fc5d-4218-aa51-72b71627556b", "comment": "Malware payload (Loda)", "value": "650989fbc085e0ef45dcdfe8a0b06d693d664771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778634310, "uuid": "fdedf4a0-bbef-4e5e-9de7-3b21656cbf01", "comment": "Malware payload (Loda)", "value": "034a48fbfca0a8b4afdaa6b07822d766ae99ae6918ef60271d25912eacbf265f92fbab36f9284b482f512761925f794d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778634310, "uuid": "a85fde52-de33-4f4c-89af-07136d9d2043", "value": "T18BE63341F3952CEBDD137039C0228645C7667C322BB2D7631BA2676A1F573806E3B7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778634310, "uuid": "feeb73b1-de1e-4bae-9b33-95dfdfd6cf90", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778634310, "uuid": "bc552801-1db1-4131-a029-563915876750", "value": "393216:nqkLzrziKp6QsUaGEfLR1uxculjcbME9WIdQeF3MnG30QpPQd:nDXYQsfDj7vbpdQc3MG92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778634310, "uuid": "d1d30e9f-958f-4f47-b7fb-8f2086304d2c", "value": 14394861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778634310, "uuid": "d1950c73-64ec-46e6-88b9-45d889fb59b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778634310, "uuid": "797c6708-e631-42c2-89d0-132143f6e146", "value": "x4c2fcbbfd4db7e673e816a4e38318efc9bbee1e25a65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b34d6db-4f1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778710977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710977, "uuid": "6ad08e91-f8f1-47dd-95ba-51f63c5b935b", "comment": "Malware payload", "value": "c8b6de78a9fcf1e84c3ffbe025103469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710977, "uuid": "552b4279-b98b-484b-a1c5-271a61cddc0f", "comment": "Malware payload", "value": "4cbae5db3ef6f68ab30889f5a8575ea02f74e4bbe746b166879821bf365d407a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710977, "uuid": "6dea59ad-7c75-4733-b122-ab16a1e7dcc8", "comment": "Malware payload", "value": "80b97991e9a8b1cbcd2ff21dd2ebf85f6265b4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710977, "uuid": "e7efc7c4-2f4e-40ba-949b-a6fa21130308", "comment": "Malware payload", "value": "3ae4358519977999b2f6c1f07d3b69f7018b076f7a5c12a4dd290a18333f844103b88a6bd3a5deb8d5b4e32d1982258c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710977, "uuid": "85dfaa51-c818-4b8a-87ca-c6056102793c", "value": "T11208339E3070E22CEA4D2AFD17622B73F911C528D87328DD66F90776B1B105162BC7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710977, "uuid": "36cbef7b-f358-426d-afe9-82f4c2775651", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710977, "uuid": "7f55c886-4383-485c-bc65-8a7ee618a285", "value": "1572864:Lt9IKPL65y5FvjN9eeTiSSD2aNXmsiCoNPPVzy0Lmc0/7:LUKe2FvjN/uvqWWjrVzy0ab/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778710977, "uuid": "6cf8e75b-3dca-4d19-afd4-c2182ba5e628", "value": 77593357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778710977, "uuid": "2d45fcac-4e3b-434f-820a-5df6a1ae8f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710977, "uuid": "7a65b2da-d08b-497b-af41-e83c621d5e93", "value": "activator1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c18afd9-4ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682739, "uuid": "892b1234-3a96-4bae-bf1f-42a8e2ff6032", "comment": "Malware payload", "value": "cfcd031aa3c5215bfde8338912f75875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682739, "uuid": "74b8fa9c-1385-4b24-8d02-f909e67dfb28", "comment": "Malware payload", "value": "4d6ca51fc7742f1d24f33edde514ce413db23688b7ee1064faf0cc689c39a39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682739, "uuid": "74d3d749-9757-4c6c-9fc2-889e0ed2f966", "comment": "Malware payload", "value": "00f26d8236e7c5c2d0247f70fbf452924ac69fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682739, "uuid": "1536944b-d7b3-4c1a-be05-8c7c76662758", "comment": "Malware payload", "value": "931edca76f2d0dd4b4df515a60baf5e4248bb67bd70eb0c446951d541c4506818f3ccf7383c858421eb28d64d942b66b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682739, "uuid": "d23478d2-2b25-4472-9b4b-85078697732e", "value": "T1FDD4AEBB76534E12E3885337C4CB884093BC978675A7F70E358413A75A033AEDE466A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682739, "uuid": "bb89162e-57f1-4896-8b9d-249d1ed75a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682739, "uuid": "732da6d7-028e-47cf-a2c9-1bc34c489d5c", "value": "12288:lgixe9zO+UE74o54qmxs30eUGrcxSgU6Hvv6vFEJ:2icIosqza4FE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682739, "uuid": "e4ccdf37-fcc0-4d2b-9db4-469aba637e13", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682739, "uuid": "99dc0153-6f1c-42f8-81dd-684a8428ac7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682739, "uuid": "21a016aa-f2d5-4cff-bc1f-baaa154e6746", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.32672.18374.30454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8043dc25-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700758, "uuid": "b8812f61-cce9-4a45-9413-499f40df91bf", "comment": "Malware payload", "value": "09c50c33c99809adc4490ea621b29588", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700758, "uuid": "0c0891f3-dea0-4824-a744-e0d5a64b1468", "comment": "Malware payload", "value": "500592a2cfd2536eeac2bd102bd56bb2c5f5fb4aff3c15239c6b9b8113c5f2d7", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700758, "uuid": "96486d2f-3e81-4b91-ac78-50d2cba14c51", "comment": "Malware payload", "value": "bf99eead4337843f2865d6622c876e2041ce3d3b", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700758, "uuid": "1a19a460-cf7a-47ee-8e77-d357ad1e1a3d", "comment": "Malware payload", "value": "ba4c262fee420dfef1a4642d00040c143f22fc24e9533c19d17fc7025ee9a00553b2b904c60f37a21ba6202e003ad768", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700758, "uuid": "91fb77dc-1922-4b6c-a2e1-44398a43500e", "value": "T150057C1282EA15D8F2B75F6C6EF421584627BDB21C3E918D11844FAD4BB3900CEB5FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700758, "uuid": "a2a8b196-de66-4851-b70d-494d3613475a", "value": "3072:XGarS34OVwRSEu6VbX/4B3VjV9MNATNRnE25YkYgG:1r6o7VQNRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700758, "uuid": "5398b09a-ee33-4bda-94aa-6c2fa496243f", "value": 796356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700758, "uuid": "97c9e3f0-be77-4369-a8f7-741c656f8977", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700758, "uuid": "5bbb9bb7-1449-4775-88aa-84ccd2999d3b", "value": "Sales Order - Order Confrimation VTR 1000030878526 - 0061-27-EXOL-Q_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783290c1-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668532, "uuid": "df2e7729-dd6c-41c4-8410-6525b0c9e187", "comment": "Malware payload", "value": "72c16f094cb58b2c06aff72449a60367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668532, "uuid": "163ef1a4-8b63-44df-9feb-bd16169d7d7f", "comment": "Malware payload", "value": "506ac5f5fd9119e161b1a698f43a43bc2dd8c35b7f5ee92e62c35008d91de30d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668532, "uuid": "2b504104-0621-4c5e-8878-46cf4fa7c030", "comment": "Malware payload", "value": "df673af79aa73b67e433c9cb0d1386e9a4a91197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668532, "uuid": "7a533a07-c2f5-4271-a893-92ce0245a26e", "comment": "Malware payload", "value": "6582b065ae482ce117d69dbc2e234e65ba9e2d2f1f794a94986419510560ba2dbf19aaf05e8951f0068e7e4a8081ace7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668532, "uuid": "836b2e8d-a677-4119-b355-8ffe31e630dc", "value": "T14734F13628B82F18D4636335B1071F3196F59B1F3B7A129DEAFE47B5B1A4A0119230DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668532, "uuid": "8cda2c61-d799-46a7-85c5-21f0f6ddee01", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668532, "uuid": "dabea60d-8590-4e15-afc3-c7e45871d5db", "value": "6144:zMooVQnnOBccnskYPmTpUxrr1XRA7WHxWoN+J0EafCUSYibN6WGN:UQnO/s1mTpG5bUo4bafVibvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668532, "uuid": "202f927b-f189-48f7-bba3-bcafe4d3594d", "value": 252834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668532, "uuid": "724aa74b-381e-4c9e-99d1-decabccb9b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668532, "uuid": "351208ac-664e-4b70-9b28-132c44c41a27", "value": "506ac5f5fd9119e161b1a698f43a43bc2dd8c35b7f5ee92e62c35008d91de30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f7d4c5-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682299, "uuid": "e9fa019d-7053-443a-9d0f-28e938e7f70b", "comment": "Malware payload (Mirai)", "value": "89fbee8c2b97be75162e40149756a675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682299, "uuid": "6f548b22-0bc8-450d-80a6-f26aeae1a333", "comment": "Malware payload (Mirai)", "value": "5074f9ededd32b17db838cded131cebcdaa28f2ad67eca6f5af1aaad7702ff66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682299, "uuid": "70214235-39ee-4ea1-beda-39e5937465d0", "comment": "Malware payload (Mirai)", "value": "efe0faec1da15180c123467b20361d4a8e6959df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682299, "uuid": "09860967-277e-411c-9bdf-850219840379", "comment": "Malware payload (Mirai)", "value": "8a14888282f084ec1dee5c3792e99aa8a2bda76b71572c56ad4d9ba6c948fd6b12a4a8a8dbdfc4b2af36429d73077293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682299, "uuid": "586bccb6-38f3-4c8a-9925-41ecaa11cc20", "value": "T19DB32881BA8BC0F5EA1B4D706167F23FCB3199250036CFAAEF549F75DA67A80511638C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682299, "uuid": "f860ae62-3708-45aa-ba04-822fc6c578e4", "value": "3072:HnkE6E8bWIfIIBDrbZ3PO4jRFsJQzlhh5SIe:HkE6xgkDrbdPO4jRFD/uIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682299, "uuid": "45f8f0c0-9ec9-4d70-bb13-fd4f2e0d851d", "value": 111924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682299, "uuid": "7c6915f2-ac9c-4712-93f8-a53dca8759f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682299, "uuid": "ad12b028-1c60-44dd-bd22-1318bce09c2d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7c1fa4-4e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778636109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778636109, "uuid": "ab74de02-8833-42e0-b3c6-a9ee98de6035", "comment": "Malware payload (njrat)", "value": "175348b088c4240e5e21ee5a6cfcf2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778636109, "uuid": "e2d553ee-3538-4838-8ff4-5d0cd64952c5", "comment": "Malware payload (njrat)", "value": "5351806e16036f24f03effaa8918cfe998261fe26502c666e493009ba437e864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778636109, "uuid": "2dbef585-38f4-48e4-a1cc-b37fc0a498da", "comment": "Malware payload (njrat)", "value": "c830a18741fa5c4b0680f2470ca74a6d70bfae54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778636109, "uuid": "71284751-4d8a-4477-a3bd-98438006a838", "comment": "Malware payload (njrat)", "value": "fa9a43ba5cddedd0ed4145cc21c17ad93e9b1f673570621ed116f916dad670f3ca80e0842b7b73a92d2b01203160fc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778636109, "uuid": "589801bd-a699-40e1-8aa4-19db3269b107", "value": "T1D193D94D37F550A9E2FD4AB3A87173404FBAF0471642938D49E1A8761A33AC88F58DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778636109, "uuid": "c6ea7dbc-68f7-4eff-bbf9-6e042a66ea62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778636109, "uuid": "48f1dbad-c6d3-449b-ad6b-92ee6d11e8fb", "value": "1536:I9kwA812QyD6i+Rv+4yOi9kW3LR1FpZv:YkQyD6i+7yJx7RhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778636109, "uuid": "207ef9c6-d507-4df0-97e1-5637dec8d1cb", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778636109, "uuid": "a11417da-d545-4536-a596-6df7ef9eaf72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778636109, "uuid": "d1f46ff4-784e-43e3-98cf-930bac7cb95f", "value": "175348b088c4240e5e21ee5a6cfcf2ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca18a4ba-4f0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705606, "uuid": "75cc06eb-2011-4998-ab43-4c0470668ad5", "comment": "Malware payload", "value": "415bb341906ae36f16d842466c001f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705606, "uuid": "aca8584c-b29d-46f5-a8ea-c85bf0e6b863", "comment": "Malware payload", "value": "56dffc636aa06a4a6c000f8cc1692b5294f35fb890be81461e5ddcfd678e0b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705606, "uuid": "4ba54270-e16a-40a1-a49b-f11f421ecbd3", "comment": "Malware payload", "value": "1535deacd449d016fdb39ded8b21a90342350f71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705606, "uuid": "b9239540-447c-43d4-92c8-b493d7b23bc3", "comment": "Malware payload", "value": "ed65550f19f331acdce39105fd79d7eada750125783f872a057d15568d9b2bebce5a0972182c85740918781b13831352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705606, "uuid": "bb88ef72-bd9e-4491-84df-0ed5b5adb2fd", "value": "T141838D808C1DFCB3CBC6B47D4D480E50326B7CF42678D74A0A25668EDC49A586FE5BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705606, "uuid": "d1b87527-1620-469b-8248-22a52edb61d3", "value": "1536:5I0rNXsKxIgE9wDBmT8i1Jt7ZZ8OAIbxbm8/V1Wf1+gv/rmbpx69:ycxsKlBrA7P8Ol0nrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705606, "uuid": "70b13ec5-d03d-4d53-a793-5488999a3750", "value": 82928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705606, "uuid": "753f8deb-f528-4981-a17e-97dae3607891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705606, "uuid": "5745c8fe-c706-4d3b-ba25-e9c75a6dee13", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e4f169-4ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778677662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677662, "uuid": "f0b35961-3b02-4d59-b597-cbb6cb27552f", "comment": "Malware payload", "value": "c4eec2af0229198d2e772dac28de76ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677662, "uuid": "9f0d7ed6-0657-47a7-b7cf-9764f1d7e5b4", "comment": "Malware payload", "value": "579085581348296ae88419296edc6a8e91acf4463c7994112b5c3f7f3653710e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677662, "uuid": "e5121791-4411-488a-88b7-74974d6b0d5c", "comment": "Malware payload", "value": "b10725fe978fdfbc646a3147c584cd4397f6f5a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677662, "uuid": "12cad6ff-e6b8-4880-a117-7bc765e73e36", "comment": "Malware payload", "value": "eba8f39ad01c3af5ca64229ceeaeeea0f9affabb5af8865209cbe90e055bc08f32e33c96bf69014132e7c495694b63fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677662, "uuid": "f1274c41-5586-40e6-84a0-cc1221f8c354", "value": "T15D35DA6AD7E9000DF8B69B54AC75405FA47ABF1A291DC85F11C0054F4EB2A08EBB973F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677662, "uuid": "4745fadc-0a6e-4a1f-8fa0-2b98ab86aea9", "value": "6144:5h13pw5tQghoPmaSxGy5xrYm5bISODG/T24Vd7Ff3PXKFg/gP8vrlN7/8igURFgP:9TgyeaS8crYiVODGqSrPXbcibL8i3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778677662, "uuid": "8b0e993a-a424-4b8a-aad2-5e09af4c5e16", "value": 1102894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778677662, "uuid": "94f44802-8277-4972-a049-28978b80973c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677662, "uuid": "3e17bad9-3143-4a23-8913-700d6a17896d", "value": "Purchase_Order_75957356511.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1845836e-4f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778704020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778704020, "uuid": "7c0fe5a0-5aab-4c01-a780-9b13c33d6d2f", "comment": "Malware payload", "value": "76fc44e3dfd64a962974640d8ff56f21", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778704020, "uuid": "936d7861-b662-4545-8e2c-a176cd53bae4", "comment": "Malware payload", "value": "5895e1d4f2543b3d69730458420c4c0e7d3a5c30574f2b07c072b81cc3ece38f", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778704020, "uuid": "2c90be74-7db2-474b-8937-ae88dadb0c4f", "comment": "Malware payload", "value": "98c7c4366da2c5d70aa07f49213eecb8c0f4938c", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778704020, "uuid": "6076e901-12ca-479d-8182-25d78528e9aa", "comment": "Malware payload", "value": "bec2acf874cf1987ae44135058c34c78fdf277be85d9e22449141a29f9a7c38d9f6a301c8d1085cf5af646b1df17620c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778704020, "uuid": "b04e1f75-2454-4384-825a-8aecf526b006", "value": "T1B0E6235A6AE345E9C9C212749F1B5FF516F64A6143CE88BBA4C7308470A2FF3922F147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778704020, "uuid": "78505124-b612-4c9c-a4e2-8bc1a34b50e4", "value": "3d4bca118ee7c1aad1dd25889f242d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778704020, "uuid": "5dd42f55-4538-4c23-8a69-54a67f8c043b", "value": "196608:exZF1xIPvMRxpEM1AloirPRBWkdVI8wVwsMxn4YbIi2jdk4WbsWxiT9ytK:evFjjkVIc1xA64AYTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778704020, "uuid": "0d0e683e-79ce-4342-835b-fad0690c13d9", "value": 13891072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778704020, "uuid": "53028374-dc72-4bd3-b070-344bea5ac92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778704020, "uuid": "dcb6fea2-f960-4674-9b09-4c97465dc734", "value": "20260513_164908_seducingdelirium_surf_5895e1d4f2.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d123cdbf-4edb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778684143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684143, "uuid": "38eded44-448f-465d-9281-31fa894af442", "comment": "Malware payload (AsyncRAT)", "value": "7038b2ea574f055efd1ad93d49c76b41", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684143, "uuid": "3bccf401-1230-4db5-9a98-b461e825171e", "comment": "Malware payload (AsyncRAT)", "value": "5a691bae899ee992b6d0181436ac668f6195e3d459777ed9e49518b37c7305c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684143, "uuid": "d997182d-261d-4308-88d0-2b999ff88530", "comment": "Malware payload (AsyncRAT)", "value": "7294c3ee7ff410038203eb817c1f0418ef6f34d3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778684143, "uuid": "ecafa811-f3e3-443b-8fc3-d49c85e1d23f", "comment": "Malware payload (AsyncRAT)", "value": "26cfd41ec4b8219036f03b5a10235011788a640f44a17adb3bb914a1bb3ea92c069ec65094df67a421b1cebc799aebe3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684143, "uuid": "0ba6510b-e9d0-48eb-8962-afc8ad5fa8a5", "value": "T186D22B0473E8C665E1FD47BB883396008775E9574953DB6E1FC890AE2A63BCDCA14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684143, "uuid": "f14562eb-bd04-4132-9ab2-e8566141c69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684143, "uuid": "5dd32054-f824-48ed-b90d-05d78c1bb06e", "value": "384:ap0Jr6RkT55RA2mzSQloy3Kh6h4XIyH9qbuUscC/QxnCJfJbndnjJ2T7ue9T+:a+Jr9FLbkS+fKewIb1xBibnKnue9T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778684143, "uuid": "63dee98b-02f3-4c33-8357-0f9ab7bec1e5", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778684143, "uuid": "68acdffa-513f-43f1-9ba6-822a45c77da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778684143, "uuid": "6d44bf0f-dd4d-4c15-b69b-2a8e6cdcdacd", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f62414-4f0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705735, "uuid": "32e59801-e16b-4946-b0d0-fff21d9ea9ad", "comment": "Malware payload", "value": "1444bbbe164b7bb8292c3a168219aec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705735, "uuid": "a6775cfc-77f8-4172-994d-e1df420a8e4a", "comment": "Malware payload", "value": "5bf8efabc8c725c111f1eb0ae4d52a09ad51ba976b4c8655accfd1ff1a9e391d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705735, "uuid": "4920df60-1909-4aa5-b9ba-677f1dd02131", "comment": "Malware payload", "value": "3e635029abc00993a45f7313feb524808be49d4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705735, "uuid": "16c2fc47-cf99-446e-a7b0-053b4066f60f", "comment": "Malware payload", "value": "e812f94430b34f7ad14c8e365d51cbcdf28829131418dee7306d7092b312eed86c04a46642315ce905d3deb463c89e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705735, "uuid": "72a785ed-1146-4f3e-b795-9a8f66443cc8", "value": "T133730991FE81D952C5D939BAFA5F41C8338303ACD3DF72028E019A35A6DF51A4E7AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705735, "uuid": "937ef9c3-e533-45b6-9f85-25b2b0107d19", "value": "1536:GwQhrNjQGv5g/VtQfSv+vkIpWqW7LuxvFi1wWOS/Z2Qxqb7:GJ5gNKVMi/8utFuw0Rqb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705735, "uuid": "99131ba7-ebfe-493b-851f-95dc5d924228", "value": 80436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705735, "uuid": "1ec9bdfe-05df-49cb-8111-ee7e620d09ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705735, "uuid": "c6ceafb9-62f1-4491-8158-ab44047fff10", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc78509-4f16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778709505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778709505, "uuid": "0c5bb547-b2b1-4d8f-b1ab-4c68ff73602c", "comment": "Malware payload", "value": "3df302111e7155edc8f3149070cfc26d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778709505, "uuid": "c2569e48-c53d-46ef-a928-f95c2e566271", "comment": "Malware payload", "value": "5c1652d6570d3a229a8eb491391e4bdf67e9358a8720b17a9b8f451e58413eba", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778709505, "uuid": "daf69371-037a-4c32-93eb-13148a381f2f", "comment": "Malware payload", "value": "e30db0bfcc3f48ea4c82e736e3cb1442662060df", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778709505, "uuid": "bdec015b-9c4c-4be7-8ff0-ce2acfd30e15", "comment": "Malware payload", "value": "1e1c0f259dfddfc7075a7084d31938d28252ed5c5a43f935d29c3cd9becf5d73aa7fe21c2c98c1cd2029fee59821cb94", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778709505, "uuid": "a0e0a6c6-ea7d-4e6c-976e-b8b805be9408", "value": "T184667E3BEAF88D9AD0DB737181226600FC713401CB2277D79AD1B7182E67AD059BEB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778709505, "uuid": "a5e250ed-c290-4dab-a98c-475fa533348c", "value": "2d1a2a3b2edbe3e08125b43db0ee5897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778709505, "uuid": "364a027c-61cf-4b93-9112-d9ca017af355", "value": "49152:SGJ8+Zjd4IqLnka1O7kVun1czkG+ntC4jhU/d5bhxHJFvUApzBFE01jiZNajzlDi:SGB63LLOEsqpTpFv5Zyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778709505, "uuid": "5f03f741-a862-484d-bccc-d8afc4c4a4e0", "value": 6860800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778709505, "uuid": "718eb1fa-5405-4499-8118-165f19ebbeb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778709505, "uuid": "0e56deac-5b60-41cc-9cf8-a023ef3cf38d", "value": "20260513_213832_packetdistributionmesh_wiki_5c1652d657.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b76d0-4ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778689958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689958, "uuid": "4e0de3f5-fd6f-4a22-9c96-46dc757ceb90", "comment": "Malware payload (Mirai)", "value": "d58ed5775415768e36643c93b5259217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689958, "uuid": "dbe52a33-d672-4f01-bc3b-06212d27d6af", "comment": "Malware payload (Mirai)", "value": "5ff9b9c540f3862d22329e6c846b1b0582d0cdbec4809ffdd5e94bae4b8fbd29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689958, "uuid": "19fc3339-0a04-4827-b6ec-77f0a83b687a", "comment": "Malware payload (Mirai)", "value": "69f1d8a1941ec02b204f5fba97284af80bd90950", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689958, "uuid": "350118c6-f240-46d4-8ca3-32fc34dd7720", "comment": "Malware payload (Mirai)", "value": "54b461c63dd9da2bd1abdf653c25a2d0a001ba7c859bb04b11d3389cf60256980e695e9116c856906f103fb6f37a0e73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689958, "uuid": "2d6c70fc-16a2-4f55-baa8-fca9cdd3109c", "value": "T155730268170F90A2C90833BAD9D8949737959AF005ED7853B6D8BE287F85C4FD8BC10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689958, "uuid": "307357e1-9ba7-46c8-8c2b-746fa99d2c85", "value": "1536:b9VWz0x5imcCiIo1YId2ADJnL/bbc4tn5xkAlbaV5nuwjjdaW45Rozzz:bBimxGYId2ANL/HxfrMVXjjdN45RAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778689958, "uuid": "cea85632-b5e0-4999-8e22-fa5f2d40678b", "value": 75656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778689958, "uuid": "c5ac0171-2b4a-4357-8489-2b682d07b7a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689958, "uuid": "c9be8c98-885c-4036-a5f2-f3c6ff4b3b66", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b031f5-4ef3-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1778694511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694511, "uuid": "054ef84e-d00c-4efe-aa8b-83df1b95cc4a", "comment": "Malware payload (Socks5Systemz)", "value": "52eb919cd2019919049d8371922ac41f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694511, "uuid": "09b8377d-d3a1-4138-81ac-534db1c521c1", "comment": "Malware payload (Socks5Systemz)", "value": "60a1d51be7283a1985ea6c06fa33a03dd33760a7682ddc428bbc799ebaa5b24e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694511, "uuid": "738d5491-4fc9-40e9-8319-93896553f3e2", "comment": "Malware payload (Socks5Systemz)", "value": "483f431ce1e4395913023ef74ecfb23507391b7a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778694511, "uuid": "dff7d133-9c92-4c53-b85e-35c40e23a037", "comment": "Malware payload (Socks5Systemz)", "value": "a86ae123a657127f2580def60490f011bcc5456a80592b21c1845c8958ff263ae8ffaf7bb87f156472b9f8b0bfa4e0de", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694511, "uuid": "b4222f35-d69e-4837-b3a7-82e94f526218", "value": "T15F063347251BD4FDDC7ABC744C35C08ED8633C6268BC61AA726ACE6B9332521DCB5293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694511, "uuid": "dcde5f3b-e463-4603-886a-95fca7e2582d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694511, "uuid": "e463c2ff-d44b-4bf2-b102-2a1c262d38fc", "value": "98304:NEQr/TTFHhb/Pwc6AsyUw/R2T9wbcHlOMg/1KvpdT4:PPpBccUyUw/SWq/I9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778694511, "uuid": "144ba981-285c-427c-8aa2-c0621f9adc9b", "value": 3661262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778694511, "uuid": "0ba49881-bdac-4ad4-96e6-2e3c98c5b1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778694511, "uuid": "1a53b278-5283-4741-b5aa-5d2f7b0e4e3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7caa6-4ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778678809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678809, "uuid": "b21411b0-a558-4996-9b28-e79034afb811", "comment": "Malware payload (Gafgyt)", "value": "4268a72c1a8e0b2d7a22a289ce891dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678809, "uuid": "58817ea0-2513-41bb-862c-1c66469f18e2", "comment": "Malware payload (Gafgyt)", "value": "6220f7627cf9b1b451935f8ebcd677bf4fe1164e2e23c80dbf0cf896a5fb4e35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678809, "uuid": "568b57f3-f162-421b-9f66-98574fd4d5f1", "comment": "Malware payload (Gafgyt)", "value": "faff114b925ab243820f009432d4df9e33b81a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678809, "uuid": "2150fc9e-b9da-470a-96e3-7c6e4d547699", "comment": "Malware payload (Gafgyt)", "value": "ba4deafdce55add5e7638b5f5de7f5203c27efbbc10f03c2db0d64dc7bbc9b33e2942be97a2acac4f174d86057c5ebdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678809, "uuid": "7c456737-b9d7-4dcc-be1f-397218735b75", "value": "T12E735CCAF7C3E0F4D94A05711227A36C8634EF165018DE59DBB5BE72DE32611A21BB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678809, "uuid": "6ae6f8bc-84c0-4bd8-9867-a4bd5e4610e0", "value": "1536:BtLFH+BPWytIDhkfwHcgUe31M1Rf0GoFK6CP1BDbT6r:BtxH+BPbtIDhkfe+j4xCPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678809, "uuid": "83b27689-4d9e-4329-beae-5b7f84eb879c", "value": 74816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678809, "uuid": "5dada2f3-d55e-4aec-bc28-b0cbae26422f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678809, "uuid": "017e2585-8f88-4974-b90b-f77f2c774ad9", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa90258-4e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778639661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639661, "uuid": "0f1b6928-76f2-4b14-8977-4613744bca34", "comment": "Malware payload", "value": "5a124efcf931373747aeab4199854d49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639661, "uuid": "18664676-cac3-4fe4-8779-70a0d1297278", "comment": "Malware payload", "value": "6356a12295738d0badce36a73faa2051778f2c5368e70393a042942338846cbb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639661, "uuid": "8d092770-3a95-4fc0-ad9a-72047c8637ce", "comment": "Malware payload", "value": "34cef18e4e1a3a81f893e32289cd709babc25dec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778639661, "uuid": "baa0b2d7-e61d-484c-b7fa-9e4bba1f67c6", "comment": "Malware payload", "value": "43f16635ce979c707af6e3cda2d67cd0845e9294ea0a345a80306580106a7e46aac88ab3e815044460a34bd4dae1c2f4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-coni-co", "colour": "#191FD6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639661, "uuid": "64f94ffc-35ef-4107-88f0-62ae74f80e40", "value": "T1AB965B75AB1013E5DF4396BE4E03E7F6EE6991006221246D628FC647DA438EC4373E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639661, "uuid": "84fc6a36-a599-4deb-bbf9-ab9fb02d3b1f", "value": "296befc1d5813ad1f4da38226f6eb468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639661, "uuid": "9355270d-ff3f-4e4b-a241-ff620a6e5ac0", "value": "98304:TG09u11llq84g2elwzVjmLSpUTLGI6xoPDAg:TG09u1sbg/wYLwULV3Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778639661, "uuid": "30e7b44b-0672-467b-91eb-701a3889d861", "value": 8835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778639661, "uuid": "264f6e52-6178-4a99-ab41-86b397484baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778639661, "uuid": "514f572f-fd30-472e-a9ee-0f8e12dd240a", "value": "199503092023212028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a23806e-4e78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778641289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641289, "uuid": "1628bcc8-df92-471a-8b64-c28b85f830b4", "comment": "Malware payload", "value": "65416a052ca96c3f6d7efb4c3f7b7c95", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641289, "uuid": "69eed4e5-889f-4184-a411-e10f39bc5634", "comment": "Malware payload", "value": "6376bcd8faa57aac7437116b184967a588025e2bf96318272cdcf51ff2f8dfdd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641289, "uuid": "22bfc0a4-a245-4234-9c16-75f95c5367b3", "comment": "Malware payload", "value": "9dc2d5e617659fb6114ce468ac79bb7a35b2e39b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778641289, "uuid": "1ddbf0aa-c22b-4c58-a6dc-f82a519f025b", "comment": "Malware payload", "value": "0146031f95b903efca48b6eca3c9c7a50500669922e7702a89743f760626c42d32c479423847d8704e28e80445d0e273", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Konfety", "colour": "#E19525", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641289, "uuid": "0a514480-9323-4342-867a-139de220999c", "value": "T114E50218FFDA1D3BD8BE52312D980266E231DEB2DB4AD74B250873692CF71950F52386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641289, "uuid": "4b9cfa7a-8569-4125-862e-e5f2f05be2b7", "value": "49152:xac3k5NF9xFA26mKcIrNdQMwadYkv64eZSHjMItZH/2+RCIG1nkiMjmdHL:xac3MNRFV6mlRMwaX64eZujMsO+QUFjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778641289, "uuid": "aa1338da-118d-49d9-92fb-9f2d4e0258a2", "value": 3062539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778641289, "uuid": "14c13d18-e1c6-442a-a516-1f6622ed28b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778641289, "uuid": "dce6a39a-fcbd-4e54-81c9-a05be56ac097", "value": "Downloaded.files_file_2632_1.apk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7d252b-4f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778707434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707434, "uuid": "71357fe2-4021-4598-a427-3beda9d1be5f", "comment": "Malware payload", "value": "8e829af7c9d8a998bdb15d771b784d28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707434, "uuid": "77c16c2f-aecb-4bd2-ad33-f82ba337f473", "comment": "Malware payload", "value": "65bec8464d28744402af146ed23b8a3509784fcbcf34f6a21cde6929c3f893ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707434, "uuid": "bc5066fe-5e67-4643-b832-cd6bf6ac367e", "comment": "Malware payload", "value": "228a779eaeecb2701eda074fe6e118b2bf2fc383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707434, "uuid": "c52904c9-ea08-4c40-8349-1321ab476a8c", "comment": "Malware payload", "value": "e5f12f2b76b4c294c36e7e756d59d56c1f87e169444d1326a4297c9c90a0ff933fd3bf3536d8c4aff9b37301c5b3df98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707434, "uuid": "564d161f-e560-47b7-ab54-539ac6a779fd", "value": "T1D2932A50AB040D7BD4F75CF4047B0328BBD56BC702E998160929EB435BB1A73674AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707434, "uuid": "0316e230-9c3a-4393-94f0-f574850b425e", "value": "1536:/rTnYBiwSOyQJvkKVc2LbqyjFe+ZJie0yI/wSa18JrkZz8dLtTlESx8n4S99PW1g:zTnuvBc2nqElZJ4e18JYZKx5ESxQag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778707434, "uuid": "b3378bff-6642-4782-b78f-2f5977ea7925", "value": 93092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778707434, "uuid": "910e64b0-771d-4053-8fa2-9b464b0f25af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707434, "uuid": "99171575-b26f-4d96-a8bf-a3e864aa843e", "value": "SecuriteInfo.com.Linux.DDoS.2637.8431.21820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27714ce6-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638762, "uuid": "2cbf63e0-4243-47fc-a13a-2fb756841ff4", "comment": "Malware payload (Mirai)", "value": "30d04664a0e91ec11564ba2db033175e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638762, "uuid": "330138a6-c82c-410c-ba16-499523c63fac", "comment": "Malware payload (Mirai)", "value": "66eac6515be3b6ded07874647325ba1583ca6bf1c04794b653df06e99e7be4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638762, "uuid": "0af82820-f8ee-46d3-a368-c3a6a012379b", "comment": "Malware payload (Mirai)", "value": "cfdd6336550da1afb42f88e4bb5c7668d97f61a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638762, "uuid": "0d221b1e-f884-49d8-8f1b-ed56e318ccbb", "comment": "Malware payload (Mirai)", "value": "924b6877ea610b36af38da6844520eedc7920e35fff9f332f8ac5fe2a25ba98e87289f462cc4ad927a3177617120fceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638762, "uuid": "47c99a94-ceaa-4ba4-8ac2-936cf185b63b", "value": "T135937D85FB83E0F0DD0609B011ABF7798631DD362024DD6BEB98FD76AD326129116B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638762, "uuid": "d3217e74-dba2-4e24-b74b-cf59dc3009b6", "value": "1536:JUj89KwKFRAXmDsDDCczf7J34z8GGoYqoB8w3vUX31QUHL6kjyXr:w4KFRA24DDCczf7J34IXOui3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638762, "uuid": "038062e4-ab3f-46f5-98bf-db73a41b598c", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638762, "uuid": "93f6814f-dd5a-4a8a-8f48-15ee8af1212c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638762, "uuid": "d7e92236-a331-432c-a771-c8bace6aca3e", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7342bef4-4ec5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1778674537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674537, "uuid": "e93cd694-d3df-4706-b57e-a4cdd8705086", "comment": "Malware payload (DarkTortilla)", "value": "ccf19e127c0b8f65ca072df1bd801924", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674537, "uuid": "5e84efcb-736d-421f-b3bc-de35db4d8b0c", "comment": "Malware payload (DarkTortilla)", "value": "67435818ec3ccd9768649f84d5753d7130b7833333beadbd4b5975e3eb08bdeb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674537, "uuid": "dcd2986e-cdd0-4ef2-a056-53a28ef43fb6", "comment": "Malware payload (DarkTortilla)", "value": "4cbfd74155d5d6f9a96a3b2efd06f99fc9109b84", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674537, "uuid": "35c39374-16c9-461f-a2ba-33df593817c0", "comment": "Malware payload (DarkTortilla)", "value": "08aa3d33ea494ba75cf494d0fba03c48710bf678ad14f42946efedb636b0b72545b49848966de78e209041da10409f57", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674537, "uuid": "305b38be-144b-4efc-80a4-fb90efadab5f", "value": "T18425AF2E368F484DD5E1DB788B333BD41770D47698F2D3467F8C5338A62A6E59A8C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674537, "uuid": "c494db84-48e6-4f7e-a827-4183bfe50e5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674537, "uuid": "2902bb86-8596-40c9-84d3-a5d945891299", "value": "12288:7Ev7c2b/uMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BBzu:76vPCmQui1rBgc+9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778674537, "uuid": "6f9e684b-c4b0-4e08-8f7e-00fdc4d8efd1", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778674537, "uuid": "2a347caf-9a3b-4d31-823b-11d03be61aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674537, "uuid": "4fe3ff68-c9d0-4cc2-87ab-d79a8c7f8065", "value": "COTIZACION BanBaj\u00edo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed58bf36-4eba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778670017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670017, "uuid": "4c02a318-346c-4c99-83ba-8f39a5e891f9", "comment": "Malware payload", "value": "7649eba961fc0aaab744fd9a9e0206bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670017, "uuid": "34c9bea0-9136-41c3-bfd5-884971ffaf66", "comment": "Malware payload", "value": "6837e6c32476d43bea7a9dc5fddd02c16138b2b2002eec123f48a8dbf5562afe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670017, "uuid": "2b11c0d4-8a12-442c-8958-569b09bce755", "comment": "Malware payload", "value": "c08ba3f76e06c3c115bd45a61ec7023d1ebd7211", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670017, "uuid": "2e50f114-b525-4513-903e-e2637e798057", "comment": "Malware payload", "value": "26eb0b6d883419c074ec06a7e3800fd6a07dd67894ef1ca85c768a48fe8fb48b363f11f57a4db3baba894f372f949057", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670017, "uuid": "1a8ced1c-8d9d-4c12-8649-69f0ef1b0108", "value": "T1A30194E7F519E222F5444E78E78E315370827C1B9464CE0C34C0B4555D5EE5CE413726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670017, "uuid": "ada431f5-03a3-4f40-a285-8a853874f347", "value": "12:VNZD1dC3zHHMyZK1gzoMBzN2fNiF9fNagNSN5A0a/NmzmRsUd3FL0R:VNt1I3DMH16NkN6xNagNSNe0a/NKu/dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778670017, "uuid": "332ef246-758c-47bd-bd5d-8baa1db8f2a3", "value": 694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778670017, "uuid": "a7ae7a0c-ca16-4861-9211-18500e0dc257", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670017, "uuid": "15fe2150-9fba-4729-be0a-eb40ca743acc", "value": "6837e6c32476d43bea7a9dc5fddd02c16138b2b2002eec123f48a8dbf5562afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4144cc56-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637946, "uuid": "0427bbbf-9ce9-40b7-92f7-db9eae788066", "comment": "Malware payload", "value": "c8dfd46129daa22aad6462ab79daa81a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637946, "uuid": "e30123d3-bab8-4eb1-a8b8-2204ccfdcb08", "comment": "Malware payload", "value": "696247f1533d46607b13d2a22dcc367623fa5dfb239b36d99d0aae20a581ac24", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637946, "uuid": "14bae3bf-7113-43bc-8711-98198ee8e142", "comment": "Malware payload", "value": "0f961f53a9db097a1ac7ec1f47ca7b7893959924", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637946, "uuid": "d28fb7e8-ed3b-433e-9198-96341c45df0b", "comment": "Malware payload", "value": "471770e678bb587c388ed2ce5c037e7e65a433702eaab1f1dbe48ef4cde1a1e82feb2d2f6cfe7088a4fb6863bafbbe90", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637946, "uuid": "b889ce00-a624-41e9-9fb2-027c0ff8a907", "value": "T11EC6DF1632628265D8F6A4FB45AA941FC4397A1B073184CFA310FF1CCB27781DAB6779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637946, "uuid": "8572eeb6-fc83-42cb-8a76-857e76552f1c", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637946, "uuid": "4ce0676a-1be8-469b-956a-45e2e9ed94b5", "value": "196608:OVq6e47rHH0SWz0zcFG9pLdAdeOGrz3Aqc6pzBO:YrH0SWAcEbLKCAopzBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637946, "uuid": "9d32a644-5e1c-4804-b481-ce3bbfb3c768", "value": 11811144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637946, "uuid": "dee71f54-ad32-4e36-9440-8f30033273a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637946, "uuid": "d69ab20e-7b47-4da0-886f-d37114f95db4", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbad01e-4ec5-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778674555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674555, "uuid": "600427db-7bb2-4ecd-881f-57f78ad1781f", "comment": "Malware payload (GuLoader)", "value": "b59b871a934b10ef0c9b3a550edf53a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674555, "uuid": "2c795f66-9ea8-4a52-8ae3-da5d73064baa", "comment": "Malware payload (GuLoader)", "value": "6a46cc07f5f9740196f0dd8c3aa1cdd50f9b09389727cccafa92ce949741c1b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674555, "uuid": "f0f77cc6-f0c7-4769-8968-54481fdc9e77", "comment": "Malware payload (GuLoader)", "value": "2be00821cfaf7adb67e8947f63530be3694ba6cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778674555, "uuid": "46945dd5-c99a-469d-8a04-e133fbdb3b89", "comment": "Malware payload (GuLoader)", "value": "75dc1d410c7466541e50e3ef706e60b539f02d6f73fe576ce3d86a89e621e49e50644a49cf8e088fee17781bcf37ab9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674555, "uuid": "720a0db0-f233-4284-8ccf-065b48c864dd", "value": "T16D152258F375431FD866D37085B94BA4CB78BD9CB54A920F738A71623CA32CA45243EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674555, "uuid": "16deba5a-31c7-4531-b562-efb6213fa3db", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674555, "uuid": "a1763bc7-e01a-4e2b-a590-c1377918871d", "value": "24576:xA7FRGeT0g7vKUxklMeBEFmNZpJGSqQc3DKtbPik+1:xoPR7NSrDHVSKtTik+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778674555, "uuid": "1b428f9c-0859-46d1-88d1-4dd096a9beaf", "value": 885008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778674555, "uuid": "a77fe36e-a6a0-459d-82fa-3ec517adc162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778674555, "uuid": "b78cde05-09b1-4cf6-b955-b30b679ded86", "value": "ADVANCE_TT_SLIP.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2541467-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778700869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700869, "uuid": "78f52b75-fb46-4816-beff-172686e3fd22", "comment": "Malware payload (Mirai)", "value": "19a4203464bc693ce27d947176e3ee2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700869, "uuid": "95b96c9b-f911-49f7-9b7c-e5e5ec35d199", "comment": "Malware payload (Mirai)", "value": "6a4790b20723e72658973cc0f0611ac27ff804043a96910a66b977c8c5a8b060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700869, "uuid": "fcbcf6ca-cb79-4bbe-8d27-207ead9db7de", "comment": "Malware payload (Mirai)", "value": "0edccd552be4557f99d8cf2f1602c7a1f14377f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700869, "uuid": "d738aabe-ae06-4980-9025-146e56e7e5e2", "comment": "Malware payload (Mirai)", "value": "c0689fc34e748c6f9b0b38106b45058b63381ebd0674df22093bb00d828bbb2bf6b49acb8a855cff604184b5f0d3358f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700869, "uuid": "577b26d5-b6e3-421b-90bd-f8f504986cfc", "value": "T13244E80ABB610FFBE8AFCD3746E90B0125CC541A62A47B3A7674D918F54A68F06D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700869, "uuid": "1650760f-d6ef-4d16-bc60-fb284723c32a", "value": "3072:xMG6PIt2eOLGqRdWlR5ZtHcUfni4YxbBr0WCPrQO3WO31:xNx25LdRUn9HcfbBJ0hB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700869, "uuid": "dbe31dd9-4abf-4705-bc1d-4c435bffdb84", "value": 267520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700869, "uuid": "dab6d6dc-86de-48b1-b975-cd637e864fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700869, "uuid": "617b024f-ab33-40d8-a423-39e7254c7a38", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d67c54-4ef7-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1778695884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695884, "uuid": "86bdcaad-0aa1-4836-8a26-bdad6e916830", "comment": "Malware payload (DDoSAgent)", "value": "583105789584dffeb47204dca581c741", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695884, "uuid": "ae1c789a-050e-46d1-9579-e5461b1b936e", "comment": "Malware payload (DDoSAgent)", "value": "6a72ef75262c4bb019042af2877f24611db594ca5e365a5e31dd5a274e5ff6ba", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695884, "uuid": "0f9842e8-8d75-4ad3-b50d-b0a02f633da8", "comment": "Malware payload (DDoSAgent)", "value": "80a3efc2aac0549c1dd45be6bd4902a3f2dec799", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695884, "uuid": "e2f1c4ee-01ba-4175-ba30-bb2279cdc3d4", "comment": "Malware payload (DDoSAgent)", "value": "f7bd97a84dff419c49119999ca99f93e89b4b406bfe63a7a1e41c7f9071e7f423eb549f1f6376d77a4509bbc20bc0a1d", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695884, "uuid": "ab66559c-3b1a-4a44-a09c-2d62cb1b2946", "value": "T1B1860905ACC53BE6C42C5E7444EACA6522B06D140AF2463A26A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695884, "uuid": "99b94a13-3e36-4d16-985a-e4c1c2f58633", "value": "49152:1X7W9BJ4KGlHi4Ocyc0CQ58WTBABWCBIE17Il8ZkFc55Eo:MhuLQ5pyImDOFsEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778695884, "uuid": "70483d6f-3bf6-4502-b14f-4cbce3685f73", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778695884, "uuid": "affbe0e6-2868-4211-bc1d-ce9311554e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695884, "uuid": "cedbb4da-6d13-4243-8dcf-d5c37644ce24", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183696da-4f0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705737, "uuid": "21a14976-96ab-451e-b278-3ab4d6cf7f2e", "comment": "Malware payload", "value": "30838308792f3854abfb0a473f442cc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705737, "uuid": "e1eb7f3e-c2b7-4c2f-89f8-0c5f5ca20923", "comment": "Malware payload", "value": "6d0b75e797136a7f718451b7ded7fbbdf0e4120122bf485c570551057742f37b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705737, "uuid": "b8ab9720-3362-4d7c-8691-5b0f77466c96", "comment": "Malware payload", "value": "fc82dc5b0533f4261e5a2808165620a309f2f19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705737, "uuid": "ec65ca5f-a7bb-4d9d-91ce-253de7735704", "comment": "Malware payload", "value": "82791ce7e271f5aa7ce751d4fc3316f66e1997f84f9c309a17e42373d44d01fdf59f12e9ef118da7a1a580ccdfe3553e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705737, "uuid": "44625803-487e-4346-8329-e05928fb58e6", "value": "T1B2932A50AB040D7BD4F75CF4047B0328BBD56BC702E998160929EB435BB1A73674AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705737, "uuid": "3eed5ebb-65fe-4301-9682-b45fde24eaba", "value": "1536:lrTnYBiwSOyQJvkKVu2LbqyjFe+ZJie0yI/wSa18JrkZz8dLtTlESx8n4S99PW1g:5TnuvBu2nqElZJ4e18JYZKx5ESxQag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705737, "uuid": "dc611945-36eb-4345-aacf-e621c0e8a0ee", "value": 93092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705737, "uuid": "343453c6-3a16-41eb-ab54-bf6aac1ee0a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705737, "uuid": "b9ae79bb-9875-43cf-8a45-2aab5f7ed797", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a2505d-4ef7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778695882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695882, "uuid": "57496d02-5fbb-4b8c-aaa4-69751875005d", "comment": "Malware payload", "value": "d9147e2bac91361ed16d44bca0d773eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695882, "uuid": "a24818cc-4243-49ce-9fea-aa499c86ff78", "comment": "Malware payload", "value": "6e4b89ea9bfceb8dc16a9a0800449b4132005ed467ab5414e15309d9e4bfddf5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695882, "uuid": "114e8074-5817-4f9c-992c-866d58c3730d", "comment": "Malware payload", "value": "6a5759f88b0e0fcc4c30e6155f0b98df1aa14e8a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778695882, "uuid": "afcca907-0f6a-441a-a2e6-1ac53554af3f", "comment": "Malware payload", "value": "d65e79764660424ca41bf312246e1acc954cc7ba97e5b0e25b62a0ee3c010afa676fadc8edec9d7d451b28bb18908965", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695882, "uuid": "56f394f8-246f-4dd5-bb46-d50c26e84c12", "value": "T15DB13B88119258B1BCFE9C237169C894B5D4B543AECA5F18D4ECB4F9988CF09B941AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695882, "uuid": "1c1f0045-3bc0-4902-843c-40b62bdb0819", "value": "96:IKhEcfEnsTE1OnAjnA5w4OyQYkMG6kMKOUM:dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778695882, "uuid": "7f0b4e2a-922e-41bf-8bef-9045303a81a6", "value": 5122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778695882, "uuid": "459188bd-b2a5-484f-9e5f-08d61ca64348", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778695882, "uuid": "1a58907a-bd0d-49cb-9c12-20d0bae2ce1e", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e87e125-4f1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778711466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778711466, "uuid": "cc620f54-66e8-4d21-8edc-7c473e5b397e", "comment": "Malware payload", "value": "4a7d41e4ba4e80606e32ee2d3b64e692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778711466, "uuid": "1743b543-64a0-4f83-a403-a23c0e240c94", "comment": "Malware payload", "value": "6f176ce2dba60eed990a8babacbb1cc99046ac605c32d73e74d6f6edd7dc2f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778711466, "uuid": "3a8ecb53-da22-4527-93e8-4c79b5ed430c", "comment": "Malware payload", "value": "8738dd9d4374fb64cc78c1b5842ef2c4fe96ed34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778711466, "uuid": "ea274fd4-1748-4c49-bf46-177ab1c450b5", "comment": "Malware payload", "value": "d987563935c0bdd209164011d1f6804ffe0f687041e904ca7fa9c7aa4088e93df662485f81acbd921c9e5fe6af0e874a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778711466, "uuid": "6fed5b7d-8e08-4ff1-8b93-9967fad9c3a0", "value": "T131261873A09154E4D2EED574C6256213BEE0389B273423DB7BD066E11B7AFE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778711466, "uuid": "7dcd9402-5eb7-4e64-bbcc-f9cd8eb5b6f7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQJ:cqYUQuVDt0TZES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778711466, "uuid": "cd56c381-6908-41c9-a6e3-bbce566048a0", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778711466, "uuid": "b48429e0-9064-4e39-8fdd-c8394b567f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778711466, "uuid": "08c37b2f-c2ac-4d0c-ab4e-0c003dfdf297", "value": "6f176ce2dba60eed990a8babacbb1cc99046ac605c32d73e74d6f6edd7dc2f23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4652e6bb-4ed0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778679186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679186, "uuid": "13ff80ee-bc95-4b84-b360-aee27e652f2b", "comment": "Malware payload", "value": "e99d49fbe27410b77753da83e37c1f6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679186, "uuid": "14563b0e-07b5-4239-a5f9-71ececec2718", "comment": "Malware payload", "value": "70fa07f8bc4c9bfb81caa09a2eb9a73369b72600f2225eb4be1abb2980a12467", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679186, "uuid": "4dd45c3b-0ae4-42a5-8062-c6b418efa113", "comment": "Malware payload", "value": "a4083d36cec02359bc88df924af8a14d8d21c3ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679186, "uuid": "e00c44cc-0a9d-42b8-a4d0-95d5960e5f5a", "comment": "Malware payload", "value": "b60dee576f67a5ec9e522c1a40f96ab85835da6b0b52c992b3dff6fe646fa4b4b7964e05cc8b964f3358c4730594d1f9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679186, "uuid": "413b2c8f-e30a-4d46-af08-96a804a3491d", "value": "T178E0C9DB141B1E71C60CBBC6EE608B549002B6D0F6D7B36AB2035952ECB87B07917B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679186, "uuid": "c92e92dd-6caa-4371-a8fc-4b640c230d40", "value": "6:hoKonv4n4eoKtilLkyGjonydnQdxKtdaiyGjonIFMnrlyKt5Hd2lEy7:g4IPlVGUyFY3bGUhkS2/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778679186, "uuid": "3034d284-e789-48c2-819e-09d379aba3ac", "value": 410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778679186, "uuid": "2719f081-e2fd-4dae-a843-abbea0f90194", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679186, "uuid": "8be53219-1bfb-4c6e-abdb-58b58a602e24", "value": "realtek.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84a662e-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "5defa4e7-68bd-4d7e-ad91-7ba0a6788270", "comment": "Malware payload (Mirai)", "value": "515bea1f9c2e00fe51a6d3e080eaec50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "6543541e-9119-41c6-99b3-27ec0819e804", "comment": "Malware payload (Mirai)", "value": "7197e5ea11a57115e7181b14b5fd3a07d5ba9ec2e1a66d02b5fed9a13a53dbb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "2c56d4f1-a29f-4e0f-9b2d-95b5a27b3c07", "comment": "Malware payload (Mirai)", "value": "1a5b900f97aef46b8bd012703fa14dd91622e358", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "70d61f8f-7eac-43dd-919d-8fce1b5ae558", "comment": "Malware payload (Mirai)", "value": "ec9267b54be71f905cff51b2f2ddec992490f70229bf327eca1131328ccb71b632714fa6ea0fd004718836a3e1fe00c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "a0705c04-5480-4d3d-93cb-455e8b8797ab", "value": "T10C733B56BC814A22C5E922BBF71E018C372653F8D2EA321BCE255F1537CA82B0D77B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "179aea11-7efb-4f4a-bd8a-f031d1a85f73", "value": "1536:aTJ1PAcx6x0mfPY/Sgp0eC+xM3N3RBjcHrfzYUGQU1GV9:aTJ1Dw0mHvC0H+MB/cHrfz4N1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698248, "uuid": "ca614756-73ba-4657-9ea7-a5695d371856", "value": 80116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698248, "uuid": "b1e50daf-561b-4914-b4c1-1568c34c661a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "4973ac7a-d3e7-43da-afab-e17f01863f38", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4440e870-4ee7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778689061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689061, "uuid": "d59f37c3-706a-46ea-8785-9411f6749d60", "comment": "Malware payload", "value": "2ca8d3e9755203cd0973bba44c07fe72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689061, "uuid": "603eae43-59a2-4b25-b5fe-64ec5ae65479", "comment": "Malware payload", "value": "71e4c1a3408b0f991ad8ae27d1d4c35d20d03c7b4d82f9ccd6c71cf6c393d644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689061, "uuid": "ca447f55-4bcd-4f4c-9a0d-7a268c05b209", "comment": "Malware payload", "value": "0f0ef12c1ea8e004a3896b97b39ee8601c93b9f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778689061, "uuid": "94568086-675b-4eb3-b88d-88707843629d", "comment": "Malware payload", "value": "1fee8016be994fd48de3b8c57dfb6a999436c827d1a11ae590b99092613c1f9854fbb3ef060ce2b4c331795af2a4ff1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689061, "uuid": "4e414596-60c6-44ac-87e1-459ce3519d58", "value": "T14A158D4BB2F374FDC157C13487ABCA76A936F46501122E7BA1C4C6302E27E641B2AF65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689061, "uuid": "dfe2e04e-40e3-4c5a-a011-1c7caa6a7939", "value": "24576:SkdYR4mbB4cLUNcSqKYm2zr0qlUf8XztYW:BI4mdLAcKd2zr0qlMOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778689061, "uuid": "7dd7ad9b-0ad5-4334-8bc7-29fb9b5d132d", "value": 899792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778689061, "uuid": "88e73037-4784-4709-8dcb-858c6c37ea72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778689061, "uuid": "6ab0dc2f-bf24-4ff1-9473-0698e09ffbfe", "value": "71e4c1a3408b0f991ad8ae27d1d4c35d20d03c7b4d82f9ccd6c71cf6c393d644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbef255-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698095, "uuid": "989ac006-7557-45f7-86f8-651de2bef7f4", "comment": "Malware payload (ConnectWise)", "value": "5596888133ef00d8b3b1e42cefb1255c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698095, "uuid": "fdf2fee4-453f-4fdd-a1df-ee766e846832", "comment": "Malware payload (ConnectWise)", "value": "7473bb2133b32517c8a4a7d6e307f289174ed0ee42a668039740b0261f596f51", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698095, "uuid": "4c3b41ff-6377-47b7-8d31-b702cc6dc1f4", "comment": "Malware payload (ConnectWise)", "value": "3e0d8b53fa5a0f31170dabda689312f4ddb39d45", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698095, "uuid": "530a14ae-6842-4dfe-80f8-640d0e4857dc", "comment": "Malware payload (ConnectWise)", "value": "7a75609a479c3dc5087f6b142335c3563a14ac767863c9e8d26de501ad7f7e1e9d176c52a7e52e4b64cc1a5bbe8d7087", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698095, "uuid": "ff4114d6-ad76-4faf-ae67-b9ae456d614c", "value": "T10B647D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698095, "uuid": "eb82e975-9f1e-4a1c-8285-c89b14ac8ad6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698095, "uuid": "0686d0af-4637-4ad8-a94c-2087d7ebe6c7", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9B:51iw7gryNkSV1hy1Z1u2JLu9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698095, "uuid": "95526c85-6e0b-42a0-989f-1fc9d1e943fc", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698095, "uuid": "1ac31465-b5f5-475c-b040-852eb3816481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698095, "uuid": "dc1c192a-e133-4964-8ab7-487f3696acba", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25b0051-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778638243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638243, "uuid": "36bb9924-6fea-4d8c-8e52-526d8d28feb8", "comment": "Malware payload (RemusStealer)", "value": "6d5a3a8c668a8efbc8ee02bea31f9a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638243, "uuid": "08add29d-c27f-4aa2-b190-24596bd6f574", "comment": "Malware payload (RemusStealer)", "value": "74be7ab8e67082872207557db9fa87d19e6887c4496576206d8270a2c22536bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638243, "uuid": "033f7bc0-ff29-4806-8660-689a8a5f73eb", "comment": "Malware payload (RemusStealer)", "value": "58799e849691d3944428796430d92f7c6731a7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638243, "uuid": "d63cc20d-0b80-41fd-b304-5a2dfab8d611", "comment": "Malware payload (RemusStealer)", "value": "245156078af0be04f216e4bd2defd660a6b771c62f365415e1bc415108005de5d640b44aa02b2366fa6e4da5fa49c33c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638243, "uuid": "fd644f31-ddba-4afc-823d-e64d61e18dd0", "value": "T1D0D54B177EA185F5C0A6E730C877A152AB64BC48473037D72EA16EB46F323D0AE39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638243, "uuid": "0ad6d159-ad77-4003-b0af-b50c04de0ccf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638243, "uuid": "15dc7691-8971-4889-ba8c-8d483f2b4ddf", "value": "49152:aAyYZOx8Dca+QoqM1FK57Udr2qXavthE85:a3NqgtO72+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638243, "uuid": "382c2ddc-de3c-4388-8d1d-cabf0cbaa057", "value": 3007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638243, "uuid": "be9d866b-a9a8-43da-8c06-b0aa20ff3d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638243, "uuid": "7f5781de-0c02-43cf-9d07-397c4eea4864", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6caa3d-4ed2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778680293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680293, "uuid": "7c62bc78-7300-44be-a1b2-6a18126d0798", "comment": "Malware payload (Mirai)", "value": "df9b4897b114d9673e2db74057858db0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680293, "uuid": "cc66f8c9-11d7-4a0d-bc6e-6cf85e253804", "comment": "Malware payload (Mirai)", "value": "74e6452c135da58d3e89b7614655e9e8b117311dc64076153ce5cdcdb3b54274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680293, "uuid": "0f9d950f-f451-47b1-974d-440513dfbabd", "comment": "Malware payload (Mirai)", "value": "fe90ae45cb1e2a79449bf5f490536358eb737706", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680293, "uuid": "4e58aa86-633c-421c-af00-4639e0eb2baa", "comment": "Malware payload (Mirai)", "value": "943301a16159f92abbd6cfa1efed6f11884b0ba506dc8459bc8198909746924e643bbe9f0c1ac46b8b0581c89b1b7a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680293, "uuid": "c2ac9e7d-6277-4f74-a32f-947587c015aa", "value": "T14C241946B8819F15C5C016BEFE1D118E332717B8E2DE72139D206F657B8A86F0E3BA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680293, "uuid": "24cb18df-157e-406b-93bf-4b520ca6101b", "value": "3072:AimKVOJFnlaj65/2SSmYi8MDBUqZC4jX189RSEalR77id0D101naaIVWR:Aj2OzgjaYxk13jX8RPaPY0DonaVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778680293, "uuid": "a0ec6570-46ce-4ae8-98b9-dd5b813ec48b", "value": 213532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778680293, "uuid": "efdff24e-47a1-4378-a4d1-e9255efd30bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680293, "uuid": "a976684a-b462-4104-a003-c0198205cf18", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eb8e9b-4ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778661306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661306, "uuid": "f5569238-e4f8-4ae7-8c9b-0d42bb03377e", "comment": "Malware payload (NanoCore)", "value": "4d2f70c4d5ac6a5e517bf2d9a9bfe7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661306, "uuid": "43591dc2-b086-4491-bd13-f46942881a60", "comment": "Malware payload (NanoCore)", "value": "74efdb1ae75e5d3049ca49606964f5cdcf14e5aae84473b8b003fa2b832276b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661306, "uuid": "67d99de5-9807-45ff-8e4f-1db833dab11e", "comment": "Malware payload (NanoCore)", "value": "a2b0cb6fce4d3da3b2da7fe2218bc2497279201e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661306, "uuid": "51c50505-5636-4c6f-956c-34231d3a666a", "comment": "Malware payload (NanoCore)", "value": "7c77fd97465cfffc0faf860245fb9b0e5959e12c5c54458dadbae99fec32b4ef86d95eb32817db18bf6ee5d6e4d955e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661306, "uuid": "d86239e5-f678-4045-a340-e326de4b6b51", "value": "T13C14CF6677E88A2FE2DE8679701246039379C2E398C3F3DE2CD455B29B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661306, "uuid": "6eba22b5-2203-4c63-8526-f0488ab7607a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661306, "uuid": "aa430a4c-173c-406d-914e-a528d1f809b8", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIjjLZFSGH+2AgQ7S8xaP4W9rsn:MLV6Bta6dtJmakIM5ALZFFYSEY4ers3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661306, "uuid": "517ae0f5-6bce-46b7-acda-d637d03945a0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661306, "uuid": "bf054ed4-5e4b-4a14-950a-2d54c2d64bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661306, "uuid": "a1cc1c47-5cae-4aea-9032-4f0e5280d1b2", "value": "au88-mobile.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad06a86-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682307, "uuid": "79df0cc5-5670-4de9-abb3-ec002467be5d", "comment": "Malware payload (Mirai)", "value": "3ec6c8be19dec4075e78691d7b128504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682307, "uuid": "cccb2621-829d-4dfe-ba2e-ae5da85f9393", "comment": "Malware payload (Mirai)", "value": "765363d597101d6ecab267e5dd5ed593e462e4b41a916af199ee484fe789e200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682307, "uuid": "6f457097-06d8-4aee-9876-e49c3134eeef", "comment": "Malware payload (Mirai)", "value": "b7e6c8b04d406fda180061683794bd95ffbe4196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682307, "uuid": "af49a414-b9a2-4308-b769-ef15e87fe98d", "comment": "Malware payload (Mirai)", "value": "24b3aeb58b4ed6c7452bce971749feb29fe2a1f2615a7512a9aadc1cc15f04a5a0694de73d816b7b4db7c0f82d91c394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682307, "uuid": "8521508c-e2e7-43e9-b9be-047b777ab244", "value": "T126047D9BA986B944CCE103F096D7833D1AD343904E4E91D3FD4D867EEC72CDAA901B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682307, "uuid": "7ded23e8-cbd2-427b-a20e-a690d188edd1", "value": "3072:Cr5x/YluiJVIHnPJm3/sqKBjZrQzall2IWX8czsgR2q:Cr5x/YdPIHPJm3UP2yyT2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682307, "uuid": "a82fe478-6f32-4fae-97fc-8a7f2fb1d73d", "value": 181984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682307, "uuid": "6f4c378c-1d97-463f-b5de-c0a261e862c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682307, "uuid": "0df8aca1-cca9-45e8-a388-35876b36e25c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256b5e20-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638758, "uuid": "ef1e198c-1ca0-4ade-a53f-5f1ac281daf0", "comment": "Malware payload (Mirai)", "value": "e206c2826408ce684b91c3ec1bc45731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638758, "uuid": "fa56e235-fda5-4e0a-ae3d-406600359e48", "comment": "Malware payload (Mirai)", "value": "76b804548669901d2ffbf4d058e17084f54409af0fe6b9ffcd7bd6cf02aa2a20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638758, "uuid": "2025bdc9-d6f2-43b4-820c-0f8435016d87", "comment": "Malware payload (Mirai)", "value": "99e7724d272c5716a2272c1e43cf4c6cf78bf0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638758, "uuid": "58711869-6e35-445e-8a3e-a134a0e8e001", "comment": "Malware payload (Mirai)", "value": "5b08a4f905cc67b9fe8fb150c04c52c67ca1daae08b65201a89a244a72afbdf883eb59c515875ab7a1fc008923b19839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638758, "uuid": "5df800b4-7e3b-4368-9d7e-2648d8494158", "value": "T1E8837CC6EB43C0F0E8624972213BE7329A33E53D5029EE83D369A972FD13542D55A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638758, "uuid": "4d5701b9-dce5-410a-8b53-c6f5f3f2be42", "value": "1536:saMNfheHcZS2RJQl25YDVEfV3cxisMDJ+7s3Uk2i:saGIuSKJQl25Y+fV3cEsM96MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638758, "uuid": "df3a2a36-ed6a-4d8e-b698-993390570299", "value": 80912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638758, "uuid": "ff961e39-d7e2-4588-94f8-7a997b0fab6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638758, "uuid": "12923e24-35ae-4364-b76f-8f8ee3a0ae5f", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05f0fa6-4e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778657111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657111, "uuid": "755846b2-6fbf-4698-8d2d-9726326ca4ea", "comment": "Malware payload", "value": "67f76bc2cef0353e790722cdf701af60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657111, "uuid": "6a605eb5-404c-4c4d-9182-93b7e0794055", "comment": "Malware payload", "value": "77b2389c0cb352c2a2b2296b56a3a18444dee31c487483b3a77b5b22d51112b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657111, "uuid": "961d3e3e-2191-4d6c-9995-306d3ac75965", "comment": "Malware payload", "value": "eab6db3f262968e141206a5a2f541d0fc147a749", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778657111, "uuid": "74bd998c-0875-4107-9375-0ba5dc4ea5a0", "comment": "Malware payload", "value": "986c3a77004b289953082d41946658b4999aa80507d5dd500cf065f0d0b793856264cf25f35fddcc19aea4bf0fdaa511", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657111, "uuid": "13a0069e-3db1-441c-933f-a2a01a821ab3", "value": "T12C137C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657111, "uuid": "6530df2e-3b18-4671-b211-03aa2897a2f3", "value": "768:bAs9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bdHusZOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778657111, "uuid": "8cb115a3-e324-430d-91ac-67591546267d", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778657111, "uuid": "da2d7c9c-cf89-47e0-a7b9-01fd7c6b98f1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778657111, "uuid": "a51a483b-3f5a-44b0-bc46-28588f706c51", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89d4133-4ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778676049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676049, "uuid": "764df481-c544-4b26-85f0-36f7df8dd9c3", "comment": "Malware payload", "value": "de6575f42d56418f56f168891dc15996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676049, "uuid": "76a1800a-0a2e-4a46-a584-61ee25225631", "comment": "Malware payload", "value": "77efb6239a54bf1be81f368420469618bd8eeb6182e61e20414c1d4cf3dc7a0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676049, "uuid": "61b667af-2d79-429e-bd3b-8048eae29191", "comment": "Malware payload", "value": "cbd676f2618d530edeee8abd6415ce56a873d314", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676049, "uuid": "b935acdb-ff5a-45c9-abb4-9d10469e161e", "comment": "Malware payload", "value": "bc75b986bd26d0298489cdbe60a8f5498f86319792a0e34e83463735679e445698adf481cf16fec9acf9b867e6aa2882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676049, "uuid": "4c5d4251-ac19-4441-b9f1-21a6ddbd147a", "value": "T144A30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676049, "uuid": "c0a8dd08-b595-419c-b720-0f13d9384127", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPjYO5:FOuhPHCKsqZ9YfM6g23ZJLYO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778676049, "uuid": "5b5088a4-d896-40be-9c40-5b0b3d51cc92", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778676049, "uuid": "37c80491-6adc-45c2-8e39-81625a87f314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676049, "uuid": "c4416b94-e2d0-4604-92fa-571373fc87d5", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256d94a9-4e80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778644771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644771, "uuid": "9496a8d1-7c92-41e7-817d-3a51a4e37550", "comment": "Malware payload", "value": "20f373e15c979619976bc551cf777cf3", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644771, "uuid": "aff16fef-fb98-4596-abb1-99e32b346d79", "comment": "Malware payload", "value": "791b8b0ae50f56089a9fff33d391a99ab56da62adf19825e716d86bda075f1c5", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644771, "uuid": "d0de0d8d-6906-49e3-b9c5-79badfdac614", "comment": "Malware payload", "value": "c88477f0263b767db70252233a5bf32dd2bee4d6", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778644771, "uuid": "0f677161-0202-421b-9c23-998b7ea1a7f0", "comment": "Malware payload", "value": "f6c7c0b02bfd5b949b26afb82897d62d5c57a7f31b2a291cf4602254fbdabed3bc9348f2b83a4806f97908c093ca7ba5", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644771, "uuid": "935f1db1-8d34-4954-9e2f-84224a5caf39", "value": "T1C075F10261E90865D5350B7424B84C08E6343F6BFDA1457A7E0EBA6E1BF7782C62773E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644771, "uuid": "201f3f20-a5bc-425f-8a8a-bb5c31a01104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644771, "uuid": "4126e504-6da0-4331-9870-8057c054f096", "value": "24576:69Okcy7pQu/f9CuXOmzFV52bSHK4JKj+K3/NbmKXW5nYJKh1srYfYkDWyKa/I:6owpQu/f5XOeFV5p7JK/v8+WBYTaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778644771, "uuid": "7ec73fb6-6ab9-4478-a27f-5f45a0d643b8", "value": 1665128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778644771, "uuid": "95a60a06-d1d0-4fc4-b79d-5686f676d66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778644771, "uuid": "a7bf96f0-07f8-4ef2-b2fb-aaa130539f56", "value": "ZH_CN\u4e2d\u6587\u5305\u5b89\u88c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b3f24d-4e96-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778654415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654415, "uuid": "e37449a3-e6ce-469d-8d8e-1119ae6230f2", "comment": "Malware payload (NetSupport)", "value": "a2dd60b2dc75b0a74f971bfcd775a3d4", "object_relation": "md5", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654415, "uuid": "be009a6d-62fc-4eb2-9f7e-e6f4bcf05b9d", "comment": "Malware payload (NetSupport)", "value": "791dc33187b3d9b4bc3e01351591bc8cfad47c5d964e227fe42f6e480f428150", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654415, "uuid": "eb566f2a-8831-47f1-8d41-633bcf2035a6", "comment": "Malware payload (NetSupport)", "value": "2a7ddcb7a6ce22d32df54b003b7dc7cf61397288", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654415, "uuid": "efeed545-7c7e-490a-99f3-456ed4bf5c81", "comment": "Malware payload (NetSupport)", "value": "e4d7d28251a16ab41038140122918a92833e6f399df34b854bd3da4ac372c5838fd3f998abcb1dc9e2b5641e4d8c54b0", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654415, "uuid": "00a7b757-b1b1-4753-8f5a-85d05d1e404c", "value": "T1FEC5335E9A4D84DBC96B4B74800A5F1EC33D3940E2AD7481EB318292CED9F8B977871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654415, "uuid": "13ddda13-0bc5-436a-a0b5-41f286128bea", "value": "49152:qFstk3WKcquay/4tGkYrp7LnqVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnn1N9P:qOtkKqur/4txS3q/VYj3b2+30/wBFVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778654415, "uuid": "c275c738-2ffb-4cd2-a472-d5ae5b94bb49", "value": 2598875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778654415, "uuid": "f2e78561-3558-4d15-9f8f-fb58caf12c33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654415, "uuid": "3ec3528d-9f26-45ea-9d94-44414cc409bc", "value": "AltPayload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e298d2-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698110, "uuid": "4be7165e-287d-4b3d-9a3a-c67cc21812f9", "comment": "Malware payload (ConnectWise)", "value": "c8e538539a2426fe6ed8d19bc75a65ef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698110, "uuid": "3db3c2a2-4b73-4443-b182-4782bb0a0d8b", "comment": "Malware payload (ConnectWise)", "value": "79965a3946fc049ae7643e7afbab19611cc956948eba9ab2ae72714e8d437c2c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698110, "uuid": "fa5b7bcc-1be5-448f-a7a5-ad807391001b", "comment": "Malware payload (ConnectWise)", "value": "cc9a52595c593f563a1b60461f95a25002bf3693", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698110, "uuid": "bc84ba19-d778-4138-95e0-ef4f652f3196", "comment": "Malware payload (ConnectWise)", "value": "9f701b992b45e8f32b4bb0192a3d8720054b168e04bea94c1bb24ff7566699bcf5c2715f57affaa8243a43f0fbed64e2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698110, "uuid": "72339d81-7c75-442c-8c36-08c9929b4798", "value": "T125C61201B3DA49B9D5BF0A78E87A41549B35BC049B12C7AF53947D6D2D32BC08A323B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698110, "uuid": "6b8037f4-f958-4c7f-8f4c-f3a393759719", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698110, "uuid": "3e1a0770-135e-4063-a31f-40bfa9a4f5f6", "value": "98304:nRDRs6efPwbpiTBNxNBWHTGS0h7276VpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHE:nRdfefPwbK5eqyAK5sK5GK5WK5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698110, "uuid": "ec0cd12b-c656-4042-bfff-577285c18f66", "value": 11609936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698110, "uuid": "a1be9da9-4880-423a-aca6-32a00ab18834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698110, "uuid": "1731ec9d-ed98-45dd-8343-390ed5dcef76", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d1e59b-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637839, "uuid": "3cdb4eec-2a11-4495-9a2a-276173f12b14", "comment": "Malware payload", "value": "1df70cf4739ceca3632fc6a76447962a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637839, "uuid": "9f8326c6-7158-4d4f-bf28-4bbb9e3bfb24", "comment": "Malware payload", "value": "7acbd81a705f166ac95145866413ae02258d821878e7030c98e211dcd5b246af", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637839, "uuid": "bcc6b28c-6d48-47e6-a890-ba8007475238", "comment": "Malware payload", "value": "386b08106164a9e23641334149d07971fb9ffa70", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637839, "uuid": "4fce1bfa-0b21-47b4-8650-84a6637c2816", "comment": "Malware payload", "value": "bd12c35d354e2a164d63281c5eba5a0c0e65a6488a40d02f8aed5a6e29a0702f4ae2110d8dffaf186db37f2326f93f45", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637839, "uuid": "2c4e9a00-3462-4bee-a5a7-0f420a513f63", "value": "T19B9733B1C5694A4FF3C7713E7D54D60B659062F4D8227C0E3CE8C2E9CAC1BE0AB96652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637839, "uuid": "7a24e876-0526-4d5d-aff5-0385987c6103", "value": "786432:JY5/xF/D6FTXch+Ol8nJGpNbXLZXdv2xb/hj9vq60F0Mr6hrHTvvCWgqS7g8k:JY5/D/D6NX48kNbpdutH30FRr6hrHTvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637839, "uuid": "0bbb04b7-c03b-4e8d-b1c6-6dddc36c686d", "value": 39837301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637839, "uuid": "0c0b34a6-8682-4f4c-819f-66f491a45ab9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637839, "uuid": "be9a2f22-1132-4e9e-bc15-0c90e24cd336", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e44bb09-4f24-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1778715170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715170, "uuid": "2ec4d5b9-c702-4626-a6c2-da10bf251a7c", "comment": "Malware payload (DarkTortilla)", "value": "296b8b3569aff5276c26c2fc6d072526", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715170, "uuid": "431a4ce8-9a29-466a-a8b1-149f599cf028", "comment": "Malware payload (DarkTortilla)", "value": "7dbf8e648a29836d896952fab39089c38d19cf4caf347f79461e988adab6ae8c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715170, "uuid": "e1daccd4-efb7-4383-a881-4570e65c0c23", "comment": "Malware payload (DarkTortilla)", "value": "31dca7bdf8e5364600242c9e91f18b93e9aea95f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715170, "uuid": "3ba25902-08d9-4e38-beaa-1b611b79f6ee", "comment": "Malware payload (DarkTortilla)", "value": "bc3b3ec3118fb72c5b0a143d0c2425911c37548c73903953e37106720d35cd3b9494deb88748add6b00c2f24c6d0ad2a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715170, "uuid": "35515b76-366f-474e-a925-c7a12b1e68ce", "value": "T14CF6331E2DD700ACC0C1DF38DB7A27E813B0993B48B2A397774453B4DA56756768E1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715170, "uuid": "dbbc6639-0c15-44bc-b4b5-29485bc1bcb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715170, "uuid": "c6e240ea-42f8-4d0b-a3c7-317a50881562", "value": "393216:Tb1uaMQiCtzFZWfzW+VHxq00qdZAG72S:FrRbWK+bJd32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715170, "uuid": "d61ec97c-7c34-4afe-b6dc-5b4215ec1099", "value": 15415296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715170, "uuid": "9c36ae23-5f8d-4a7a-8601-2b629b32d07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715170, "uuid": "c3bb8975-c553-4df9-8e92-cbf470532262", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee95502-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698098, "uuid": "c4bca74c-9a86-43be-b4f9-43a7d4395ca3", "comment": "Malware payload (ConnectWise)", "value": "b4fbbed84311d330406e2a6f6a99341e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698098, "uuid": "4f3b2133-694d-4a43-aec4-a7d39f5b78b2", "comment": "Malware payload (ConnectWise)", "value": "7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698098, "uuid": "f47a951d-c5e8-42ed-b4e2-575869c3955e", "comment": "Malware payload (ConnectWise)", "value": "bfef90d47201537f396f896897b7a6286abd49f3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698098, "uuid": "d32c69ff-d10d-4f43-8dc0-d4383eae48f8", "comment": "Malware payload (ConnectWise)", "value": "9ae7d26bef601fb1e90898a9d41798be08017dc3176528383bcda8d50abd05dae860cc0c5247f1e6a4ba87fb2024d30f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698098, "uuid": "114afb1b-08c9-4e73-9c34-ab7d9ff7ace8", "value": "T14F646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698098, "uuid": "7315cf29-ccec-4969-86ef-feaf9ebdf2b6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698098, "uuid": "76f195fa-3b37-41bd-902c-5bba1c08ffc7", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi94PB:A1iw7gryNkSV1hy1Z1u2JLa94PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698098, "uuid": "9d7eb187-af3d-478d-9d07-3347cc4ce715", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698098, "uuid": "ab25feb7-4ddc-4d45-8574-326664942722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698098, "uuid": "28ad3f90-6dca-4b44-89d4-b9fcce3ad9b5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46743f2-4e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778654487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654487, "uuid": "78c70f6f-b57e-464b-9909-fdd50c79eefb", "comment": "Malware payload", "value": "397fb625b5ed756912ede041f74470dc", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654487, "uuid": "029629e4-8aad-4754-9d47-f561999e1be5", "comment": "Malware payload", "value": "7edef7a3f1aa4ceb5b0f28fc6d4da6c330f8a4b9ec1f2ff68fee291fc2e3059a", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654487, "uuid": "59133ed5-93c1-474e-aa3b-2d90ccb43a17", "comment": "Malware payload", "value": "c365afa160a3d9d753ab0cef4a1ba1ea9b46c7bf", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654487, "uuid": "da12dc75-7304-4603-9b22-a074fa71c38e", "comment": "Malware payload", "value": "e0451a5473430ecad6f5e7d1929aa2c0fb0879fe1037dfc120ab0762f57183ef409b58d27ba86f9c20bf6cbaebe6da65", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654487, "uuid": "714c3b54-791c-4c36-b41a-8837998bc0a8", "value": "T179D3FDCD4ECE8CE88F1F302D852F5D03854D7223466EDA90BEEEAE413F52564B1AA5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654487, "uuid": "8c40acb3-9786-47bd-ba20-db4049164cf4", "value": "768:1vJruSOt0bqwjN5fp5E7XWU7/RGqkBS5TQ2x9MSCPC1CBCubCqCKCIXQBjGEyCSk:frroM3cr8DR2OVFzc/oUuOH7H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778654487, "uuid": "a4fecf90-4558-43a3-9e41-444134c1a4cb", "value": 136083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778654487, "uuid": "43338064-046d-450d-bdd8-39050ce2a5d5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654487, "uuid": "7b93bef2-6e94-4de8-8767-0e3e0aff97e1", "value": "Client_Build_Alpha_5623.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e1fdf6-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778638175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638175, "uuid": "456d9c41-af82-4d00-9f2f-46dbbf5e1253", "comment": "Malware payload (RemusStealer)", "value": "d5b9e8bb266c54ffaa98047b19b80cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638175, "uuid": "9475758d-f63d-4cbd-9c49-90c120c45361", "comment": "Malware payload (RemusStealer)", "value": "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638175, "uuid": "bcde6297-ef33-4366-b54a-e6a2e43979f8", "comment": "Malware payload (RemusStealer)", "value": "2a9c946a850fdcbdd3ac058c4011e7eb91bfd3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638175, "uuid": "5dbac735-317d-4335-a6b4-c99023bb9fef", "comment": "Malware payload (RemusStealer)", "value": "c7360fd10e8bc916f420fc84b71e221a9da7b60906e8744c3779fb490e51e9adeb20eeaef46ed28bc396e6ae0e4de001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638175, "uuid": "404e6236-c5c3-4534-a94a-5e077f85a996", "value": "T1C0D56C037EA185F5D0A6E730C4776252AB64BC88473437D72EA16EB92F323D09E79B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638175, "uuid": "411eebb2-a8e6-4236-a603-2bf5a6de0564", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638175, "uuid": "0eeda34e-e0bc-484a-a2ae-98853a0a3fdc", "value": "49152:ghicncSMj1GvINwy4ck7OX8Hw8Yr+4O94FIEWie:gQtlxW7Yy46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638175, "uuid": "b7704924-de9b-46b1-9372-ba1e4de698db", "value": 3006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638175, "uuid": "1fab101b-29e9-4f42-b5a0-25f7a71627ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638175, "uuid": "9fb8e46b-327e-40f7-b6b0-070b8d7e715f", "value": "WW26A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9d27c2-4ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682742, "uuid": "78aab497-42db-4d52-a8be-db2bf14905f1", "comment": "Malware payload", "value": "c05baf1f365887eabbaa5432bbb0f73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682742, "uuid": "8f543b85-63b1-4391-8cc6-8591abc193e8", "comment": "Malware payload", "value": "83b5c8aa802986507b5bc678c4839256df06f5fc71a155fb164e2a09c0b22fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682742, "uuid": "8ca37dc4-f8e9-4df9-8a14-0f8bf84fdfaa", "comment": "Malware payload", "value": "541b592eb3032326ee15d1d863c370444d1e3eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682742, "uuid": "44d50360-31c2-4d4e-bf5a-836927d2de02", "comment": "Malware payload", "value": "7e3372c78b05ce11bf5d66fc77e2333ebfc20eceec20b8a48c7b94243cad8165419db9e936ed004685f60a26b7103554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682742, "uuid": "cfe27d2e-61f7-4035-a520-739edb53ab56", "value": "T1D8D4AEBB76534E22D2840337C5C7484193BDD78676A7F30E748413A66A033BADE4B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682742, "uuid": "aac790aa-9b98-41bc-a644-3a4ca5e9e0c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682742, "uuid": "53f80166-cf40-413a-85f1-c94a13196d2e", "value": "12288:6waJH3htpQ9jQ4xOV3KTXvLISHHcPIC8BaGiDyU:8ftpQ9jQ4xOV3KDjIGcPIPBhOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682742, "uuid": "4428362b-a71e-40ba-84a4-b78c04b63f3a", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682742, "uuid": "e6e1de39-4afa-42fa-95e2-7c024a7861a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682742, "uuid": "0134d6d7-7b9b-4153-8080-3c2969f065a6", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.33326799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee581941-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638666, "uuid": "0c6649f3-1407-4571-93aa-46ccaf014538", "comment": "Malware payload (Mirai)", "value": "433f5321f906d25d76d1c79b147bb06b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638666, "uuid": "28140e2b-a14b-4ea4-8ecb-35013db41ce0", "comment": "Malware payload (Mirai)", "value": "8445248d71dd3445191cb4a98bf945c3b61f78b45387c0607dca863994fb8b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638666, "uuid": "8ac44e45-535b-4118-b026-834e952ed331", "comment": "Malware payload (Mirai)", "value": "b7a4ec38bf6e8b3e3a5e172bcd531d646f39e019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638666, "uuid": "2e7c4d65-6cb3-41d4-ad4d-dae99fc73b38", "comment": "Malware payload (Mirai)", "value": "004e335bfbac6cec6f277d75b140db95de723d0ba57d8c4f0fea76531ab4ded8ab802ea8600b0e0c580624c4b932574f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638666, "uuid": "85269491-898b-4c99-8154-c02364a8ebab", "value": "T165432B91FC9245AAC7C117BA771E978A33626369C2CF7313DC080B5176C9A4F4E67B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638666, "uuid": "e453862c-8353-42e4-8190-a01531146541", "value": "768:L2uoWsjpIE9StBkNxCU8d+bE7DdZVOIr9QKw54u8bMr2FX0nCzpke:LABjpIE6auz8oDXcIr9QKwosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638666, "uuid": "a55049b5-97b2-45f2-a34b-ca51b4dc0a6e", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638666, "uuid": "9e825f5c-97ee-4a81-aad2-8aecb28cc557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638666, "uuid": "62a2e1e3-4465-41ef-865b-6eb1ef5546f6", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5bd570-4ed8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682738, "uuid": "0fbf0803-ad4e-4a65-91c8-e789992be6c5", "comment": "Malware payload", "value": "66f6119c4eda5de607597459b9e68a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682738, "uuid": "007cf40f-811b-4720-8973-157a1a700113", "comment": "Malware payload", "value": "85a3dc5688b54be9cf44a2060a9faa5b3c73b291520de1c3646f99f5f045728e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682738, "uuid": "19aa3838-f390-4721-9e80-67d4249092a2", "comment": "Malware payload", "value": "fd60dc5a3b0cb0e7152fb1c12993bd127d75d881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682738, "uuid": "95e58882-dc1d-415a-82b7-e31683ff639e", "comment": "Malware payload", "value": "cf4cfff92df5480c36f2105b890374dc16e8ff797881ba2cfae2d265cd2e23ec29f86e23a83cc440fe3b7ba4ef1a2ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682738, "uuid": "225da89c-aaec-408d-bd4e-9fcec6cc53dc", "value": "T1C9D49D6776A34E10C2994333C1DB4A4693E8A68675A7F70FB145339A14063FEDF1A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682738, "uuid": "d3ebbcee-249c-4cd3-ad8a-1aaea6a10aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682738, "uuid": "96dd8387-0bc8-44f9-9295-31d8ca016b0c", "value": "6144:MZ0gpYDRBzhxH4fP0+/Hb3pbU8U9pib+dEpZUbXEX/UipyXnXzwdg+kcU4pdUwpS:MgmfyZK0VOWNol6aFenLV7/3/OHdS+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682738, "uuid": "71be267c-19d5-4cbd-ad54-74ead2a9dd2e", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682738, "uuid": "dfe40b5a-42f6-4608-9906-79472d63552c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682738, "uuid": "e7d6f588-420f-4f44-971d-20c92dd42489", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.32534.6911.8053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86daf198-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682301, "uuid": "afa18036-1d96-4dc0-8df4-e3ffdaa06a0e", "comment": "Malware payload (Mirai)", "value": "04696403eed05ab60b9d6f1ec92793c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682301, "uuid": "4b26b341-36a0-488e-841e-b4a4f57ec510", "comment": "Malware payload (Mirai)", "value": "86029d7a03637aa53070213e32b3e21983a07bafa521220d5c50398064dba8cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682301, "uuid": "3c97086c-ca75-4e2c-8fb9-a08d7347af17", "comment": "Malware payload (Mirai)", "value": "4f1c70408c778a3a6a3255b45b8c06f625583ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682301, "uuid": "ecea8a9a-e2a2-4292-aade-76d1a959f8ae", "comment": "Malware payload (Mirai)", "value": "416788b0509d488e75a779bee744966b6bab84f3557d5d61612c6c2caccb0464624176f6482e741c9a604f797e79c119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682301, "uuid": "9fd3dd9c-fb7a-43dc-b5c9-36bdf5ce07ac", "value": "T172C35BE7F400CD7DFC1AE77B80A70A19B231A3651A5317636267BD57BD321E1182AF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682301, "uuid": "458c84b8-fdf7-4b46-8225-1bfa69fb87f7", "value": "3072:LeQVVzJz+H2R1lDnNXLf7xGju4M8yDOsbqMgMgYiMz8VtW/:LJzu2R3nNLjxUyDHbLgLY0VtW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682301, "uuid": "d81c2dc2-8ab2-4dad-adf2-9d90412a5d9c", "value": 125792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682301, "uuid": "ab0049e8-51aa-4c9d-9cad-d58206673b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682301, "uuid": "1abb75fb-ab97-459b-ad69-edcb8990f4bf", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561956bc-4e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778635833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635833, "uuid": "d300d2f5-0c7d-49a2-8654-e42f711e0932", "comment": "Malware payload (Mirai)", "value": "3ae693c34acb7e5a9c1a4160bcb9b4f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635833, "uuid": "c709dbb8-5901-441a-a0d8-38e561877f14", "comment": "Malware payload (Mirai)", "value": "88675390f66b6866b1f847bd106e638d346dde0ca6cca8ffff3a334f61d01d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635833, "uuid": "bec34ba7-f9cb-4c44-bba2-b1448d0d78e7", "comment": "Malware payload (Mirai)", "value": "825d924348f972ba407289d29c1c99c903fc357c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635833, "uuid": "4e685138-d6e4-4554-8986-9a0fe2be788c", "comment": "Malware payload (Mirai)", "value": "a2eb879c4b8b46c71819904d2854b1f353c7f7b8e7ecfcaf34da45801cb8f70d26b6e74632410fed643da60be14527c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635833, "uuid": "a1e35505-fdf5-4c23-9f44-a1d1a25f03f3", "value": "T15743018119C6F487D6FD6673C8D45C03A30F3E68F2A7C0576B39A5F539C9A5093E085A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635833, "uuid": "fc54b850-6513-4d28-916f-2418fce9fb74", "value": "1536:shEFLsQbQlBUo/1JuCVJw31+R6iQiGdkXnIkITD:QSs4QesfuCVJw3qkZkXv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778635833, "uuid": "8864cf1c-f246-46b6-9629-956ef5bb6be8", "value": 59668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778635833, "uuid": "06027562-c779-488c-af6c-d555a421ca83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635833, "uuid": "38787e9e-8f67-4d59-8327-61cbdda4e5ef", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9f1098-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700779, "uuid": "4d4d3622-9420-48e6-92ee-3c5a40acc85f", "comment": "Malware payload", "value": "36d21cadec79f898dd327d2b2beb58e8", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700779, "uuid": "9daed03c-be6c-48c1-a404-7707e21ce85c", "comment": "Malware payload", "value": "899b268e756f5158f6707e76e15e0af4ab9a6a09953274ee1b549666f3cf2f12", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700779, "uuid": "6cfe7e8e-1653-4ebf-b5f8-8e09b6ecf9d5", "comment": "Malware payload", "value": "af6eaf12c4a3c05fc43d2968914647e15c02dd86", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700779, "uuid": "9637dc58-f8b3-456a-84a0-98217470d312", "comment": "Malware payload", "value": "d7d4fce3a80708f3284e4e40131af3a9db64992bbf0039c66d7ae2a72659e40c716d2d8a5fe1f973ffc411c8ac3b941a", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700779, "uuid": "e01358a3-9256-4b01-a042-6ad3852d14c5", "value": "T116C412877AC49361C6106ABAC0D3643943E7F69B2A73E3463A9413D51D50BF0DDAABCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700779, "uuid": "3c0a9bcf-d4ce-46ac-ac53-f3aee8c7ab9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700779, "uuid": "9f9a6582-1b08-490e-a99c-037f546c9631", "value": "12288:rlp3pcj01ERk8lR9K9yotHrizHBoQsq7xPXs1GvKypejzIhhM9LG:rlp3pwDQy2LoBoX8dXs1mpeXMhM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700779, "uuid": "2f1ac6e4-ea9f-43ac-a6cc-a4e43b6191b7", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700779, "uuid": "569df3de-e27a-4440-87e8-a16eccf3936c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700779, "uuid": "e41b3480-8535-416d-ac15-0c79ead4fad9", "value": "899b268e756f5158f6707e76e15e0af4ab9a6a09953274ee1b549666f3cf2f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa664ef-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638668, "uuid": "98d195e1-f839-4252-aa55-18c06680064d", "comment": "Malware payload (Mirai)", "value": "604002071c8e1eac6b853b442ae92658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638668, "uuid": "e7af053a-a4eb-4a4d-8ffc-c69aefb7f917", "comment": "Malware payload (Mirai)", "value": "89a9fbf82dcc4a577b1b1a4fce1fc3763c9bc961e7dad0d46a845c536e377c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638668, "uuid": "3b47ea45-b066-463e-9656-f5dd1fdfb225", "comment": "Malware payload (Mirai)", "value": "5308e9a465e2a82bc05a296668eae6e05913c0a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638668, "uuid": "d69a4682-529b-4dc7-8b01-95f4636e80ee", "comment": "Malware payload (Mirai)", "value": "0b1b137ed8053ef3ccce711538900d29a9b96c562ba27a38668366574f8f099b883866731a4f6d8da15ca0c297be268e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638668, "uuid": "a5d221a2-b14a-42ac-9665-5ac04fa02e0c", "value": "T1AC934A52FD818662C6C126BBFB5E028D372623A9E2EE7203EC155F2137C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638668, "uuid": "cbd5eb3e-894c-4444-b1a1-aeb433ea892a", "value": "1536:yxrBYDtjvAbUAtoX7PXf8kKwjHthHzM9qB/TEoW/3IrWZJeuya+kD:yxrBYhjvAbi7nrtZQcpTE6qZJ/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638668, "uuid": "05e63b03-13e6-4a9a-8c12-01392c1dbb84", "value": 89752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638668, "uuid": "dc146e2e-61b6-4bf9-ad65-1a2b83e1a2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638668, "uuid": "2ac6f891-f2bc-4b22-bc4b-cd01f2902efc", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8134f217-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778668547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668547, "uuid": "6b859475-7d0d-4261-9861-3a2fb2ecac68", "comment": "Malware payload (Prometei)", "value": "a8b7a00cfe25549ae6b95ef1def07962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668547, "uuid": "dc9231d8-657e-4712-8eb2-4784a351c4f0", "comment": "Malware payload (Prometei)", "value": "8a2b190db07c84a4e72b1137cadd6c63a0c4f7b77db1684b2059039254aa1645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668547, "uuid": "333d242e-0e7d-4773-ba29-55e8ee2cf87f", "comment": "Malware payload (Prometei)", "value": "3e4e4f651a88527b9e152c14ce72bc85aa944c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668547, "uuid": "04cd3a41-2175-424a-a91c-7f532af65ad8", "comment": "Malware payload (Prometei)", "value": "5a3daf369a664e3b53a5817be0f459bf6ff78539a642116626cd51954029b636c8e4f0f3a723b3388529b536ea911b75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668547, "uuid": "084730f6-912c-4693-90e5-969b1f425189", "value": "T145167E6BB1B354BCC15BD03097AFC663A835B4F40131BD7B36809A352E72E605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668547, "uuid": "9e1a8bed-359f-4598-a65d-0592dfed0fc1", "value": "98304:hiN8UtZkTarCS81X+HI5nZzZEWp91OKLB4k7FG3fE3xZf:ZO0OKLB4k33b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668547, "uuid": "7a8ab957-4141-4c93-9865-0af50214d698", "value": 4276056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668547, "uuid": "d1109ca2-abbc-4aba-9124-26cedaed7340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668547, "uuid": "dad4af3a-af1e-410e-a9b9-805c87b45644", "value": "c512cad695fc027f3d3df46159a1f1b43d7641c37d6ade44870c052e36496bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb673a6-4e9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778658396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658396, "uuid": "c6100509-cf62-4fc9-ae51-82034c6e79b8", "comment": "Malware payload", "value": "c30ffd5bcf5562a81504e95bfbf0b264", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658396, "uuid": "7697b668-0fb5-4060-86ae-208a258245e4", "comment": "Malware payload", "value": "8aadebc4fb43fb6cf3d81d5aa35eb479b9f38087d7f5fcd8f5767535dc548859", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658396, "uuid": "d9d6c72a-d727-4a8f-93f3-531923937b7f", "comment": "Malware payload", "value": "caff899aba3fca926315356db7932ff23716e700", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658396, "uuid": "1fa440f4-c924-4f4e-ab0b-d9ea642b21f0", "comment": "Malware payload", "value": "1be248abca71b448c1099ca8166a51cab90b4d1219dec1f5cd6b1d5b9ea9119653fcc789fce5e1bfe44cdbe1d972dac2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658396, "uuid": "1037eee2-c0ce-4f88-84ec-50abf296cc9d", "value": "T1C1853359B30626EF0B6634A73D9479A9E1F05313F7F4F1D9A73289A58B398F046C0A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658396, "uuid": "5e3a3928-4b4d-4aa7-b9c0-29681c23ed52", "value": "49152:gmMQ1pE5ZNKuePgl9akfFK4hobv982FvfseypbKt:pzpE5KuePgl9VBob7Fns8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778658396, "uuid": "9a0123a9-c1d5-4b88-804d-42045f9e436a", "value": 1805224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778658396, "uuid": "86a1d152-45a1-4658-b3f5-d9b53d2ce73a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658396, "uuid": "e7e6070f-1a42-493a-9b36-c6dc98b67a7a", "value": "nosequenombreponer.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fe0903-4eaf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778664979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664979, "uuid": "1ddee05b-d1a9-4c12-b0fc-3be8ceeb787c", "comment": "Malware payload (Mirai)", "value": "c01b5c2a2bff545c138d68157877ab4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664979, "uuid": "92d2b67f-c69c-4bfb-ba65-2518d8a4b282", "comment": "Malware payload (Mirai)", "value": "8b681b66df943cc1d486068ee7c3df72050c6f1d1b86ba31f5642225a89b2a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664979, "uuid": "0a19664d-af25-4dbb-802a-f2920fc4fcd0", "comment": "Malware payload (Mirai)", "value": "9ef4279cd024f4e64eccfe4e6d44d6e800f399fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778664979, "uuid": "27f1d6ad-9897-4ff7-b86b-8769a1aae1ca", "comment": "Malware payload (Mirai)", "value": "915b023bf56cf10dd5a8c5cea5cb1a8f9ab894a7012d681804e4c76a2d2257106e223384bc09b47477254bbca23e9c26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664979, "uuid": "a2e19c5a-8c93-48f0-a4a7-f069977fddf2", "value": "T1F5057D2AB2F3A5BCD00BC0304B9FCAA19535F47626322D7B36C4D9343D5ADA5136DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664979, "uuid": "9770ed2f-ffe0-4b24-ad43-2c1e5fc25aa9", "value": "12288:zpJW5Ngs/JTGE59cd8HENfHQS9CeKLgDN1ayRimEHX:zpE5NgBEKwINKLgDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778664979, "uuid": "c3110ea0-9353-47ee-9e16-e152015c4f71", "value": 815504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778664979, "uuid": "09987a45-538d-49ea-8621-ccbf7c0e1877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778664979, "uuid": "e11946aa-c292-4547-8e00-1ae5fdb0009a", "value": "8b681b66df943cc1d486068ee7c3df72050c6f1d1b86ba31f5642225a89b2a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c0b167-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638757, "uuid": "8c18e9b3-e971-4d3a-9248-c32c245dfa4f", "comment": "Malware payload (Mirai)", "value": "d0b22968f70c543be4c5700e53acdbc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638757, "uuid": "f9c12fa4-8d5a-47ff-a8ca-7da82e7d3062", "comment": "Malware payload (Mirai)", "value": "8b89a6300818a01547640285d0d05731f9e77749137e369a490725446ba420e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638757, "uuid": "84896446-57b6-47b1-ac0c-9d03602bb648", "comment": "Malware payload (Mirai)", "value": "5a4e50909cd1b9d97099793b0f7a77ea0cc8c483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638757, "uuid": "7f86beaa-f9e0-40d5-ba6c-4028cc08784c", "comment": "Malware payload (Mirai)", "value": "2aa317efe367bbabac8b2d9223b7f0717d47373e2a530e134eaacd97955bde1390ae214e03b0cdb5367750ffb2008253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638757, "uuid": "2518d101-49d7-4cc0-a64d-e87c0c7a0cba", "value": "T15B8317C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAADE65EA73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638757, "uuid": "86283073-1130-45d1-a934-8b56a155464d", "value": "1536:8l8IhK59kLMSbr97zmWAcanWCay3Txdgo2F62hpyl9:8/hU9ktbhmWnJwTxdd2gl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638757, "uuid": "ba964b4b-7954-4042-bb9e-f61a1fed16c6", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638757, "uuid": "33ad362a-c277-4958-acd7-f4b20fd79b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638757, "uuid": "501aa606-e5d4-4b09-aa52-953978803b5f", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f053ab0e-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638669, "uuid": "13f3cb1b-44f3-460a-93b2-f4f008511fa0", "comment": "Malware payload (Mirai)", "value": "812f6a96383679354ea0b822bd6d3b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638669, "uuid": "f0af1b49-edef-4448-a005-f41d558b5d03", "comment": "Malware payload (Mirai)", "value": "8c09c3c03952e0e381d3df1f8d759678899a9abe8db55b6afdeb41dc1cd4bfca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638669, "uuid": "2925a163-f762-4938-9db7-656dd3d8aa8b", "comment": "Malware payload (Mirai)", "value": "a8e6685c1af72069766bab6e6e5c3a1408e31c41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638669, "uuid": "fc1de59a-5060-47e5-bd81-36f6c4194941", "comment": "Malware payload (Mirai)", "value": "d62bf543993878b5286ed4cd3a561e3bb93cbe1f18e074c008852b03b8bb327e714c8cb188dae976f0d54f46cbae2787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638669, "uuid": "18d82c79-033b-4290-9b01-287b04a03427", "value": "T136C3AEC3FA8714A1C46206F107C71FAE2F93A121CE5FE4E7AC1DB63B5A7A4DA1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638669, "uuid": "b06ba460-c423-45b1-90f8-f8d57d0f66b7", "value": "1536:CrMjtT/2h9gVqXjVCnXQYlWuoPJU+1AYjlcoKFccxs5BNgRCEi/LWJ:CrWT/i9kXQSn+P1AYjRKFcpgEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638669, "uuid": "3e961944-65fb-4bda-842c-b343f84a04bc", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638669, "uuid": "81f1f630-c8b0-4f08-8711-d1bc3ba3c61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638669, "uuid": "fcbc7c59-d8b7-4de0-ac1f-4457b0c36d30", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b5690-4e91-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778652330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652330, "uuid": "5684c3cb-e6aa-47f5-af92-f20f6a272e35", "comment": "Malware payload (QuasarRAT)", "value": "67dfcea351219410b9e30d2fe542d815", "object_relation": "md5", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652330, "uuid": "46e90be7-98e6-47ac-9f6b-6bacb6ebbca2", "comment": "Malware payload (QuasarRAT)", "value": "8c3f86f92a95d2820f6173f18b2e0a7047cdddd835909f88ecafaee65a7011da", "object_relation": "sha256", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652330, "uuid": "4bf4982a-3051-4046-8c42-a9180d5c7d3c", "comment": "Malware payload (QuasarRAT)", "value": "08a71c0dd7af8e59b0c0c5da6be14f8644f0491f", "object_relation": "sha1", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652330, "uuid": "fba81ec0-18d0-4ccf-9a92-9b3939464cad", "comment": "Malware payload (QuasarRAT)", "value": "62eab1dcd8b120fcd2576398cafda9f832bf4f102f2efda4a7df2a9aad667bbac21726dde2bdaa000639e5141e6131d6", "object_relation": "sha3-384", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652330, "uuid": "9c7ed77b-413f-4e81-953a-a31a1d70e632", "value": "T1B3E56B1537F86E23E1ABD2B2D5B00016A7F0F81AB3A3E71B2682A77B1D53F505841767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652330, "uuid": "c3b8ca69-9db9-4042-94a7-8a3d47ce5bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652330, "uuid": "779d5ed4-10b9-4fb7-88a5-2845fab05524", "value": "49152:Z7ZnsALjoXepKa6Pg92m+qne3OweaaMeREBHHB72eh2NT:Z7OALjoXepKa6POT+qeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778652330, "uuid": "eb7b368a-ce9e-4e00-8629-26b45f336579", "value": 3294720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778652330, "uuid": "5de910c3-2aff-4465-a0d4-652efe303f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652330, "uuid": "97fa1844-d23b-4108-abc6-af97630f7eac", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91219460-4eff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778699498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699498, "uuid": "30246183-85a2-4ac9-b45d-b07c7569ba5f", "comment": "Malware payload (Mirai)", "value": "be54f7f594463280930cc96a3220cc97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699498, "uuid": "6dc869a9-07a8-4ef6-9ab8-aa95e1cc86e0", "comment": "Malware payload (Mirai)", "value": "8e54ca8267bce34c704d237614387b53220f0a5180a20ca5e30273946c6fe33f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699498, "uuid": "d8102980-2954-480f-b555-db5af22880be", "comment": "Malware payload (Mirai)", "value": "73203320b8cc7abf99f91ee0e6199e80ed6acf65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699498, "uuid": "f760c218-430b-4898-904a-fde8b1b6b82d", "comment": "Malware payload (Mirai)", "value": "91a62b3d86f04a528029362565517c1d4333cb872c67ae90960b63b7f0fb7bb4a21cb6337636d1d82e7d9b972d1b888d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699498, "uuid": "6bf4c266-4974-435f-997b-82d869156456", "value": "T170A3022459BBDC7008929BB8989E8FE21F7BB6E4F1D5539739790A3407C60C53A8F493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699498, "uuid": "17624b8c-62d0-4bdd-af48-e1f6bb403177", "value": "1536:n9ZHQfUrwBOPCbR3gsLfT+vJWGBJSKwVfTzrg0jalaMXPk44EkULSvetJ2fkUJLf:3wSYRwsb4L0KAv+NGEkULSveJKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699498, "uuid": "6c98adf9-034f-46b5-b5a5-58e10d4930bb", "value": 100032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699498, "uuid": "565d084d-914e-4c15-9343-163e95501431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699498, "uuid": "c62099b3-875e-4021-8c81-1c1b6aa23642", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec557632-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638662, "uuid": "ac7bb830-b1cd-460b-99a2-3c375ee392f3", "comment": "Malware payload (Mirai)", "value": "72058037fbeeeb6d96a20fad1e98c1bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638662, "uuid": "8514669c-470d-481f-8f96-bf00f582f64a", "comment": "Malware payload (Mirai)", "value": "8e56c832fd5cb03ca98597d5905130a4b68c947f5c5fd01f60782cee70d12d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638662, "uuid": "e95cf7e8-d36b-40bc-9f57-57970210d904", "comment": "Malware payload (Mirai)", "value": "143b63ec9abfeb99e969748f28a81a68a90f6c3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638662, "uuid": "316af1c9-b8dc-4108-a658-77439afc917d", "comment": "Malware payload (Mirai)", "value": "6942484aee9855bc597efd2548ba93de84616b1435bb764821d70c7f150b89a0863dcaf3570041a36a18c2240da0123c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638662, "uuid": "2a269456-b512-481a-af08-2f49a41b9f7c", "value": "T1AB932952FD818622C6C116B7FB6E428E376613A8E2EE3203DD255F2137CB95B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638662, "uuid": "7f7d5951-39bb-4625-a6cd-f1aebc742560", "value": "1536:a5tLkg6zvSjbNISR0Yszk9sYJAx9hfSsqDzX6HXjQlZmTWvuaH0:a5tLkgMSjbNlQYJ4jfVqDzoT4Nl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638662, "uuid": "e0857610-8c92-4059-a187-ce6693f358b6", "value": 93264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638662, "uuid": "a4ec0ae7-84ea-4dd1-b72c-e52d52c0bb77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638662, "uuid": "2b7042a9-507d-4087-8b5c-34aba0ff0b96", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f921253-4ed3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778680463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680463, "uuid": "021ef8a5-8028-411e-8ac5-cfed870f8632", "comment": "Malware payload (Mirai)", "value": "d67ac958e51d281bba0e93379ca955e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680463, "uuid": "657f47fb-f2a3-4932-bd1a-4931367983dd", "comment": "Malware payload (Mirai)", "value": "8fe78c2a9811e2a9a7a51eafe4f58753949a0393db52b4342ce503a7815c07db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680463, "uuid": "743aa74e-d1d0-42d9-b57d-472501a1f389", "comment": "Malware payload (Mirai)", "value": "9dc66e16857935d83ea9c4a77035894964db29ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680463, "uuid": "e494e2c1-1842-459e-87c2-21ecfbeb1279", "comment": "Malware payload (Mirai)", "value": "286657e0229d5a61f58d0b9631b7fe8426f9eeddf9b1dd963c18ddaae63a1a11b89f864275d5ceaac1f3dea8b07eda97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680463, "uuid": "2ecd20bf-632f-4584-9569-59f8b3bdbb3b", "value": "T1A9A34B81BC82565AC6D4637BB96E568C33A653F8C2DF3256CC128B25378A92F0D77F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680463, "uuid": "1cd3c371-f7e5-4087-a6dc-0d5988a6a2ad", "value": "3072:WCPng8VL11T72hV3HuqG2mYNBgIpFUSbG6cauzY:rPnbXveV+GgIpFnGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778680463, "uuid": "52285457-135e-466a-a8ad-00301470da20", "value": 100412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778680463, "uuid": "df0acda9-9f83-4b09-a152-a867704584c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680463, "uuid": "5993d53b-e8fe-48ff-87d7-6fe71d8322a1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3102ec5a-4ec9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778676144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676144, "uuid": "6e1b0a16-8ea7-418a-b86b-6f4b94cc96a3", "comment": "Malware payload (Mirai)", "value": "ddf9b016ed10587e72f6a1fa3cf1e508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676144, "uuid": "9cc7d130-b744-40d0-b67b-e01d4e2a363b", "comment": "Malware payload (Mirai)", "value": "91c9d3d0b2094795c70f385e437392540eda954721c42c8dd3831c60f16b0c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676144, "uuid": "f93869e3-1328-41d6-b4b1-f3d428f97f90", "comment": "Malware payload (Mirai)", "value": "3b0eb575a1732f30d54b8c7f99fc97d852473487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778676144, "uuid": "0a00ff63-fe25-4f0f-941f-d5df8ff8e01a", "comment": "Malware payload (Mirai)", "value": "9d517226b81039af730cef23e06104b95d952569c5c7601e6d5f6a3870be54ea4065d9842cc39123f91c813a846d56a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676144, "uuid": "72d4c3d4-bc47-4af8-8920-03a08394b8b9", "value": "T15C830852FE41D951C5E828BEF92F42CC334307ACC3DE72029D01AB35A9DF5594A7AE52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676144, "uuid": "ebfd4938-79be-4bdc-978d-d4975df29879", "value": "1536:5E0qrNjzY29Ok2MwVanaJsBTC/rsbjhXV98O7rhO2DXv0aC7:59S1qkrnnS6WUhXD8krPMaC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778676144, "uuid": "d1168476-607c-4dab-8a1b-35bf452575ae", "value": 85996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778676144, "uuid": "279f19a2-c8f7-45f6-ad2a-7b5a4d13c9ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778676144, "uuid": "65f95f83-af42-4872-bcd5-77f5ba393a8f", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aca4f7d-4e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778635761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635761, "uuid": "f12c0eef-04c7-41e2-8d6f-9c5b6e8c792e", "comment": "Malware payload (Mirai)", "value": "efa8d10d07033d34f098891cfd90f5f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635761, "uuid": "a73a47b8-2ec9-48eb-b0b2-33e540780c68", "comment": "Malware payload (Mirai)", "value": "9233ab2516e676fc6500a30a7bf61c269d09f84b22b928da9c3bb96803d7c9e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635761, "uuid": "d174c05d-321a-482e-8270-41714c863235", "comment": "Malware payload (Mirai)", "value": "c15579dc959da84ae82e18cad475ca60cad97b76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635761, "uuid": "523d5025-9d61-436e-8f3f-3d71a2c61f3b", "comment": "Malware payload (Mirai)", "value": "c1d249d5f720fe50a7f4e73ed1e5adef7d5621734e7ec55bb331580bc49ea42a273ed74931cb098afa30d68785780b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635761, "uuid": "7caec2a3-9c06-42ce-ba2f-03eede2f2cab", "value": "T1BD530160C7488CA8CF90D57675F1DE031CA69E6FE8DE12D36130A6A293C50D57AFBC26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635761, "uuid": "9767b10c-f4d4-49a8-9c92-1f7cca7686ec", "value": "768:x9Z09yt09GTcgVK7MSZOjvO9Q+Ma+APTGxxNEfQT1D+/tYettnOtofBKvnq9Xm2Y:xY4YmgMSR9Q+MUPiVKK1D+VYwE3qXlCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778635761, "uuid": "7caa0fe5-80d3-45b1-8950-451538473c29", "value": 61404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778635761, "uuid": "3d4cda62-19d5-4dd9-8a90-645cfa472a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635761, "uuid": "7d7e1267-9bb5-4e13-b536-42e256b3672f", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd91a09-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700777, "uuid": "cace5cda-32d1-493b-856e-8a1477b5d76c", "comment": "Malware payload", "value": "6f675231acb3a55fd4e736f00ebb1b7e", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700777, "uuid": "e5115edb-8f24-4f47-a8c0-a31ea85f04d1", "comment": "Malware payload", "value": "9349e5bf051233ad07db787994e36c05f5e356ef863082d9b282f5cdcbd2f2a8", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700777, "uuid": "b0ade8d0-e121-4d51-ac3f-a7ba49b11557", "comment": "Malware payload", "value": "e52e9d1731cf915402b2939d912892c6d1f77c66", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700777, "uuid": "c7ee2e8b-572c-4acc-98c6-c6051ef5a79f", "comment": "Malware payload", "value": "db8b83c2d994aa125b2ba9ad4e643c24f90be1ec1633dcc0297e13017549f1c91429c20150a0ba8bd2f3abec92404409", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700777, "uuid": "02b4791c-7d86-4d48-acb5-2530d2f12e1b", "value": "T11E6633C5C3E8E6396A9BD630C6EA1DEC0583771F76B70059449EDAA0F36C2CC9B64532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700777, "uuid": "eaf1baf9-73c5-4cee-9770-ad74d709e954", "value": "196608:Mn57jc7qWGL+jSfba9YZDRzbeWIo260X0O:Mn57jcuWGq9oR3ey260l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700777, "uuid": "a9b15034-4657-4e5d-b891-9481deb76e9c", "value": 6503598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700777, "uuid": "af709f6c-0579-4864-b161-b9d6247a05a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700777, "uuid": "efafed63-aa10-4258-a038-2af5385b412f", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47167c5e-4f18-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778710111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710111, "uuid": "793bc6ed-e6e2-46fa-9e13-1942b418285b", "comment": "Malware payload", "value": "560d3cf53dc3e9ed91a23e90a97e105e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710111, "uuid": "78530208-f81c-4a4f-8715-c4d0c5a35d72", "comment": "Malware payload", "value": "963a40412210c782c0ba87eb273c4b750cf5e330b5224a9fe57c95f93ca27f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710111, "uuid": "4d13190f-a699-4882-85e4-066c3d78b720", "comment": "Malware payload", "value": "babe23ea053ae179c5f69fcedb1abed016803bc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778710111, "uuid": "4a05a817-5a47-4a22-8621-75df8deb982e", "comment": "Malware payload", "value": "6dee8a60c293a72d0f685ece199803130b37ed720347b37194bd7ab4d817b40858a45fbb5b12c3a8921a87a24fc13956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710111, "uuid": "1e5e68c3-a0fc-4124-aee4-9035541c248c", "value": "T194734902F9E250BCC446D071475FAB26EB71B84843257BDF67C87AB13E66E902F5A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710111, "uuid": "670bfafe-2ff6-44c1-86a9-9953fa3317bc", "value": "1536:HXPKrNu/a6D5crtxsDeD9kgJBtBuDerEgbQ7zTVEYyxSAb/K23na6VhNp3KIDZI/:HX6k/9CHsDeOgrGD1VQfyS7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778710111, "uuid": "8745aa33-00b3-4c79-89d6-bad076d37743", "value": 75080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778710111, "uuid": "0faaba83-d7be-4407-a384-5d5d34ca05d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778710111, "uuid": "32761784-64a6-475a-b923-4a67f6155b18", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2018a95-4ee0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778686292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778686292, "uuid": "bf033c21-e934-4033-87fe-c8cdc090d10a", "comment": "Malware payload", "value": "5ae81a09156d61f9c5e05b3f00af5b60", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778686292, "uuid": "a3d52cc6-6498-4317-aea9-9ebe2808222c", "comment": "Malware payload", "value": "97361a91ba80981ca549ed19b2e2b9250fed6231027cd15418578b3db76b02ab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778686292, "uuid": "4d7c2b1f-9afc-471a-a2d4-5e9108d1b34c", "comment": "Malware payload", "value": "2508e6326ec307d226d79c91e7e123e4a5b5e39e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778686292, "uuid": "22afbb0c-534d-45e6-9be6-417ab5c13c96", "comment": "Malware payload", "value": "510da96664aeb670df23f5a3e2536e0a607e57394a7042d62705e67811d262baf83eb2ea8e4b1d9bfa6cc485612ab5d2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778686292, "uuid": "9226556b-7007-44d6-a7cf-f12c333a466f", "value": "T199A33B130366C8F8DC2F6C173A2C146A7941259036ED4F9AE9C7C69692DF0D63329FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778686292, "uuid": "b5fc2b53-76d1-4121-beef-70b528a986f5", "value": "768:DQrQaAvl5mHlN9tttttttttttttttttttttttttttttttttttttttttttttttttx:oY5mHMnXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778686292, "uuid": "f338260c-b972-4378-9b9f-4a7d08385677", "value": 101162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778686292, "uuid": "3f94b555-c924-40ea-b20e-9dfc02dbde90", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778686292, "uuid": "ac471052-c103-43c7-94d5-7a46c3caaf37", "value": "4_13_1_1389_28.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a982a83-4ea0-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778658658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658658, "uuid": "3f5be2c9-39e7-4000-9028-64dfca3fa8c4", "comment": "Malware payload (Prometei)", "value": "b0805ba965815b8fb57c9fd683156816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658658, "uuid": "26ad4402-526f-4e9d-8b29-fadca3b5a9d7", "comment": "Malware payload (Prometei)", "value": "994cfbe672e8008f3d925ea63680c39147704366eaab35183a592d4928835ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658658, "uuid": "6c02f89f-8c4c-4ff5-8aec-ef120810d092", "comment": "Malware payload (Prometei)", "value": "566a5c179ea4d8275a807f95a580564ae88efe11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778658658, "uuid": "59075556-c0f6-498a-8d96-5387366deed5", "comment": "Malware payload (Prometei)", "value": "0e3b2d7c99768d92923a6fca8ca6d33613fd57cb51738529689b6b3413d927ff7cc3eb1daca7b9dfed58fbbd07a3ed11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658658, "uuid": "b1d4596c-853c-47c7-97b2-623334404367", "value": "T145A423B4F9219E8F6DD769B91B24831DE181D172689D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658658, "uuid": "1f0d267c-cf18-443f-b24d-263ea8018794", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdB:Fs6pyCC/Ya2hpi6T6N4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778658658, "uuid": "04438984-72be-4500-8cee-9fa216dfc833", "value": 449085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778658658, "uuid": "95de2f01-3789-4b90-8087-2618909062f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778658658, "uuid": "e2a4b79c-a350-4d33-9924-09aa50ba1ea1", "value": "994cfbe672e8008f3d925ea63680c39147704366eaab35183a592d4928835ac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9de7a3-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637915, "uuid": "7ea73ae3-c5b3-434f-9d0e-9ad017f755c3", "comment": "Malware payload", "value": "bf3231c84eb50b2b48ab77028de023c9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637915, "uuid": "d868e6e4-3bb1-434c-8d30-56df63c17639", "comment": "Malware payload", "value": "99c08205b30f670a43a2c50de4bfb1956daaee5aa3e291843fcc82d8e121cfb5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637915, "uuid": "3a9d7eb4-779d-4b2c-9c13-6387714f91c8", "comment": "Malware payload", "value": "66aaad45e747d48a6e4043d884e02bc12231ac3e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637915, "uuid": "88793bb2-c1a2-4d4c-aaf1-7ee7aa41dc8b", "comment": "Malware payload", "value": "088ac233b7382370a0ce4152653c113d9167f3511c318bba668fe02092b4d770123e0b834ceb85c23e0a7f20d986b285", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "bitajaxcloud-icu", "colour": "#930CCA", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637915, "uuid": "815b1b2e-6a30-4330-b490-3373bec88770", "value": "T177973385F86DB5A2C3F9E8B47E58652BE220E3B8E1FAA9071D74B11484E33D15700F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637915, "uuid": "8f3a2840-8fd3-49da-b6d3-b03be5119a01", "value": "786432:tU+nUtjIUFvkv82jT/MxoqEo9WZVkD97hbs/j09M:tDUpFvkv1EGqsZa9wjOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637915, "uuid": "f939da60-4995-48e3-a973-7cb3314d639c", "value": 41054699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637915, "uuid": "aa3465ea-a68a-4329-a2bb-38c4d7ca095c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637915, "uuid": "17eedf19-9ece-44d8-bab2-71b3b1ecf97e", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3d92cb-4f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778707432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707432, "uuid": "4db1ed1d-2e0b-428a-83a5-6f3fa024cb27", "comment": "Malware payload", "value": "0745133e5d4294c738187fee331d49bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707432, "uuid": "28910876-0fb6-4302-b0d0-52dd9eee9c34", "comment": "Malware payload", "value": "9a22bc5a297c4b15802aced55171cb050467d0b3d9b4ad6e3474f364be8fe6c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707432, "uuid": "265a0687-9c48-40cc-ad3b-fa20de5e76f4", "comment": "Malware payload", "value": "36f376d44350cf3f641a629d11accf72b32c202c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707432, "uuid": "63e758ae-c2eb-4960-8f1f-5f0601195bb4", "comment": "Malware payload", "value": "8e1a4245ea4deac4680ef17ec72a8d66e60f818c1a5c57bc8e4ac44b5937f225ad389196135ccbf52b960e2e457fb631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707432, "uuid": "2eddfc72-42ff-46f8-996b-8d4d1dd9c9c5", "value": "T197B30876BA20EF2FC40E83306873C75015D52DB52E925ABE3264EB9C7E3415B1E5B9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707432, "uuid": "d98f15ee-f437-4d8c-817c-89ca64b5b8c2", "value": "3072:tqSlwygtgQTtaHKBkv8fZCpjkTbq7i5NOxmYG:tDwygtgQTwH6sjkT+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778707432, "uuid": "2bf8def3-85d6-4643-8d65-faec582af216", "value": 117324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778707432, "uuid": "c10f02f2-a693-4392-b490-1b849e9d1697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707432, "uuid": "b16eb23c-8ee8-4883-afaa-ba765ff56c08", "value": "SecuriteInfo.com.Linux.DDoS.2637.17608.2004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d16469-4e64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778632939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632939, "uuid": "ad0721cc-1dd3-4f1a-bd18-ec7a57474bff", "comment": "Malware payload", "value": "4885638f35f6de9f2d55eb83853539d3", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632939, "uuid": "f1bdb89a-e3c9-458f-94d1-e39efb8022ab", "comment": "Malware payload", "value": "9b578e423a61209c8818391be449dc1b69a9a8cb64bf53e3c80e868437de6c88", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632939, "uuid": "27867530-b07e-41e0-ab32-b5d13dcd1347", "comment": "Malware payload", "value": "3c8c12f569f3b5d379ec5190ad7d234efb1d7f4a", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632939, "uuid": "6365fade-8ebd-461f-9e45-74803072ac8e", "comment": "Malware payload", "value": "2a11d20d27e8d56bd0d01b0af5986f8a217f292554728be502a715833a89f7f2604cff5ef7405526a97219e113bb505c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632939, "uuid": "a7b7c375-18d2-4c09-aa72-e518fe982455", "value": "T16715D019D7E405F8E0B7E578CD534912EB767C4947A1EBCF03A4A9A61F23290CE3A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632939, "uuid": "7ce2347b-95c1-4533-83f4-1ac94f127e7e", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632939, "uuid": "7af510fb-c61c-4b3b-a0c0-6307bee80981", "value": "24576:525kkKdcLt08/9urpavWiEJac19G4SYxIHL:06xcx0yWgsF19XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778632939, "uuid": "1126f006-e9db-4829-9b21-2d2ac32ba6f8", "value": 908821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778632939, "uuid": "b244ed5c-a7ac-4df4-9411-64d9523dc3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632939, "uuid": "9981d9ee-dda2-4bc7-92a1-ad5b32f9c045", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d859aaa-4ec2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778673319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673319, "uuid": "3ed4ee0b-31c7-408e-84ff-fd98c399c477", "comment": "Malware payload", "value": "172d41e5f6f4c3f8b37ebe27c328675d", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673319, "uuid": "a0440bc8-aa5c-466c-bb7c-7107e9ac50d9", "comment": "Malware payload", "value": "9eeb8ccdcaf90c1adf7af0dc35899fcc60639208817d65634519ad0481138da9", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673319, "uuid": "aade6ebb-88ac-41fc-a43c-3680b9e4983e", "comment": "Malware payload", "value": "bd8bad15c160e8279d6f694e28f4a8813c3af900", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673319, "uuid": "e3a3d4af-a977-44c3-a3fc-8922f50392f1", "comment": "Malware payload", "value": "b591d6085aa82af7b4bb3642e630d89106067c2ba83b6433dcc234963ab2179239e25584f29f9c92b22c8fca8f9a88a4", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673319, "uuid": "1e4dff2d-f4bd-40f5-b42f-3fa028b45f04", "value": "T1E1E2B018FE00EAAAAFDF74EC502A0106C37D64A655B87A5EC794F2103E16CBF415513E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673319, "uuid": "e948982a-2d46-40fb-a8dc-ea5cbc1cd8ab", "value": "768:eoocVxjnIL3bhOGpSxBup5pxC6tfcrO3vhLl64ajvjObtkMN60tZ:eo/VxjnILLhOGp+BupV3tBdg4mbHMwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778673319, "uuid": "0c2345f1-3003-4237-a82a-22f052e3e30c", "value": 33298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778673319, "uuid": "64d6aba2-7967-4558-9649-ab4ab6912ea9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673319, "uuid": "e2df3617-7e9e-4033-b248-9b19c4d44893", "value": "evelo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913be8c2-4e96-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778654401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654401, "uuid": "b23c87ff-d4f6-434a-90b4-99a1a20ed0f5", "comment": "Malware payload (NetSupport)", "value": "9c4e14db8cfb10ae8d9f1bb477144461", "object_relation": "md5", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654401, "uuid": "e8750561-0b44-4871-80e3-69e214eae59f", "comment": "Malware payload (NetSupport)", "value": "9fc308606f49a3e319e881e6dd92b534881ffb37aa6939d38e1e882470cce2ab", "object_relation": "sha256", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654401, "uuid": "5c602b2a-b746-49cf-a218-acfc3f83c814", "comment": "Malware payload (NetSupport)", "value": "ea392cc47e918e28a3b4163cd7fbe474b749f740", "object_relation": "sha1", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654401, "uuid": "88cb2344-0ef3-45a0-8931-ef725bfa0e19", "comment": "Malware payload (NetSupport)", "value": "53fe929d3fc7e6a113eb7efcafca49771e65ac716245fbf3035f7f011daf44398003f00a87891b83e9116f4862babfb0", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654401, "uuid": "d99e6a7d-d471-4b57-a735-db45eaa121fc", "value": "T186C533132C08E276E1310CF4D282D19D4AFADD1159A02615AF31F2999BF56E7CBFA27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654401, "uuid": "b43d88f8-f964-40be-9c52-063175125b88", "value": "49152:9BNv5364ylbvT3O0/EY+dppCZ+GcDuMca1b5nZ7M75rDyY2/Onx/z7tvY:9BZJ64Ab7eHYMpC8DuMbZ7M1rDyY2/iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778654401, "uuid": "2891da0f-60e8-48dc-89c9-14eabbea0187", "value": 2531328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778654401, "uuid": "e495a3a5-f4c5-4368-b6bf-5dfad48dc31c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654401, "uuid": "47b92629-ee89-4cfb-9378-02b745ee6624", "value": "installer(1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5928d2-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698713, "uuid": "c8796ad0-d41e-4f4d-bde8-7e9a6245489b", "comment": "Malware payload (Mirai)", "value": "2951b844aadb8ec07e90b767a09791b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698713, "uuid": "ed78a14e-01d2-46d5-8e85-d0d9ea984e08", "comment": "Malware payload (Mirai)", "value": "a0bf0e9827afb102f887de73ecd6365944c3a536c9a5063b9cce5463782b8f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698713, "uuid": "98aebc79-0ec7-44d9-83a2-ebeb2347f3a1", "comment": "Malware payload (Mirai)", "value": "0e49f4c9ad518d8a5647eb302c33f82ba4595f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698713, "uuid": "d1965446-3067-48e9-9568-cd058d6d2d52", "comment": "Malware payload (Mirai)", "value": "d14ed6eebb1351cb1bb133883060b6ce7881c62b99a23ee9a6af1d212c5608b610e6182cde0849eea8ca99577a7b44fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698713, "uuid": "1ec6a7c1-fce7-40af-9677-ce2634147247", "value": "T149E36CC1F743D4F5D91A01B02077E336DA72E43A102BEE93D7AADE32AC92651961B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698713, "uuid": "96dad00a-3e81-42dd-aeec-e3dbeff85bb1", "value": "3072:Dh0mBXUkLggFayaHuRgtabhrZxHRACogQGJgcS4bJqZZujG05HUGqGny:N0mBXUkMgFapORgt0NZVR59QGJgyj79G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698713, "uuid": "a7d709db-227b-470a-bdb2-8cccc0532513", "value": 151848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698713, "uuid": "3ac98013-8881-4c9a-ba17-f72e45d0b46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698713, "uuid": "bf48537d-8e6f-42cd-935f-83556e8a7b79", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d98a91a-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698096, "uuid": "efac310f-6523-4a17-8075-dafe8982e170", "comment": "Malware payload (ConnectWise)", "value": "b2221f82f9e9db8f5300863321d8c40c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698096, "uuid": "423df06a-c911-4730-8796-8b6535046dbb", "comment": "Malware payload (ConnectWise)", "value": "a186a3b11f293899037234126d1676b9ccfcf7f7c12cf18822affec48a8921a5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698096, "uuid": "42917c65-8caa-476a-9529-e039cbaccec7", "comment": "Malware payload (ConnectWise)", "value": "2832dadd6f2538780be97e8cfd7b9b38a8aede93", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698096, "uuid": "04a6f25d-df8c-4275-885d-ae50ddbd6e8a", "comment": "Malware payload (ConnectWise)", "value": "e81a018d25c206d7eaf0c067d5446673effe941b299ada82819973a55818ca2b5f24e80b646feb4d97c46a70e4cfff18", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698096, "uuid": "bf84a708-fac1-4a33-8cb1-4907a35f84fd", "value": "T14C46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698096, "uuid": "bf339d00-b72f-4007-9917-62fe457c0929", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698096, "uuid": "e40f10a6-81c9-4844-aebe-d4c72b848665", "value": "98304:2zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:2hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698096, "uuid": "79064ed6-6963-4532-9fb1-0a5bb8967413", "value": 5642648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698096, "uuid": "f5334909-ccf8-4e61-8368-535272e0abe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698096, "uuid": "5dd2e3f8-dd77-48be-bbb9-110061ce569c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dbc665-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682302, "uuid": "86a39017-2dfd-4add-b830-5a935fae3351", "comment": "Malware payload (Mirai)", "value": "704f60e78d96689703993bc404db0d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682302, "uuid": "da152684-9fee-47b2-b0d9-33717115b8ea", "comment": "Malware payload (Mirai)", "value": "a206cadcd035efabbe65673b8f12dcaf3a3ca39a9d74de755ec3d294e0e4cba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682302, "uuid": "9cae338b-1e12-48b6-bfde-66bf33f0e22a", "comment": "Malware payload (Mirai)", "value": "3a7383ff7b0524b396ff59ec170963d7a0b5d6c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682302, "uuid": "c5d7ec2a-d049-42bc-9876-17f5bee71d4e", "comment": "Malware payload (Mirai)", "value": "723ed6645e00e884507af9c0135e91e64dfc8f99c98010cdbfad1ec137f8004371d8a6152c85daafea18ebeb4e4d7680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682302, "uuid": "ee9096be-f997-4739-a7cb-1c18f7dc89fb", "value": "T1A3B32945BC928B62C6C713BBFF2E428D732263A9D3EA7203CD255F21778746A0E67151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682302, "uuid": "a86c8b83-ace7-4e5c-a15d-dc1a9b47f196", "value": "3072:O4SVd2sEbW0iO1b4n7/t1CKU9meyMuWIi:3SB0iO1Unbt1CKU9BPuWIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682302, "uuid": "a30c044c-6363-4ed3-8b11-3143f018d4a3", "value": 116668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682302, "uuid": "15314a6f-ed54-4b27-8dd3-ca77454f92b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682302, "uuid": "0c3247c1-31d7-4749-8b4f-1da570b028d4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614c201a-4ece-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778678372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678372, "uuid": "eb74814e-11ea-4d93-bb6c-98c9b460c431", "comment": "Malware payload (Mirai)", "value": "cd9ea84a4cb390a44ab29189e9b795ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678372, "uuid": "6e936b65-43ea-4b4f-886d-25183726f24c", "comment": "Malware payload (Mirai)", "value": "a4ea8311004e5ba1c98a369b3a94ecfc1eed237108f5f2fad2ec0e6f93a92f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678372, "uuid": "6050c962-f8fa-4d1d-a919-023b0bd00873", "comment": "Malware payload (Mirai)", "value": "3e0289890657dbb05305ea153076fd90644a4afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678372, "uuid": "685118ae-8758-4800-a5aa-18d440b02e82", "comment": "Malware payload (Mirai)", "value": "e4e04cf74eb4ac05e2f00641a1d8802a0237df623ef7022d8de479d18ac77756b652e79ea3cb8c8ff92c13f13e62e2bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678372, "uuid": "68a82318-2b82-4186-a1e5-f29b095fb3d3", "value": "T107145C06B31C094BD1632DF02A3F27E093EF9AA124F4B645755F9B8E9272D361485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678372, "uuid": "58797fdd-37c6-4834-b163-ec327718abe7", "value": "3072:E05gh0feFTskvnzjYqhwoyG7BxSCJ7ROMI4Vwr7MOcs:neh7BxSClROx4Vw7as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678372, "uuid": "bbdff94e-1cc3-4ee6-977d-3f4ab371afdb", "value": 201552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678372, "uuid": "92b21e4a-86e8-4a26-bd47-2b8a3d8be997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678372, "uuid": "933c247a-1ff5-456c-be5c-537e89d534a8", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f8d5e4-4e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778632422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632422, "uuid": "d4289cca-179c-4557-b560-f47ca1188ee1", "comment": "Malware payload (Mirai)", "value": "6ae294f5a2ed1b2b96fde8597c9d80de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632422, "uuid": "af97cf05-9c9f-4d60-ab93-50f15a5f105c", "comment": "Malware payload (Mirai)", "value": "a5f097feb9ab70708ab022194e1a6d2bb1fc0f23ce6ebac83d4c9e4d6e8ed2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632422, "uuid": "2ccc28fe-865f-4a90-b5f8-d6f166777c51", "comment": "Malware payload (Mirai)", "value": "960fee18ab63dd56d8f191d19707e051a252e083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632422, "uuid": "da54b77a-5007-43a3-a898-dcac9a3f8812", "comment": "Malware payload (Mirai)", "value": "b2dc73241dba97ea6fbeb1021fbad12790cec265b10dfc62c2f42839a1ccb604bc4f1c9cf2fab6b152ad563312f3ad26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632422, "uuid": "c1cd440d-c803-4cec-95da-8ff90747e102", "value": "T1E7E3189FFC81AE6546C1277BFA2E418A331327B4D1EB71139D041F2876CA94F0E7A652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632422, "uuid": "0d5802b6-d1f5-4c3e-8f7f-4ddb6f2d645d", "value": "3072:T2s/ITo7WCkybotgsJ913DhrbW4UYSx7QpUiB5IQggEuaJhnR1rm3:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778632422, "uuid": "e587fd87-c36b-4179-87cd-b6d1a930081a", "value": 144000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778632422, "uuid": "8a0c4a94-5374-459d-9ef5-24d06dc997aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632422, "uuid": "55edee3f-1242-4a73-9093-e4e5f2bf0770", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d581b7-4ed2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778680229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680229, "uuid": "cfd19e62-dbfe-4130-96d9-453b7c1d2101", "comment": "Malware payload (Mirai)", "value": "5e44226562fea71cf74fa8ffa190dd5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680229, "uuid": "612e0268-1502-4150-a5f2-63bf148f5f52", "comment": "Malware payload (Mirai)", "value": "a77b110d70b0311bea8637a9602b40e1871f86abac23ead512b35d2aae25c001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680229, "uuid": "faf1d5f5-5e88-45f5-bbff-3ba5856c09db", "comment": "Malware payload (Mirai)", "value": "0b23f8f02863039cea5fbd0ebf723e3ffb320334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680229, "uuid": "8f437108-8bdd-44d3-9dce-7a469b3d929e", "comment": "Malware payload (Mirai)", "value": "fb2e983b16d64fe96a93addcb0fc4de03d41a3261cca715a6b3faebd83ff1d8ba25ae618cd8be027be659f3788bc10a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680229, "uuid": "bbe6aabc-862d-44b5-b68d-c231699f5914", "value": "T15E830265B25DE92046303E768FC941F81F5B4DA9A59815BF36D7090D3EA043BECFA80B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680229, "uuid": "6211e209-8485-4257-b17e-af35b7b4be85", "value": "1536:oDL2JUMHuFrPYrXeBd2bzkkhmutd4GPMR26ph01kOHeC11nT/oef0tL8:oDL9PYjeBd2b4khm0d48Un01k4eC11TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778680229, "uuid": "688deff9-c3b5-412f-bf9a-805431d276cc", "value": 80792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778680229, "uuid": "b071a1a2-77fe-43c6-8701-bb2ca016beb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680229, "uuid": "cbef4bad-8af3-4518-bccb-2132b99d6709", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcbef05-4ed5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778681645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778681645, "uuid": "f21ff896-4fd6-41ec-af60-70d16289ab8b", "comment": "Malware payload", "value": "89a9d42d3a7a5ba66a65b505a7bbe82e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778681645, "uuid": "ac88f02b-63b1-4c14-9719-18127c04d11c", "comment": "Malware payload", "value": "a8eceb915e1e26266a2bfcb779eb4e9d3d5a0c67e23c03804a9850687e77166e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778681645, "uuid": "d85dc5d7-1f32-48b8-8eb5-9f689a259456", "comment": "Malware payload", "value": "48c074026005eb6a043b88551ff3ea264c64c610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778681645, "uuid": "08fe4ba0-5b06-4947-8017-a2bc8dc5f0b3", "comment": "Malware payload", "value": "124824080bc10962edfcd0226a63a561c0e50f8091e880859d01d36e8b5277ef02118b1df318802fda812141caa19bc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778681645, "uuid": "af84645a-fef3-4f7b-96d5-4fb5fc543340", "value": "T131D44955F8809F62C5C62536F65E86683323477DC7D7F30689189B383BA78AF0B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778681645, "uuid": "e3fab8a7-0f65-4736-8579-244f2c48d7f1", "value": "12288:PL2WS0XPdVpnEkC1FHd+Ph2b9nBGeXRJs3ZC6p4796qpwnemEkwGNge:q8p5C7Hd+Z0GeGsmeRkwGNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778681645, "uuid": "305b583e-4e05-48f7-a040-23a3714e1eab", "value": 625804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778681645, "uuid": "84aa897c-dcf3-4eae-8e48-13f6d4ae4eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778681645, "uuid": "74983d6c-b94e-44bf-b80a-5f01e3b1255e", "value": "a8eceb915e1e26266a2bfcb779eb4e9d3d5a0c67e23c03804a9850687e77166e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d04539-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1778638271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638271, "uuid": "93333280-1ffa-48f1-9ae6-d131c0090d90", "comment": "Malware payload (Efimer)", "value": "5be28a0df3727df75eaf00461f4cee73", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638271, "uuid": "157ffd23-2135-4e10-87a3-473b230d887c", "comment": "Malware payload (Efimer)", "value": "ab3dd2d1df2945ba2e66b472562cb01461f142e606c84a1c5ed4b88d6aac0001", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638271, "uuid": "b89c26fb-f2e2-4f99-8c73-6ca916afd848", "comment": "Malware payload (Efimer)", "value": "675ab16344fd78a4e31887809e23a64ee420f96d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638271, "uuid": "c5a7afda-8436-44fc-800b-a52d62ff3e71", "comment": "Malware payload (Efimer)", "value": "16d0032d0e18a0ddbdd90abd58aba6801f537631c7b8c44d39399020edba8026c6566238506df81b6bec3a23a3981d93", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638271, "uuid": "0177e434-e139-4196-9325-e8faca96943d", "value": "T10DD63309A9C1A1EEC7A3C1B5BBF005B8B43870AC5FB59C728608E7719C9F1958F1949F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638271, "uuid": "6f6b6a10-4717-4905-a176-f91724f5ccb4", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638271, "uuid": "29809f96-a13f-4603-afd7-438ec5e4ed70", "value": "393216:rngqnLS9cjX+NvcrSL0XMCHWUjXJcuI3/PGTAI:LgRsONUr+0XMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638271, "uuid": "3147973a-13c3-4bfc-afce-8c996dbed99a", "value": 13859505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638271, "uuid": "63316a2f-b6a6-4622-bd89-67a188a9c803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638271, "uuid": "94d775a6-c12c-45af-ad66-e67cf8881df1", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdba6182-4e7c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1778643309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778643309, "uuid": "fc8a0ccd-9b8e-424b-89b5-d943845451bd", "comment": "Malware payload (RemoteManipulator)", "value": "1ce964e233b0906d8e656df343447636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778643309, "uuid": "cb908392-bcc6-490e-a206-375057e14673", "comment": "Malware payload (RemoteManipulator)", "value": "acae87a39faff99d12c7bd853c2f7cd74380f253a5c87770b9f7e13a4bd6a425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778643309, "uuid": "dd17daf1-3711-4607-bbfa-2ca6431a6958", "comment": "Malware payload (RemoteManipulator)", "value": "232816cc1b0f996343b7a887f7a1b6378c6dffd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778643309, "uuid": "5249f587-33c5-47e6-834f-fe8b89e2253f", "comment": "Malware payload (RemoteManipulator)", "value": "1b5432cc33882587175d8d3da1475691bf3f018e1b632283c0a2a09de332a30ec239a01adb3cecdf9c4749588becf6cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778643309, "uuid": "968483ab-37dc-4214-aa2c-bd8fdbabda9a", "value": "T187771122B682C036DA6B05315AB9DF6D547DBE701F7011CB27D83A7E1AB18C25632F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778643309, "uuid": "111eb894-09c0-4acd-8f45-ebe90c9461dd", "value": "d25b29054fccfd62c3ed5a8a3d014883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778643309, "uuid": "3e128c72-cfa0-4375-8fc4-9a8cd383a202", "value": "393216:wIrqyC8tYOThN9mDlEYxIqwFsRkwSasMPqwwVSelRz75HcV9WvSmnlkfIAtqPsvE:wIeyCGhiEQIqwFJ1aoHjRl8HWvnxAtMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778643309, "uuid": "47389ae0-2441-48c0-9d16-9e4c8908d976", "value": 35557488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778643309, "uuid": "e6020178-8814-492e-a93e-20b59f592317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778643309, "uuid": "831dc5cf-e596-41a1-b869-d43264c6c384", "value": "1ce964e233b0906d8e656df343447636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba55bad-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638661, "uuid": "85126d29-8a52-4e83-9713-01fc60240e3c", "comment": "Malware payload (Mirai)", "value": "58c91aaae7c16345991fa4043be96988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638661, "uuid": "1a96e46d-96f3-44da-aaa3-cd43edb664a0", "comment": "Malware payload (Mirai)", "value": "ada6e92b06c1fb1d236323ff44a20cb18f5e611f877c0605fd354401b3fe84a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638661, "uuid": "60f00c00-a7d7-4635-9f28-86cc92735a92", "comment": "Malware payload (Mirai)", "value": "e24b8fdc64b30b7f73775e05291fb02dad4d8ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638661, "uuid": "690b111f-5e9c-4980-a11b-4b1f982c65cd", "comment": "Malware payload (Mirai)", "value": "3e5216a28f692be145f1426d8179e6d6f81925743a7523b1f79c20670b57624b315c110e2e077d1973f5f89f480586ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638661, "uuid": "bc5f3f1d-bd53-4891-b8a4-ee43972f90a9", "value": "T1F6936C42B70C0E43E0575DF02A3F57E1C3AA66A120F8FA89790EDE4996B2D325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638661, "uuid": "deb8c5e9-5bce-412f-9660-d97023e14445", "value": "1536:6DbQbediuJ6mJYRBNS3LJEr0YN7OPqTzhACgTF36gu2MP0l1Wrtln3J+tfz:QQMIzTzyC2u2MCWrbOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638661, "uuid": "3f9749cc-9cd2-48f7-a8e1-084fa8bac50e", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638661, "uuid": "c7efe433-c347-4077-bd05-605aef9c6373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638661, "uuid": "fd1a181b-740c-4c95-8a7e-185beb4ded33", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefc3a75-4e71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638667, "uuid": "70bbfecc-c290-4b8e-b2dc-852337e1827c", "comment": "Malware payload (Mirai)", "value": "a19236f7090a83286faf74bb0c40245e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638667, "uuid": "ed51b051-1d35-4d81-991b-6ec89a7da865", "comment": "Malware payload (Mirai)", "value": "adef9750eff8410a5d2b8cc53ef7f4051d9c39ef4cdc554cdd6da140f8270f68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638667, "uuid": "590da2cd-ea96-4a67-b615-16fc03d59b92", "comment": "Malware payload (Mirai)", "value": "17e8ffff977cd2ee46c491b1e727b6f148d74299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638667, "uuid": "58e26e4a-cdc0-4ef4-8dd9-1bd93529c1d8", "comment": "Malware payload (Mirai)", "value": "03adb5722a4fd3eece83ca5b0e05c02413f85b565ccf492e425432e3f7ae432ed2e17a534bbd45d51fe7eba46f30bea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638667, "uuid": "07689375-3ea2-4076-ae74-a5a2a17d2547", "value": "T194432B91FC9245AAC7C117BA771E978A336263A9C2CF7313DC080A5176C9B4F4E67B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638667, "uuid": "363f6364-023a-4309-9285-2b450b8e0620", "value": "768:CuoWsjpIE9StBkNxCU8d+bE7DdZVOIrdQKw54u8bMr2FX0nCzpk3:cBjpIE6auz8oDXcIrdQKwosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638667, "uuid": "12ee0f5b-c027-42bc-8bc9-482177feab83", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638667, "uuid": "f7df9d7b-285c-4aba-9b80-3eee1e9741fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638667, "uuid": "6786909b-cac7-4ecd-8560-323cc095bb0a", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9476d5a3-4efe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778699074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699074, "uuid": "c94bacb5-416d-4f5b-ba5c-11f424f072b9", "comment": "Malware payload (Mirai)", "value": "5ec8533590b2d9ade0ede632b6e64d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699074, "uuid": "acf5d160-1d7f-4181-a993-2bb95537e90b", "comment": "Malware payload (Mirai)", "value": "ae591dd91dc8d0d2cf618fcdc1406e8722d17ee5e4e7b27329ac56bab6566aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699074, "uuid": "3272ab39-3f00-4e84-9664-649b0c9a497e", "comment": "Malware payload (Mirai)", "value": "a1920491e1432eab0a9bb05bf7082c83810ed61c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699074, "uuid": "db8462b4-5f02-4fd6-b777-d50783ec5f60", "comment": "Malware payload (Mirai)", "value": "4dc4e9ffeadb486690934b7fda63863b582a87721ee0529742ab1be5e225934d65b995cb9f6583b2893086e9e4955589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699074, "uuid": "9b628227-5d7c-4a4c-87ca-f45dfaff37e3", "value": "T1EA635D89F783E0F0E9474671006BA76D8634DE235014EE6DDB947E729D72A12B21F72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699074, "uuid": "6043b148-f029-4e2a-b61c-92dbc307aba7", "value": "1536:+NtbVyyhR1SgnHcbUU31s1R3C5moCL8b9/gkB6Vr:+7bVyyhREMMO7K//4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699074, "uuid": "5040ec62-4cd3-43a5-850b-bc0de23a4764", "value": 70552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699074, "uuid": "9be51576-9a64-4df3-9081-249e527fa23a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699074, "uuid": "087715e8-c278-452d-867a-4b81c380d1b1", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f2e1dd-4f12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778707430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707430, "uuid": "66eb3ac0-5711-48aa-9afd-cf8ae567aba2", "comment": "Malware payload", "value": "5bf6fc146e0b4d5eaa2cbd8d803da783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707430, "uuid": "fac28ef3-401d-47c1-984f-e5c98f990291", "comment": "Malware payload", "value": "af7d6e960bea16a055ab0848d27ad114a9b34fb9778bda1dbe1d5560bb73929a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707430, "uuid": "6fe22791-c9e8-444c-804a-f98c20c6812c", "comment": "Malware payload", "value": "3b406dbe1e743e5baf73cd782357f2874ae2d038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778707430, "uuid": "a2c02103-6cdd-4ec3-ba9a-af109fc0346c", "comment": "Malware payload", "value": "71d6de94d96c45b182b607353d59e7ae7ab6d7ece79090eac4a3e4b12dec548c35676ffee74e77bb6ab9cd0868d6ee5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707430, "uuid": "6430f820-888a-49b7-ac1f-136765801507", "value": "T1CD838D808C1DF8B3CBC6B47D4D480E50326B7CF42668D74A0A25668EDC49A586FE5BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707430, "uuid": "4ca9ea09-a2b3-44a2-9af6-39425c91bcc7", "value": "1536:5ICrNXsKxIgE9wDBOT8i1Jt7ZZ8OAIbxbm8/V1Wf1+gv/rmbpx69:y6xsKlBjA7P8Ol0nrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778707430, "uuid": "dc478a8d-b4c8-4d15-8f4c-15a6270c8fb0", "value": 82928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778707430, "uuid": "0b3928b4-91f0-4631-83d7-d213e0211c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778707430, "uuid": "3bd2c279-6be4-4503-b1f3-864333c8d777", "value": "SecuriteInfo.com.Linux.DDoS.2637.23779.17011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf65d495-4e89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778648895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778648895, "uuid": "7c87600c-6c97-4878-87d2-31d7bee9df15", "comment": "Malware payload", "value": "36c099f2d426af9d36ee8a5de0129c44", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778648895, "uuid": "878956a4-2579-4ff3-a707-58007dd8a668", "comment": "Malware payload", "value": "b1668822304386f338d3c5c5dd1dff3ddad748621d3f59e6c3c2cbf1b77a41b3", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778648895, "uuid": "ab339645-aeba-48eb-8af5-9a3ba7ffec5a", "comment": "Malware payload", "value": "d3afa142f74ac86fa8f7d424be7ee4057735935f", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778648895, "uuid": "2dca8fb0-9739-4ea2-98f4-f9f3e7a53426", "comment": "Malware payload", "value": "f8983834d79bc157691dab3bf06ba31fb040209adb776942bfd7420a9092131972de91c9f8bce836e831542e9348b5d8", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778648895, "uuid": "d89bbeed-b3bd-4f73-acc8-8fa30d05b5f7", "value": "T193466C17B97501F9C1E1E239C9277263AF19B889933837D31AE29D602F363C01E79796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778648895, "uuid": "ba7c24df-b91f-4b7c-8a4c-36abc29926c1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778648895, "uuid": "4cf6841f-a4d8-4a60-98a0-0909002cc413", "value": "49152:kQ62/xfYpAWb5rl8IJYr3XrFgoTELeOd40encC:kPucC5qr/en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778648895, "uuid": "6711c82b-ed47-46ac-a529-bf7119c23eed", "value": 5771392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778648895, "uuid": "652ec262-2aec-44de-8ef0-09b168e7b3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778648895, "uuid": "f26d8bf2-be50-4f85-9aa3-c6cb8d08214f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7983b72-4f0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778705602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705602, "uuid": "1909284c-b46f-42ee-8185-3d20b126725d", "comment": "Malware payload", "value": "00f52d4fcd07823cb7e8636e9f59abb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705602, "uuid": "7ebe0976-e32a-4db6-89ce-8dc134699f04", "comment": "Malware payload", "value": "b1a87c99b7a6868932d95b51744b67ac33b80dab7eb6e768f5396daac07069e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705602, "uuid": "b2ccf104-7309-4a50-a308-0095e0b208b3", "comment": "Malware payload", "value": "2f6784ab26e5cd42e715568ef87af6821a45f648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705602, "uuid": "3fb4676e-efe1-492a-9183-703291ab3cca", "comment": "Malware payload", "value": "1d9e32e4a9ac86836e493ebc5e0c667d3021cd1ab2d6778acadc2e59a008bfbefc8201e6f22e87208ec109bb14fbb563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705602, "uuid": "3bfd54d0-ea99-40a2-8a85-e21226d7fd2c", "value": "T1ABB30876BA20EF2FC40E83306873C75015D52DB52E925ABE3264EB9C7E3415B1E5B9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705602, "uuid": "6c062f30-d95d-422d-b0f5-d725f9da689b", "value": "3072:/qSlwygtg8TtaHKBkv8fZCpjkTbq7i5NOxmYG:/Dwygtg8TwH6sjkT+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705602, "uuid": "d59db9dc-6b0e-47de-af6b-8e6f44c4e6cf", "value": 117324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705602, "uuid": "a8950154-68a0-46f2-8b30-20b14191afb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705602, "uuid": "55387b4e-230e-444a-a4e9-50a60423639a", "value": "bot.mipsr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf342c9-4f00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778699892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699892, "uuid": "14a5b319-5746-4c52-9864-f65ae94ca240", "comment": "Malware payload", "value": "17f8567b0bcc8365a6df920a8a83c335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699892, "uuid": "25c7fa38-ae33-4047-9b9c-e2d7a092bef9", "comment": "Malware payload", "value": "b33b272fe3e00166b7a6eecc26eff8a6dba5bf74e21733840907823e413a8680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699892, "uuid": "981a5ecd-891b-4626-8449-47c32e4326d3", "comment": "Malware payload", "value": "3163f6ec23ac1ca0d67d27804220d498228e71da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699892, "uuid": "fbb2ae22-110a-4126-89a7-a17c8f2f2009", "comment": "Malware payload", "value": "b9cc3c809eebafe7c6442437096aeac888c8e0af77a9ba82aceefafe80fe7df76c60e506046a0095ef54eb6278c3ebee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699892, "uuid": "4b905cea-d74c-4b9f-924b-581b11da8f3c", "value": "T1AC734902F9E250BCC446D071475FAB26EB71B84843257BDF67C87AB13E66E902F5A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699892, "uuid": "71abd213-7f5e-4fd4-a2d4-623307490c79", "value": "1536:HXPErNu/a6D5cr7xsDeD9kgJBtBuDerEgbQ7zTVEYyxSAb/K23na6VhNp3KIDZI/:HXUk/9CJsDeOgrGD1VQfyS7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699892, "uuid": "3ed798b9-fa52-4466-8cbc-20c036788477", "value": 75080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699892, "uuid": "4e709717-ec34-40e9-a4e7-088c5134dab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699892, "uuid": "b8f0cebd-0fac-4baa-b171-796477605b74", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f721d4-4f21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778714048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778714048, "uuid": "a5b0a343-e018-4f31-b0e7-bf0e3441c8e1", "comment": "Malware payload", "value": "fbd9d24779e084c35ee963a8cc8b3546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778714048, "uuid": "c3c9a1fa-6c13-4f79-a434-62bc04e7c4dd", "comment": "Malware payload", "value": "b514a5a8eafbcda97058ae5c1cb674e76a80978ff1102404d52f24bcf5525835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778714048, "uuid": "c3e26138-d537-4376-a8f8-6b81f8a8109f", "comment": "Malware payload", "value": "93c03fafd6dbdb3f9d23a269631ab9588a105959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778714048, "uuid": "9f963808-c80a-442d-ba4f-3fdf49e1a0a6", "comment": "Malware payload", "value": "22d17858ae1985ef15f6852ea9cd6a410c7b44680b31647d6501347c7ec4c2bb854305831ca01a3375a3265b1500b525", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778714048, "uuid": "c0cbd530-7a99-477c-be22-e9e762a0d3de", "value": "T1D483D692FE81CD52C9D838BAF91F42DC3347036CC3EE75019E129A3566DF5994A3AE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778714048, "uuid": "aa1faf55-529a-4bc3-95ff-2ca2574c7b76", "value": "1536:E9CnrNjY9Tvj2Qkx3mFMg7L68woSCD8PyKdlQfS7:rqdj293mxG8L857Qq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778714048, "uuid": "26d8a197-a53d-4a4e-80c6-0f69b79db63c", "value": 82356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778714048, "uuid": "856bb4c8-e17b-4f52-821e-37f091740a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778714048, "uuid": "c610b1db-2874-402e-802e-72b59e2b2c43", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72872028-4e6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637599, "uuid": "3921c10a-2c1d-462c-8455-358ccce26445", "comment": "Malware payload", "value": "084b800870e45dce36ba681bd43cbee9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637599, "uuid": "98f4efc5-366a-4411-9c49-feaeaea8cbba", "comment": "Malware payload", "value": "b6e8d46789c7d4d11a9474114fe4bb272a3cab87f69a138e194b4cc4699ec403", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637599, "uuid": "6565a4d2-add5-400a-ba6c-efff8f03b8aa", "comment": "Malware payload", "value": "82c604771a90b867ac18a221589e133e3c704049", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637599, "uuid": "639982ae-28e5-49ef-8d73-75fedadc798d", "comment": "Malware payload", "value": "f8478e65fe9d5d4421e0dcf08c810a5db030b895c8e7cc212ec91389279e51b01642fb26e1a52b28d1531afb82397bbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637599, "uuid": "82bd9c15-a8cb-4c57-be6c-039633acf99e", "value": "T1C9670126F6624160D4E784F645A9A16B99387A0B1730C4CFE380FF2CDA23BD1DA76735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637599, "uuid": "54f36124-b0d6-41ea-8d88-d2b1e9d428ec", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637599, "uuid": "f5485fd9-a6ad-48b0-a81c-a3250051209f", "value": "393216:zqSS1aqiC1BchvoOmrkDWp4Tv4mpYlak3GXab+kgg4ocRoI21n7H5Z4RpP:2SAaqlsXjyO4mpI3GXSEozN7HXwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637599, "uuid": "1806435d-a50d-4333-9208-0ac364a63810", "value": 30428512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637599, "uuid": "c202c85b-235a-43c1-8398-f3cbccf029bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637599, "uuid": "6c79b1bb-50dc-4271-ace2-51fb940e1321", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcaa706-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778682336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682336, "uuid": "fef475cc-562d-4b3b-a902-0b375f99ac4a", "comment": "Malware payload", "value": "c5d5e7dfbcb008dd9eedf45146db25a7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682336, "uuid": "1f9c19a7-ece4-4b1d-ac30-a20f304818cc", "comment": "Malware payload", "value": "bd50b1145195ea8601c18333e8899a0c86e4e25229d801c1965c384fde68f9d5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682336, "uuid": "6c6c3cf7-409d-4a37-ba59-3e0413363e67", "comment": "Malware payload", "value": "82d565c7aaabb8fc46ce4a3d0fd14288498cfe2f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682336, "uuid": "b6a2119f-5d18-4d10-a9d6-3669dc3f961c", "comment": "Malware payload", "value": "0c637314a7f1e1a666f5117bf6097fa30d2f11eb08c26f03ad81a2335741432b28de32fa12bdf8b29b8bb6226c851c4b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682336, "uuid": "6512a6cc-f1a1-4646-9cbe-25268d2a892a", "value": "T18C253A57E76344FDCA7BC170877B9672BA30F81552306A6E1B94CF352F21E604A2EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682336, "uuid": "c6c92cb1-a85a-4a71-9d24-74fbf6a16e09", "value": "d81431e2c62d449262cbdabb3df3ac68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682336, "uuid": "1de8b452-b9cc-4464-b1bb-e58d5a8ece20", "value": "12288:CYF6+aqxWF2gF66UD5BZWpFLn2lqrmqg+VaP:u+aqgF2gFjUD52pFLn2lq/nVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682336, "uuid": "4adc515d-cf0b-4065-bd4f-24eb074b3ad0", "value": 1057564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682336, "uuid": "246b8d37-f697-4e7b-931e-e032737e678c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682336, "uuid": "6f6914b9-6c1b-4b4c-b837-de96dd26d352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cf7521-4ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778682306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682306, "uuid": "58c97c3a-d5ef-4a10-9e04-b98e943a6920", "comment": "Malware payload (Mirai)", "value": "ee8803a8893463c4c9ec423f64d6652c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682306, "uuid": "2f4a285b-5c0c-4c44-9921-1e0987077f7d", "comment": "Malware payload (Mirai)", "value": "bebb6c7eaaa7b92546cc796d00f1fe1203de11c0c1fd9c818c4936fc84fe97d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682306, "uuid": "ac7f6a2e-eae5-4e7b-ace2-76e7753b8f54", "comment": "Malware payload (Mirai)", "value": "c887f0be7aaf473bcd57d86f63a94acb504044c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778682306, "uuid": "5955dbcf-a869-47cc-9eb1-b9be08779384", "comment": "Malware payload (Mirai)", "value": "e184a774a073a880e21810bc525e31edc88e7cb0896166b143179aef0337ea056c01d4eefa3e041ead4d34816bcb5b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682306, "uuid": "42c5485c-b9ff-4ca6-9c77-19042c042d53", "value": "T101F3B30EBB620EF7E86BCC3B06F91B05258C554722E83F757974D818B64B24F1AD39A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682306, "uuid": "8bf83b00-3dab-4db4-adc2-a12c2b152b22", "value": "3072:OcWWtGFRtHBjwFYi7J0WpLJkYazKx2aYPpiLE8IfX:vtStHBjwFYxS/vwaYPpoIfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778682306, "uuid": "269885c9-5e61-491b-bcfb-3f8b123367fd", "value": 160820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778682306, "uuid": "f3ff5cb9-cbf3-4812-aad5-aee3eec31f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778682306, "uuid": "2fb4e253-242b-4478-a9e9-9145f2033afc", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409e3eb4-4ebc-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778670587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670587, "uuid": "9d5c41f4-c118-4406-ad89-e5d70c15856d", "comment": "Malware payload (QuasarRAT)", "value": "93d3e455557f8b3cf1af9f8c020317e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670587, "uuid": "e789ab00-d3df-4cb1-b064-efd0561698ec", "comment": "Malware payload (QuasarRAT)", "value": "befd43899d3fd6441ae166811caf6c71c5f28cded92b567562b5186d942e6cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670587, "uuid": "4c9a354e-2a30-4c8c-b3b0-e9e95272b47a", "comment": "Malware payload (QuasarRAT)", "value": "27da24185729764e435884cd2fc99a0b2ea041be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670587, "uuid": "45eb1d32-5715-4a0e-94f0-13d0a4c7e6b3", "comment": "Malware payload (QuasarRAT)", "value": "f1403ebc12bb8dde75a3580805d56fa1832c775514ea073e79ea3b5ec15483176e9d51fafcf1600cae706ea9317e55fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670587, "uuid": "fd8f0be9-0d58-4594-beb0-e7e80cbf1384", "value": "T153F5181C27F44E27E0BAE37795B8402657B2E85AB763974F21C1676938F3B4088C3667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670587, "uuid": "ac17cc9d-22f6-436f-b561-8b8299cc1ba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670587, "uuid": "5728c410-eba1-4e7a-b86a-076f581e1290", "value": "49152:dvn+j2teai5mmP3lhsFQawoSgGsYRJ6WbR3LoGdMTHHB72eh2NT:dv+j2teai5mmP3lhsFhwoSgGsYRJ6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778670587, "uuid": "46ff90ed-161d-4526-a2ca-35a40aaac7ca", "value": 3432960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778670587, "uuid": "84cad37e-46bd-4ec8-ba60-01e7916c8e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670587, "uuid": "659b193b-2990-45f5-96e9-8c503bd97bf0", "value": "au88elite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30161dd7-4ebb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778670129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670129, "uuid": "5ad98338-087a-416c-8724-88c9ee58c405", "comment": "Malware payload", "value": "87b1a2455da7f362abd532fc0cccb58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670129, "uuid": "e969e997-31df-449e-912b-c3b39770f273", "comment": "Malware payload", "value": "c1255d401c37c3d913779420275001a88950b45583e0cd216b00298c89979b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670129, "uuid": "62c5644a-77f6-403a-9dc1-e5dd82b30d6b", "comment": "Malware payload", "value": "8def141921f59ce80ebe2c86515a19603f442b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670129, "uuid": "597f39de-3887-4cc3-befa-ecda28f9eeab", "comment": "Malware payload", "value": "1d63b1b96dfccd5d90f2a30a399fd72cd8c77bfef2a139e78805b74bbc7cc1aab3e39232e4239355022df5694309fd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670129, "uuid": "d017e77c-753c-4a14-91ef-a56f1a901e41", "value": "T186D44955F8809F62C5C66536F64E86683323477DC7E7F30685189B383BA78AE0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670129, "uuid": "ddf828d4-dc46-4ed5-969d-eac19377c5bc", "value": "12288:l3b6S0XPB3gtkQymHdRfHRzJMh56WtP6yUe6p479mFK+pcBemEkwGNge:hYGTBHdRvW5P5NE0eRkwGNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778670129, "uuid": "f5525063-bc11-4326-9b8a-15181e138ccb", "value": 625860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778670129, "uuid": "e977a9df-cf9a-43b6-8747-76a0494f3b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670129, "uuid": "8196ea9e-7349-4f90-922b-51cf3d80838d", "value": "c1255d401c37c3d913779420275001a88950b45583e0cd216b00298c89979b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176396a2-4ea7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778661498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661498, "uuid": "c0207dd7-d9f7-4a07-b8be-5e3e064bd7ed", "comment": "Malware payload", "value": "04386776404ca093758217563c1777b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661498, "uuid": "44c18d3a-1ab1-44ef-890d-1c867f463e3b", "comment": "Malware payload", "value": "c1ee13fb985e2db3d0c0b4344165cac342f1539d7afa775446a33dd23284629b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661498, "uuid": "084158b8-a797-4d91-9b8d-4af0fd5c441a", "comment": "Malware payload", "value": "c432a2ba0cee5499d609f135fe1bcbbeeb8e5325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661498, "uuid": "9366dc3f-7346-4c7b-bb10-f14d25188960", "comment": "Malware payload", "value": "453085ebdd89c64eeca5be44e7efed62e470f970fe515a84289bad5dcf604c6064a6cad6e5da70976e2d4e8e722702f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661498, "uuid": "12dbd1cd-6a9f-4ba3-bfd5-810cf63a2232", "value": "T1E6252917FB75E1A5D26AC4B8A2621B63B630BC0DA124A333CF95CB617B20F14CD9E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661498, "uuid": "d1214ef3-9042-4855-8a51-973c3a81ea63", "value": "88964abb1ae69d582d0f0b22d62fa582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661498, "uuid": "a4e198e1-05de-4289-acc3-eccd5fe3a9c5", "value": "12288:0z8B0YZDLrNh9R93Hso0jUUxJcgtUUxJcgGQin:QYZDLr5HsQUvczUvcTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661498, "uuid": "659cfbbb-925b-4140-8ff1-38bae0c58f7f", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661498, "uuid": "809feb3a-6878-4405-a727-4a6788f3d68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661498, "uuid": "98dd28ee-e96d-45f3-aadf-916a5ad4b318", "value": "2026--\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u89c4\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90789e7-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698249, "uuid": "ddcec140-f032-4870-8902-8773c5c01fd4", "comment": "Malware payload (Mirai)", "value": "9860058af252a01039a44d53e877f1ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698249, "uuid": "6ce1b1c5-808f-42ed-906c-08f888bbe91b", "comment": "Malware payload (Mirai)", "value": "c2e330e711d400384da68f36f1c80c8d70c8a214922ed6d1f2c3b606adab7df4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698249, "uuid": "fd9d7723-31fc-45a7-9e8e-87089206d0d8", "comment": "Malware payload (Mirai)", "value": "453bf140fa44d37588274bb88aa1b92dfc3951ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698249, "uuid": "9b97bdcd-9ad6-4883-8597-6a2dceccdeb5", "comment": "Malware payload (Mirai)", "value": "057dd3fe34d16e8d0a62bb61325f1374dbe5909b4ab16e49e0e6d67253d0fed75e3afdda1de56dffadd669b0a3f5765f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698249, "uuid": "4fa98b4e-4c39-450c-8abe-f5db42a82f96", "value": "T169932946BC818E11C9D512BAF92E018D332357BCE2EE7227DD105F2437CA96B0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698249, "uuid": "dfd4b833-3509-4a7d-a7f4-5828602d133f", "value": "1536:SdnQe9FdIVtCHbgAYc2D6BxGl715alHAQJMqivr+hQeP5rxh5LYj:ewCWf6LGl55ag+hQeP5rxhpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698249, "uuid": "5bedf6d5-43c7-451f-a9f1-3ce864a177af", "value": 95552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698249, "uuid": "f28eeca9-a626-44ea-8211-a87797ccae67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698249, "uuid": "a4987014-0c55-4d6c-b167-e55ff033ac3a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a877aeaf-4ebc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778670761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670761, "uuid": "6c8745a6-1e66-4e29-a6a1-6b2f217c357f", "comment": "Malware payload", "value": "e83581463e34a4ed735359c7f3745070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670761, "uuid": "ef8189ab-74d4-4797-a4dd-4504c06e0427", "comment": "Malware payload", "value": "c337c4e00abae08dc1df09463d6b90d2713f672686885f0f89ed85150ec552f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670761, "uuid": "3d5c58b8-9f5e-4a93-bd68-630eb2f2323f", "comment": "Malware payload", "value": "645eb99d041abdcb62330fe6157e61125eef484c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670761, "uuid": "f492e00d-efd7-4c7a-b2d0-33e49b040366", "comment": "Malware payload", "value": "a0ac4a815a6154b6542a61bc1f02c09ef138aca30b1570cd7150008f4230871a3b90f240fc56e079c7be81c57ba3c013", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670761, "uuid": "83a61e1f-a33d-4bba-87cb-bbddafe2d153", "value": "T12DD43955F8C09F62C5C62536F65E82683323477DC6E7F30689189B383B978AF0B3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670761, "uuid": "6f8958ed-26af-4eab-aef0-d2f0042b06f6", "value": "12288:PdLxS0XoZ17P62u0IL5/d43Y7nLjtrgI26p47jNnRiIUE5ycNkn:dcjy2u0IlX72L2In5ycNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778670761, "uuid": "a388daba-58c9-4b6f-a355-5c3b7d046a71", "value": 626556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778670761, "uuid": "bbe1bfcc-e51c-4b95-b8d7-399943ea9180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670761, "uuid": "56819bfa-ab78-43f0-b828-66b81d72d46b", "value": "c337c4e00abae08dc1df09463d6b90d2713f672686885f0f89ed85150ec552f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfdbb29-4e93-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778652916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652916, "uuid": "a361b935-a4da-45c5-9787-3df508496836", "comment": "Malware payload (njrat)", "value": "2457dfe5e7bb52ab6adf2edc1201cd06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652916, "uuid": "5a12d4f0-c1e7-4d50-9b04-4ff8027cb966", "comment": "Malware payload (njrat)", "value": "c4f1ee7a8892d17270053520167f3861c36e0c36a07968e79fd407f3c30fa7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652916, "uuid": "eafa26f6-d1a0-4195-8d36-6be8f3ff18b5", "comment": "Malware payload (njrat)", "value": "fd642c2d3195fe0ec7b91060ea81f355a2b2887e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778652916, "uuid": "3ebf3312-a7e4-4a08-b8a9-f598ada5ba88", "comment": "Malware payload (njrat)", "value": "7589f81a2d6616e880f703ab7af3f770faa01b415c4b6c4de2dc256df94657025d466fe66cba0aecbf248842e6ef3648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652916, "uuid": "c8a94382-866a-46c5-bd55-941e210e2a71", "value": "T143B22A4E3FA98856C5BD17708AA5969003B091870423EE2FCDC550DBAFB3BD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652916, "uuid": "fbe7e8ad-6c4a-4b0f-ad64-c7d8d1e8c058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652916, "uuid": "1d68dcd2-47dc-4e2e-9eda-f1f2519b7035", "value": "384:F8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZwC:NY+sNKqNHnSdRpcnuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778652916, "uuid": "feefea0d-f726-410e-aa56-644f3cb9e88b", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778652916, "uuid": "eb526da0-907e-43b8-931a-b6b27e64adda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778652916, "uuid": "7e1b024e-0890-4437-8fc3-b8cb5101d737", "value": "2457dfe5e7bb52ab6adf2edc1201cd06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa26c9-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778668530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668530, "uuid": "4cfc7c16-ad76-4432-8b5f-556a8e459c6d", "comment": "Malware payload (Prometei)", "value": "c8daf5b6437e21945c285ac0c45e07be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668530, "uuid": "0d91b090-8db2-4cbd-8578-feedbc3a43cc", "comment": "Malware payload (Prometei)", "value": "c512cad695fc027f3d3df46159a1f1b43d7641c37d6ade44870c052e36496bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668530, "uuid": "1e5f71ee-821f-4972-ae87-8d1adad7e2d4", "comment": "Malware payload (Prometei)", "value": "73af0f40302ae367fe6b16129894abac863d691f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668530, "uuid": "2579500c-2a6d-4b72-91fa-3dd8801c177c", "comment": "Malware payload (Prometei)", "value": "a5ee345a20352660eddc75134bfd3ba01db22136eee7fb470e467a88a6bb4569d1913bbab1d4a58e2af3c1b92b2ff207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668530, "uuid": "af42f72e-1814-4a4c-b30e-845894e4f230", "value": "T11A8533BF40472BFAF185BC6867293BA37445A4E12EDF38049EDAD17142BFE845672243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668530, "uuid": "9f403528-995c-4332-9718-e0d569042477", "value": "49152:QlDQ8OpPd89+78vgpa5wym7/8cpVe445kOlpzCE:iDIp8+7MAfTAkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668530, "uuid": "dbcfcc1e-e932-40b8-a341-5329d0f41e0a", "value": 1771244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668530, "uuid": "1e060f88-0ce7-4da1-978c-b16d399710dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668530, "uuid": "35acfcbf-3bf3-42ac-84e4-3ac1e1b127d8", "value": "c512cad695fc027f3d3df46159a1f1b43d7641c37d6ade44870c052e36496bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4475734-4f1d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778712549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778712549, "uuid": "ed87a4e2-6f11-44a5-902b-0993618330de", "comment": "Malware payload", "value": "1eb32b118370047586a5d661bec796f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778712549, "uuid": "315537f5-4861-4be6-b3e2-cc29f7cb5e49", "comment": "Malware payload", "value": "c5592336c1301db754184246ecff072657f440861f704315b29e9106b749c745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778712549, "uuid": "63a574cb-996b-4742-86d3-736a3b10ced4", "comment": "Malware payload", "value": "a37cef19f8a9cbc8cc32088bf61cb80ccbd048e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778712549, "uuid": "6c31363e-f969-48e4-9645-df008af143f2", "comment": "Malware payload", "value": "089ed57b25336c0911b622bdc0c8ef9af98330059b8ab31620a42325737ff4318b9e8423d9e51adb0ac09b831520836a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778712549, "uuid": "8c1a73a1-611b-40e0-a37d-9fc40d9d89bb", "value": "T16D83D692FE81CD52C9D838BAF91F42DC3347036CC3EE75019E129A3566DF5994A3AE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778712549, "uuid": "8cc066d2-b723-4edf-b010-a1d5d88f6a4d", "value": "1536:E9jnrNjY9Tvj2Qkx3mFMg7L68woSCD8PyKdlQfS7:Uqdj293mxG8L857Qq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778712549, "uuid": "daf0217d-e165-4a55-8e90-c6db2bd0a096", "value": 82356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778712549, "uuid": "b4436db6-3a01-4f5c-acbf-1a0d3faedb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778712549, "uuid": "73799c2d-b018-4566-9b66-8c51f0ae07e8", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54739271-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778698108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698108, "uuid": "29e24225-8419-45db-9dc1-bc75f3a3625f", "comment": "Malware payload (ConnectWise)", "value": "24ba3f5ea6f1d5c5454ec81d91ad45a4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698108, "uuid": "04991f97-8697-4ce1-986b-ea3c3ddc2e87", "comment": "Malware payload (ConnectWise)", "value": "c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698108, "uuid": "fcc4fb44-5481-4cfd-a1c6-b4b1df907fa0", "comment": "Malware payload (ConnectWise)", "value": "06bef2d6347237fbd8a61280911458a4cff29b90", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698108, "uuid": "8393df73-61b9-43df-9f1f-6bb2fe6c27e1", "comment": "Malware payload (ConnectWise)", "value": "d3cba707f3b19ba52248dd0cffb221f9e976f9c13eda885709d073fca684c19548319771f16e3e033fdf1743dec8e503", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698108, "uuid": "782e6d11-d815-4d7a-ba7c-f9cffae20b8a", "value": "T18746F041B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698108, "uuid": "dbfcd33d-3d30-4921-96c0-00cee50df0e6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698108, "uuid": "cbcad826-ddd8-4d5e-8ae9-0fe70294d461", "value": "49152:MfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONg:zrs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698108, "uuid": "8c39fca9-c3bc-4cc7-8128-321b743a742d", "value": 5686928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698108, "uuid": "0a7860bb-68fc-4fe7-ac17-e2c2eddea9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698108, "uuid": "e7a5c8b1-d581-4d88-9b7f-4f7e4c4f2eee", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f51a120-4eff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778699441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699441, "uuid": "07f712bd-2f49-4959-b1df-8f0c9b522ce9", "comment": "Malware payload (Mirai)", "value": "216e5278078231602e1e59ed1c02ed66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699441, "uuid": "d875c113-5c87-4b4a-b5b3-4172e6acadc7", "comment": "Malware payload (Mirai)", "value": "c63cd4f058daedfca2435584edfefd7c966c54e9313fbbb7d0933ff04dba27d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699441, "uuid": "9916aae1-8aa8-4571-9616-9e68a09e7840", "comment": "Malware payload (Mirai)", "value": "d00fa585f46f36afc57e4addb87b228cf5a0d02f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699441, "uuid": "6508b5c1-3bee-4da4-bce5-875e8e5421ee", "comment": "Malware payload (Mirai)", "value": "e29c191a4f9c4ec59fa194f0a0091126d698086891b7452cead2544f28930979996421ad16cad8e3e4dd930c29248cde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699441, "uuid": "08ad4581-ba06-4129-9252-3f79655591da", "value": "T104145B06B31C084BD1632DB42A3F17E093EF9AA134F4B645755F9B8A8272D361589ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699441, "uuid": "f8940bac-c004-4488-8100-dea20a24eadf", "value": "3072:n05gh0/q9bMkvnzzsy5fqAHlxSaDeRPGMEDVwIgUl:c6JlxSaiRPGNDV3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699441, "uuid": "07befd50-973d-4993-86cf-fe007c796d59", "value": 201616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699441, "uuid": "3cfb6b9c-203a-4da3-9ea6-8daf2bd92b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699441, "uuid": "d0ca6f79-21c8-4b19-b5ca-12965626e093", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6802ca0-4efb-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1778697869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778697869, "uuid": "d6da31f7-21f7-4c57-9852-0f79b42ab23f", "comment": "Malware payload (DDoSAgent)", "value": "579f1cd314a6a780c536c3ffcbff0f15", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778697869, "uuid": "add394e5-e291-40a8-bb5c-f0d63ae0e2d9", "comment": "Malware payload (DDoSAgent)", "value": "c6e28e79ed4503b29dced539841bd96bdc03074f349a79849c0f8462f72721bf", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778697869, "uuid": "55c7da8c-d944-42be-9ac8-f688ce1af10f", "comment": "Malware payload (DDoSAgent)", "value": "9257906fd691d117bfdb598737796d47e240803d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778697869, "uuid": "8d4e2cda-7bae-45b6-b973-9fc35ce1b06d", "comment": "Malware payload (DDoSAgent)", "value": "ebc7d32e569266406254cdf063e183dba6a4736445561ba45191890bba09896fb16a54436a296f3e4224d1e927f8d7d3", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778697869, "uuid": "cea7a7a3-9a6e-42cf-a3d6-9ba40fd86afb", "value": "T18A767C91FB48A136DA460A3248670B30B3A15D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778697869, "uuid": "c7d62e4d-01c4-4fe2-bb16-a68826c65fd0", "value": "49152:sCKwGYUgc+7O1NbVL3dyhGi/p8VWzxqRY1eiHVRW8Pwy9/MtJGflHHUt5Ee:9UtJNbVEhGZoCUji8Pl/GJGflnUjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778697869, "uuid": "e1858bfd-ab2b-46e9-80bb-98ea36aff43f", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778697869, "uuid": "cac96daf-4f2e-4f45-b89e-bc1e5d5376b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778697869, "uuid": "42c27541-691f-49b8-85e8-1e40047e2a91", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a2e03f-4ec3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778673850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673850, "uuid": "49811212-7d7b-4b1b-8b36-0ffbfba18116", "comment": "Malware payload", "value": "a4a5a108f84970dc365665226ebfdd6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673850, "uuid": "4e0a6464-8465-43f2-9a7c-25368ae68bed", "comment": "Malware payload", "value": "c86d57b8b5b435a1ea4469012dd85aac38659444d8281b3016250b1c648e7d8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673850, "uuid": "6848bbec-0818-41cc-81dc-6995440e6e5f", "comment": "Malware payload", "value": "30e4c2e26a93bcec9007439d632166259f6242aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778673850, "uuid": "e64db6da-2932-4a9d-983a-38e236eebc6b", "comment": "Malware payload", "value": "ad945c5d20025eaf6de562b8659cdbbb93cf6f8b85513b4b8d0d1c2e9b7a82adf78ae6c5634346a07e71200bb283d21d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673850, "uuid": "86299b0b-af50-466a-9bf9-9a1a51580a80", "value": "T156931847AB548D6BC5E1467248AB0370CB7BE9B8A746AB03513892703D8235FBF4F64D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673850, "uuid": "d1f527cc-938f-451f-95d4-e4550f878c8e", "value": "768:2PtiGLFonUAh/udFjkdk3Ehq75NIEGfDgdt2j0BpcTWaRsB8IT5yFNFTbBuclxh4:2PVLOU1PQ65Ydo6LRsBN5qgRaJWMbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778673850, "uuid": "c1bc564a-5d92-46d6-90ad-2b517cd36ecc", "value": 94974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778673850, "uuid": "1b3d5601-e4f9-4809-ab06-96dec856827d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778673850, "uuid": "57bc06fa-086c-41c6-99ec-c2eec6cc8ee7", "value": "dhcpd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c79959-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700816, "uuid": "c68232f5-7da0-4df4-b6b7-42e5391c5d54", "comment": "Malware payload", "value": "cf1ed17c5295c5c849a265fd05334ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700816, "uuid": "c7bdbd19-8c74-4a54-b90e-1d573b72cdcc", "comment": "Malware payload", "value": "c9116f99a073f79a68e0239cf6d503f1009a27ca997bb660c72bfe1098021af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700816, "uuid": "87ee7da6-1a12-46bf-984c-8662a8f88d69", "comment": "Malware payload", "value": "3bb82b93c7ad0c1cbf9a51bdcb1f6162429e649a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700816, "uuid": "cef3a116-3996-4b1d-8412-7d2c291f7906", "comment": "Malware payload", "value": "79d4ac63a2411d9f2e0426fb8cef280df60c3ca91bde2c36f996ffaf4de9fdd933ed37998362c38beaaabe376f6ff2ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700816, "uuid": "f6e409f5-7591-4e36-a4df-a0ab01181a93", "value": "T142730991FE81D952C5D939BAFA5F41C8338303ACD3DF72028E019A35A6DF51A4E7AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700816, "uuid": "0266ddc7-a08e-44f8-afee-5b0ab7f6ea3b", "value": "1536:GwRhrNjQGv5g/VtQfSv+vkIpWqW7LuxvFi1wWOS/Z2Qxqb7:pJ5gNKVMi/8utFuw0Rqb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700816, "uuid": "cb54ed71-3fd5-45ab-bddc-0c18b47edc3c", "value": 80436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700816, "uuid": "49d484d4-b84d-4fcf-83e8-80e3d7b24743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700816, "uuid": "bcd08397-e567-4f74-8754-f97df4398f23", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261684c1-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638759, "uuid": "56a7e514-79e2-43eb-8939-e63fe712af48", "comment": "Malware payload (Mirai)", "value": "226e1473f4575bd8700bd86245bbf5cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638759, "uuid": "9c232132-1a9d-4ce7-8336-a957549518b6", "comment": "Malware payload (Mirai)", "value": "c91d5a9c13854408f01cd35161deb6f0e2892e1054a451d239f246cf4e3ce4f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638759, "uuid": "1e7ee268-ddb6-4b2c-b214-41445f82cfb7", "comment": "Malware payload (Mirai)", "value": "7131fd5236e4f5be48f5763431d36444deba68cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638759, "uuid": "af7ed051-7c1c-40a7-ba84-2f45216d8bd9", "comment": "Malware payload (Mirai)", "value": "2b37210513efbb245ac096b4b0453fae741bba08c4700d37d313e7498a4fffbaac6221ec1ef576f80cb5d1016bc709a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638759, "uuid": "214543be-eaaf-4adb-bcac-d82a4d143dc9", "value": "T1E083AD33C92A0E68D84845B4B0B18FB65763E515C0972EF7495AC67AD083EDCF98A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638759, "uuid": "83509eef-f566-4b64-93ea-1e03700894b1", "value": "1536:tgynxf8zTG5xM4A+XRcK5PrKhCeRCaduH7Hy9:txnx35G8RD5+CeRLiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638759, "uuid": "1d4f54c9-b4d2-41ee-8cad-9045369df5a4", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638759, "uuid": "f7c3a0d4-2eb3-4587-8696-94a6648f25bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638759, "uuid": "d45aeca7-f89b-46f2-bb1e-bdf468170f04", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5466818a-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778698107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698107, "uuid": "76ea2951-c632-4394-a69b-bb1ae383e3f4", "comment": "Malware payload", "value": "e566875efe6fd9350480c06cd97fc3a9", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698107, "uuid": "3e3a8b69-b3b6-4827-91d9-81c6d7b35cf3", "comment": "Malware payload", "value": "c94c813578f0fc77fd72bb018dcb1d19fe501bd53f5903243e8a8677b38576b4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698107, "uuid": "13dba443-a0ff-424e-aaaf-51374a6763de", "comment": "Malware payload", "value": "d326c15ded14bf8d337f94141db819a36e2b9281", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698107, "uuid": "e1d1e666-01cc-4395-bb39-29120c1895c3", "comment": "Malware payload", "value": "fc88bc9028730246784aeb681c4fbc3399ce9792abf84ad96292619e6cc19372ccc38fecb1e71105efe98c446cfe0e3e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698107, "uuid": "0579d6db-bbee-4a1b-83ef-35259bdbfa92", "value": "T16D46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698107, "uuid": "832af1b7-1fc1-4e92-a412-3db84f6daad6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698107, "uuid": "78efade3-e873-4483-a067-b54ae018d674", "value": "98304:5zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:5hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698107, "uuid": "6603e6bb-02ad-43bd-a14d-37cffb686c5a", "value": 5661912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698107, "uuid": "a5becfcf-7bac-4a49-9660-c8fa77d493e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698107, "uuid": "434d5c2d-7a9c-4991-81b9-b12191461fe0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99971098-4f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778715833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715833, "uuid": "e3ac39bd-ea0f-421e-9017-883fa06ac61e", "comment": "Malware payload", "value": "ba2a4f8a192a0ce5c6df6abec2ae68f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715833, "uuid": "c04db0cd-c9ab-433b-af96-56ffc093464b", "comment": "Malware payload", "value": "ca69382abf752209091bc176833adbcc76846f39942c8a560a0c99553dbaa44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715833, "uuid": "868de4bf-4707-44af-ae3a-952996de48f8", "comment": "Malware payload", "value": "1a7f1e7e625bee587a6c08e6ae28e44f73ce6bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715833, "uuid": "5deb9164-bf8b-4048-84b4-484b8b7c7b01", "comment": "Malware payload", "value": "7fa16c0337e9768c6d36941ec77a90d322c75756fe721475233642c3627fbcf25b75615324596710d5b8339302cde321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715833, "uuid": "406d2c7c-695d-4fa0-83a2-b529d7313c34", "value": "T1B0B3D747BE04FFABC03C4F709AA9C7120094A5C5B6A5A13F72A497DDBE792131E439D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715833, "uuid": "b036e51e-6c72-43a5-8175-a666dcd11803", "value": "3072:FhC0VpoZxXbp5wrQLITxseIRIfmEq56oJXD:FMmofoS+amM56o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715833, "uuid": "e0426466-611c-4806-80d5-27265d842e93", "value": 117836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715833, "uuid": "e5d1637a-1e6c-4f21-ba23-828ce5791746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715833, "uuid": "c5d96218-060a-45d1-a924-5df7ff506e69", "value": "SecuriteInfo.com.Linux.DDoS.2637.3549.19620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a582f-4e62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778632195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632195, "uuid": "94e3ebf4-32f8-4e99-8acd-55dae4bcf9da", "comment": "Malware payload", "value": "42b9e69adc72dfda190424958c07e408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632195, "uuid": "2df284c0-9673-4214-a340-f6c0368aebcb", "comment": "Malware payload", "value": "cc1cf7247be97691d6af63fd44440579ebdf28ad8aa59b047da879fcc540946d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632195, "uuid": "723eb228-5814-49f4-a5d8-8d7e204e16fb", "comment": "Malware payload", "value": "97da2a116ff9b32af5921edfc0474054145f477f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778632195, "uuid": "f83363ec-e72a-4a76-bf4f-4ddba7be18b8", "comment": "Malware payload", "value": "71f3ed929a8a643c4c749c62d38ad3751c4869b8e870ed04e23cd91652ed594d4b0bc514a1815159d11600bf681080c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632195, "uuid": "1de37650-d122-41cf-acb8-c57a088600a7", "value": "T13207AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632195, "uuid": "2cb60b47-e805-47f5-86aa-17f9068bb026", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778632195, "uuid": "8ec2ff63-b7f3-4c6b-b2e6-d6a9a347ceda", "value": 17596416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778632195, "uuid": "a46c22fa-4dd2-4879-8038-a584fb1ad1de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778632195, "uuid": "6ad1c348-105c-4a7a-839c-48c72c1accaa", "value": "cc1cf7247be97691d6af63fd44440579ebdf28ad8aa59b047da879fcc540946d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fd64d1-4ebb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778670292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670292, "uuid": "2869cf18-2d83-4b08-809a-ff19749395fa", "comment": "Malware payload", "value": "86af5457faadcac97224bb33b8c0a871", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670292, "uuid": "1e894ff2-5b29-4336-a54f-5f4b80ca52f7", "comment": "Malware payload", "value": "ce1822f4150fb641b445c3b85f990ecbe68bf30ee3ee2cc8e5e92f45d8ae3937", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670292, "uuid": "52d3a263-d46e-4948-958b-13dc9bea410c", "comment": "Malware payload", "value": "597fb73631f8f5f5fe9d31f1878e7ddb2a092445", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778670292, "uuid": "13826acf-d674-4c4f-93cd-5a062ca69a8a", "comment": "Malware payload", "value": "9bd487bb2092250735efc642ba140190aab2c588bf15c773fb9353ca000c787083cd70b58c046f3e0d2f34e59b5960ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670292, "uuid": "46d6fecb-74f0-4616-9885-5e681eaa514c", "value": "T144455F3E9A3702A68AB1B45EDC72570EDCA09F990151F7376A7CB97ABB41019D4C323C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670292, "uuid": "15326d9f-6b86-4e7f-b027-d1630ef113fc", "value": "24576:fB+tR1Ze99UCFyvaGrvBXU7N0sA/3ur/XPxtrmdJijLh:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778670292, "uuid": "0fd8eb67-5255-41df-b68a-0e0931841c6c", "value": 1169113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778670292, "uuid": "934c86d5-7bce-458a-bde9-ef535f09512f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778670292, "uuid": "10700baa-ab9a-4d18-b477-1cb763d0f76b", "value": "certificate.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5f0531-4ebd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778671225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778671225, "uuid": "e2bf5870-c442-4a36-8dfb-6c8ca9323d61", "comment": "Malware payload", "value": "cd5fca37c5cc54a2f3c2dc5e872b87d0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778671225, "uuid": "40d95de0-6b81-456a-ac68-1d482aceae05", "comment": "Malware payload", "value": "cf49ee4f77bf87dc1cb4745cf6346193d167c901a2f82cb1b93a3cdacee98a79", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778671225, "uuid": "a7c9d40f-e576-47ba-baf0-8ffa63c8a87f", "comment": "Malware payload", "value": "781a8f7cbcca298feecd89cac59b9016cc671492", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778671225, "uuid": "61685cf6-a6a9-41e7-af03-0e03d1be28b6", "comment": "Malware payload", "value": "cba7417046408fa0e7da82b8f4a6fbd614724c92df17b67ff4e5eda34f6b0f214f22e6089e4a160ab1811c9b6fa7e359", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778671225, "uuid": "a02fa4da-7ecd-4bb7-a21a-a2afc79170e2", "value": "T1CCE5AE47A86245F5E4A6F735C87662A5AE61B4880B3033E72ED17F702F397D09E7A304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778671225, "uuid": "e3264d9f-9a81-40b9-b24e-7f393baabb1f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778671225, "uuid": "4ee54161-c962-46ce-b04b-c0bfc1f400d9", "value": "49152:iRKuafKF6MeW1ZkzM7grJ6Ig3GrRNMXnPZqTg7p7JIlH3FiztbcAr:iEOcMv1i4+eh7Z0XObL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778671225, "uuid": "014a18f6-6c29-46e3-92f4-8eea6b5df05c", "value": 3152592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778671225, "uuid": "85ac5c97-9ae4-4632-a892-13095fd1bd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778671225, "uuid": "48802490-31a4-439d-8ac7-4bf1b87fc649", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157b8bb9-4ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778678675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678675, "uuid": "7ace5f79-e1c4-4afa-987f-3e702071c598", "comment": "Malware payload (Mirai)", "value": "8587d1a6eec41946b09aa709280da4f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678675, "uuid": "15da0ddd-1292-442c-897d-3c6ff4f292ca", "comment": "Malware payload (Mirai)", "value": "d37801566901e335ed96045ed2baf759d0b5ff90d6d4e18f1bb4daf382ceb547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678675, "uuid": "7e3794bf-9e2a-480e-9b9e-c2f90e228f91", "comment": "Malware payload (Mirai)", "value": "26d58bbc724d3c000e5bcc63444d33f1de01ef56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678675, "uuid": "4f8a1026-9a05-45d7-9c01-7bb996dc8500", "comment": "Malware payload (Mirai)", "value": "55039a418cbf321f1b4741761fe5863ac8da7ae218001e88b151311936f42ceb3d567ac5f2051d6ee2c91bcc2b52ba20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678675, "uuid": "a01a2e04-4d06-406c-876a-0a8abd097dc0", "value": "T11BE3AD97F2075868C82306F44FCB4B5C2A2321218F2796E77D1E32796F7A9DB64067E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678675, "uuid": "e7fbf9f3-f8e3-472d-a488-ffe2a3ad6590", "value": "3072:c4jT2qQO53Kg7RYC1l8VmKNxKqZpfgzCsMJzJAc5tqrM:ZjSqKg7qCwVtjxbKCsMJzqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678675, "uuid": "e95b35c9-4f9c-488c-937d-7016539f299b", "value": 143412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678675, "uuid": "fde9b4be-d07f-4f69-9898-e600b783af89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678675, "uuid": "56eb2cdc-17d9-460d-9321-368e3df4c0c3", "value": "bot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9afca-4eb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668931, "uuid": "d647fd8b-e96d-4be3-a75d-29fdf572e739", "comment": "Malware payload", "value": "71d438336bb17d7124384582f4117654", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668931, "uuid": "07f2789e-eb7b-4545-848b-b2bfb7d45a8b", "comment": "Malware payload", "value": "d5b10a827a2811d516cf6e0d601eb9d7354d37b7d7e5791aceb0227482f3227a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668931, "uuid": "c2680166-fc1c-41c1-9c21-913244040679", "comment": "Malware payload", "value": "77d685a0e8b43f4e94a0bad66d50a707178200e1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668931, "uuid": "a615e1d3-657a-4a40-ac2f-726949cd812e", "comment": "Malware payload", "value": "b84008304bd10c5feac182a10174a57105fc5b0226fe5016c8e0394b9a881ccd5857fd3656ffbdd14ec52cd4338cde76", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668931, "uuid": "ead181f9-fcc1-4d20-8506-56beb66555c3", "value": "T1C905333D6004A4ED950A8C502E0A1F6714BEF61474C867CCFF7AA3D46884F5E7B6B8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668931, "uuid": "9c9c4999-931a-4415-85d0-23b11e80e041", "value": "12288:fUs3Dwn4Z/ULJuHG2PSjn3kooEc/9kFDrq7u/TFBYHNw0i5AEvvfr2IXjhDljLJp:ss38n3LJuOUoFcFk8GRKtOXC4jhljLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668931, "uuid": "c68722e3-39a2-43fa-946f-bc6e4fd276a3", "value": 869808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668931, "uuid": "897a1ce4-1244-4af2-9620-66b5cd626bb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668931, "uuid": "5a0750f8-ed06-4c9c-9737-732250bded8d", "value": "photo_2026-05-08_15-06-16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d059086-4ef9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778696860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696860, "uuid": "fdb9f685-53a5-43cc-8d77-f3746dcbacf3", "comment": "Malware payload (Mirai)", "value": "448d9f39e5330856f768841609b15bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696860, "uuid": "9c76c453-8df4-4e79-8a32-f007a21cbd27", "comment": "Malware payload (Mirai)", "value": "daade52b71804710eeb002628575d95ab62dda3b2a03fac1a5f7ba476b5ac96f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696860, "uuid": "40704e76-7194-4458-b31f-db2ef7d51c1a", "comment": "Malware payload (Mirai)", "value": "18732d25e0f949583bc82d382f963794851b46a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778696860, "uuid": "e9420526-64ea-406f-9bd2-bea4fc6c3a25", "comment": "Malware payload (Mirai)", "value": "c4529e65add12c1de40e6bf8388f73c888c704a19d7e42044090937d3d00a21e4f02680b1ba3f485033975483f8054cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696860, "uuid": "448e445c-d7e2-44c5-98a1-1d08cd4c7765", "value": "T122049D23D8786EA8D664D4B0F4F19F791B53A12182471FBE67A6C9744087E8CF9093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696860, "uuid": "9af4d094-85f9-414a-83c5-f418c5cb132c", "value": "3072:ZKuFXE/3X/mjLsfGVg3LeC20ZCReviEg6NRaWxhTI6AL8:gVn/mEQUevA6oHx26H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778696860, "uuid": "f3a9d4a3-b08b-43f2-8d13-8f4bb34ee5c9", "value": 183172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778696860, "uuid": "0c354185-3575-4de6-adfc-a88663926b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778696860, "uuid": "73532fd6-86b9-4a24-ab04-314ad02e7065", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46da2b0e-4ea5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778660719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778660719, "uuid": "85cb5902-5f03-4d24-a4db-b87e62215fc6", "comment": "Malware payload (ValleyRAT)", "value": "d84f240f41ecdae77dc52a6ba32e7b2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778660719, "uuid": "cee8b5b2-c143-4e0f-a8ad-31693fcda422", "comment": "Malware payload (ValleyRAT)", "value": "db9eb3c96c3b3938e358b949211e9da304d4a948a29f993b0f5d6b759bdc108f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778660719, "uuid": "afc3c49a-7c5f-41f4-9c37-fd3d452a6afe", "comment": "Malware payload (ValleyRAT)", "value": "460f70170ebf5b10bf7e976186f632ebd1ac468c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778660719, "uuid": "17e6e276-8a04-44a5-be84-76acd3a610a4", "comment": "Malware payload (ValleyRAT)", "value": "e64e3d3bf4a51bc0869da23220298e2ffaf018a0e0a9dd97c7aad687a1286eaed269504520b55744ad5d8913b39f921e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778660719, "uuid": "7dee73d1-54d4-4163-a818-ed6237968523", "value": "T15766AE11AEC49AB7CA23FB3C1952A06CB09E9C141775C3E3DE9F7EBB1C380425958766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778660719, "uuid": "022cdbf8-1acc-47c4-877e-0f40a8954b2d", "value": "0570f232072c2676976eea801785ad17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778660719, "uuid": "51a2bc61-d8d0-4f5f-b147-88b8a6916a5c", "value": "98304:2V0wZk7UIlu5j8n3NB3fAHi0x9huVJl5Vhpj0pEd+2MiV+Uyg:I09ns5jVi0x9W3VLel8Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778660719, "uuid": "a56fa6bf-0d09-442f-9cfc-d829ac5d988e", "value": 6691328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778660719, "uuid": "46a0ba05-d444-43e1-a3da-79937ad30598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778660719, "uuid": "d6b4626b-1626-43a8-89c2-144b819c7b30", "value": "db9eb3c96c3b3938e358b949211e9da304d4a948a29f9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c5e55-4e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778654441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654441, "uuid": "26acc3da-017e-4c6a-8d97-cd0962f43a7a", "comment": "Malware payload", "value": "c738b27e7a8b9dbfcf3fcece495ab525", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "pw-antombot", "colour": "#6C45B7", "exportable": true, "hide_tag": false }, { "name": "pwn-antombot", "colour": "#7F29F8", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654441, "uuid": "e974eb79-6c03-4018-89ec-e2d73101990a", "comment": "Malware payload", "value": "dc04ee8bd9fc98a8c7e4e7ad80565a90cba87df6c8933d659e97492ec53f9069", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "pw-antombot", "colour": "#6C45B7", "exportable": true, "hide_tag": false }, { "name": "pwn-antombot", "colour": "#7F29F8", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654441, "uuid": "e0618a66-1c0a-4ad0-b8bd-585c30bbb375", "comment": "Malware payload", "value": "9451802652b2fa19306a30f4bf233496ae1f27fa", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "pw-antombot", "colour": "#6C45B7", "exportable": true, "hide_tag": false }, { "name": "pwn-antombot", "colour": "#7F29F8", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778654441, "uuid": "40e1bedd-ec82-4883-baf8-a81bf1b824b3", "comment": "Malware payload", "value": "9f1415226867bb58fa154e75424dfd730414c79096108edbc9dc6ff7bd8a80b5aec529c9cc1c57f1a37387bc1922ca74", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "pw-antombot", "colour": "#6C45B7", "exportable": true, "hide_tag": false }, { "name": "pwn-antombot", "colour": "#7F29F8", "exportable": true, "hide_tag": false }, { "name": "uurdxji-com", "colour": "#334970", "exportable": true, "hide_tag": false }, { "name": "yuaushg-com", "colour": "#D0F2E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654441, "uuid": "c5fff814-5a17-45de-8a1d-f6bad9128d04", "value": "T1458533A34918EAAE517018C9B792D89E0AEAD77128F4375B4F30F33567C8496D7B903C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654441, "uuid": "2a8760fb-a42b-4115-a195-fb961a92fcce", "value": "49152:+BO453wMyx4vomO+/Ub+dpZCZa8pD2bcI1b56PgEuirMn:+BRJwMK4A13bMZCrD2baPgEJr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778654441, "uuid": "feb7d2ad-d14b-40ec-b2b0-2411e14d2bcc", "value": 1728848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778654441, "uuid": "a04e70d3-98e6-4a94-aecc-b05cd398cfe1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778654441, "uuid": "1fbdcbd5-37c2-4b9b-9641-9f01a39beb50", "value": "AltPayload.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd9fca-4ecb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778677155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677155, "uuid": "4d029334-682e-4d67-934a-a86b646ce1c6", "comment": "Malware payload (Mirai)", "value": "460c4a0cd4d9a8c94d702b67fcfc1164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677155, "uuid": "a185e315-f4d5-461b-a5bc-264e28b47cf3", "comment": "Malware payload (Mirai)", "value": "dd2bcbf93a0d24e2d357983e32481a890d53b7d174c4b59ac488ec349ee709e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677155, "uuid": "ccdcb470-c34a-427c-b94f-6101474e163d", "comment": "Malware payload (Mirai)", "value": "7e1293ca9e61508e1ef94d7fcfb7d8614fad1719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778677155, "uuid": "3c37a33a-07b6-4adb-99ff-6afb8106bd91", "comment": "Malware payload (Mirai)", "value": "0e3ef060f7244ba1f725396bf7ed21e4d74006cfead8927fc1339c90719b6f1ae066c220a752752fca9f8cba7d28b8e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677155, "uuid": "e76a8b4a-5ba4-4a19-8a7a-ad52a38c23aa", "value": "T131830212490081F4DA6DC5BF5675C7907B882F3DF883A8E1B260E5BBE5ECE21990568E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677155, "uuid": "8c5cb2f9-6e3d-4ee5-b622-0e608c07e76a", "value": "1536:ucR0XnXMuntIKTy1BWrgtaSV4LFCemb0kwnFtFevbIJs1a1cTZ3DzdEAmqVJuK:z03mIgMSVt7CI4S3P2qVQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778677155, "uuid": "a70bf978-8cc5-4a39-bb14-c654dce5e312", "value": 83052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778677155, "uuid": "8d3fd28d-7f87-4037-b532-a0ead27bfe35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778677155, "uuid": "48242560-2fec-46e7-b9b4-b3ba83ed3998", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d288cf-4ea7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778661460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661460, "uuid": "50a79919-70ce-45d4-ab96-c66d1e5fe7f8", "comment": "Malware payload (ValleyRAT)", "value": "c8df90c28d202c86f549a03a3bb0a3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661460, "uuid": "53a42d38-e3be-47e4-adb8-207617c003a8", "comment": "Malware payload (ValleyRAT)", "value": "dde3291400a0666dc0d90e8725811ffe00e4f399106c4b24b2a557982d2ae862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661460, "uuid": "7ad58fcb-118a-42ad-b2d3-48eba35aab48", "comment": "Malware payload (ValleyRAT)", "value": "84d035c1d8eb3941c0da58a0d25dc4c19c032608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661460, "uuid": "34bb0c89-d8f6-45a6-964b-fa6af02d0d1c", "comment": "Malware payload (ValleyRAT)", "value": "960e5183222ad25260a5e04cb5bf9d0ed3a8f48cd6cdcac95a6c35e9fda74bc0367bd8ffa2debca8396fa3916fd49682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661460, "uuid": "3d09c4bc-d7a6-4b1f-a92d-ae50fe2a636d", "value": "T1F8D4A707EB35E1A5D16AC4B966621373B631BC0CA324A367CF55AF117B31BA4CDBA700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661460, "uuid": "98a62c15-e52f-451b-bd84-c800e432b47a", "value": "9b738f748fda972cb4302bed2452843f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661460, "uuid": "3a96c649-8f7f-40c0-bcee-9b8f52dbf8c0", "value": "6144:c/eYN7FklW9tAdYUcmLy94Aa4o53GEfRx65LFcDT4QresEdZlUyzSyy1/n3zD7nG:+eRkwuBjVjsfP3Sao/fQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661460, "uuid": "b84ca81a-84ba-4c62-a7dc-97bc7f90eb59", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661460, "uuid": "8bdef132-8a90-4d3b-8ca8-d761f8f4db45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661460, "uuid": "225d896a-66f8-4351-8f1d-7dd2a2ed4911", "value": "2026.05.13\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767587b9-4ee9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778690004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778690004, "uuid": "a625cb3c-e57f-4cfc-ada9-62728f3b182c", "comment": "Malware payload (Mirai)", "value": "31aa50f62de4c4686c2f1770785f3145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778690004, "uuid": "faff5cf4-44d6-43be-8e45-0a390e9ab178", "comment": "Malware payload (Mirai)", "value": "def0dca37160626a211ff7f5270bd7dd415dfd23f7495d5302304c82e6f2c4c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778690004, "uuid": "f8381a80-a2f1-43bf-b3a6-d03e16d612f8", "comment": "Malware payload (Mirai)", "value": "dd5bca8a3748be83bf924f04a5c98d01e7a8b2cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778690004, "uuid": "49c49f9b-4fb7-4f20-830b-07935d0bdf9e", "comment": "Malware payload (Mirai)", "value": "d3272e8c654fea8c8d92f7d883d0f25326b57bbf18d2d5dca7b0d756e3a2367c73f4b8437107e6f65f61e39455ea9d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778690004, "uuid": "1a592ba9-4644-499a-9471-f78839b3e345", "value": "T125141945F8819E53C6D562BBFA5E428C372A13B8D2EE3102DD215F21378B96F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778690004, "uuid": "24506797-c277-4bc6-8980-0bcd08fc9ed5", "value": "3072:b2UuoGHbhR0GIK2vygojpWa/u6l7aZ7ne04qPxpi09H9lYUNqAf7:b2UpwRHIlojpTuhNe04qppJp9lYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778690004, "uuid": "edb3c670-3e0f-4b6d-8b42-15e93e33210a", "value": 200576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778690004, "uuid": "d8b9a23c-7b08-4eea-8941-7432260b6fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778690004, "uuid": "0690142c-cd87-485a-bcc8-21a19514fc76", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6ad9c7-4ea6-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1778661079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661079, "uuid": "0ca7d00a-d6df-494b-be4d-f04f4bca2537", "comment": "Malware payload (SalatStealer)", "value": "7d423a2410fc0f02bdf6ddc557ff38be", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661079, "uuid": "a1d060ba-028e-443a-b57c-00318f5b16ac", "comment": "Malware payload (SalatStealer)", "value": "df0c9eb79c128f5b4f27155d6a2d2b7dcfe0cd84868e92c3cf5b741a73db70e3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661079, "uuid": "c112e52b-3197-4ae2-97a7-f6cec5d151ed", "comment": "Malware payload (SalatStealer)", "value": "dd42fa98e05e6801a06e85ad522bdd899141a20c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661079, "uuid": "12964d4b-1af3-43c8-8008-f8eb4d10c8b3", "comment": "Malware payload (SalatStealer)", "value": "744a511fb0b70de28d3d4bbfc683304fd32bacb6c5ecbad9d0fcd0b36c7149bbdab4c9e8d4d3daea560df9c2b1c676a8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661079, "uuid": "b1b511c8-4e73-415f-a925-ba4bcbe4583b", "value": "T136469D033BFEB05EEAAB97B4957866418625FC774C91804931CD548B4F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661079, "uuid": "f5946c74-b96f-4850-ad28-3e68fcc87c74", "value": "2c13cf8017e9ba514125d2be4b551c50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661079, "uuid": "550f8030-4884-4071-b050-1cd8b2f55ad0", "value": "98304:s8hxXpxeLMnyZS9kxdIS+T9C7xJ8D5OHfA:VxDpyZbnn+T9yx21O/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661079, "uuid": "d69fc134-3c01-40c8-a53f-aea8222bda1a", "value": 5550080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661079, "uuid": "7e1b071b-49f5-4dad-963a-8b64375d4642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661079, "uuid": "16b6fb77-d6fa-4cdf-8d3c-2fc4abf867ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e68b215-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778700755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700755, "uuid": "ccd866e8-8803-4d93-b137-6baf78c5cdd0", "comment": "Malware payload", "value": "5b84ad7b1743603f59779f9146184e91", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700755, "uuid": "caa0af1c-40d9-46bf-9a54-a48fd9fa95c6", "comment": "Malware payload", "value": "df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700755, "uuid": "ec99ba1e-697f-423e-8068-7a0c231804e7", "comment": "Malware payload", "value": "650bd71840384aa9b42b8678c9a47fece1755e2c", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700755, "uuid": "1c51380e-8b57-43c3-a26d-a8c840030970", "comment": "Malware payload", "value": "21517a28281f1097d6d5fc57b3c4fe45009fbcb83870f4269b9b07fa2389f36e7e47730a9c45ec98ae825790325dc0d4", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700755, "uuid": "ca49f4be-5425-424e-984e-b1ba6331f080", "value": "T1B2B3125B37EA83001D817F7CF128921BB2FB77482061536BEB4D96B4B88919C4B45F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700755, "uuid": "2000f0b8-7c01-43b6-bb8e-e16d1b8074ea", "value": "3072:CpM7QpiyKLe/XoiKwqbiK645MVxdSPIDL/:C278zXaBb3645wxIPw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700755, "uuid": "86d20ebc-2b4c-4089-bdbc-4c6633238151", "value": 115220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700755, "uuid": "dab5ed71-b9a3-4a38-8cd2-6525a24eec58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700755, "uuid": "4c01d7f5-adf7-41f8-8cf6-89068a38587e", "value": "Sales Order - Order Confrimation VTR 1000030878526 - 0061-27-EXOL-Q_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b33eeb-4f00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778699802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699802, "uuid": "f3f9fbdc-453b-4f31-9d48-ea386a436431", "comment": "Malware payload", "value": "35ab15ee258a0852fb3dc0acc8b3bfbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699802, "uuid": "d61a3848-468c-44bf-a819-ad4e2ff595ce", "comment": "Malware payload", "value": "e07eace65a2dde744a0cc3f2d69abe929a3c75a4847f63cbcb71d9e2c52341b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699802, "uuid": "371cc358-b297-4e13-b2f9-c4e8581ae2c0", "comment": "Malware payload", "value": "dca7412a76d1639e243556a792e3b70a89c40d98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778699802, "uuid": "0e092173-fe4f-4d5e-8ac4-e5eced4d5dc1", "comment": "Malware payload", "value": "672e56894e97a55503da85ff299fba7bb7aac0176ac30e7769c46d5250551052588b3cc671daaafbffc0be00e9fd7ddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699802, "uuid": "199f9952-fe7b-4dd6-82ac-00205cd53a2c", "value": "T1DBB31866FA14EB3FC40E83306873C75056D52CB12E925ABE3264EB9C7E3415B1E5B9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699802, "uuid": "29fb400e-94a1-4d0d-9c1c-4fddb8c9ab75", "value": "3072:hqSs2wE/LGqf+Z+77py9Uc7nCbCBdulHmN:hm2wE/L5fXpYUc7oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778699802, "uuid": "ef36751e-c668-4d0b-ba85-d748e043f9b6", "value": 117308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778699802, "uuid": "7ad3cbc0-ae73-4c8d-9cc8-ac5daf842cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778699802, "uuid": "30de5d46-e349-4946-9054-edff3c4076d6", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1641ef05-4ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778678676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678676, "uuid": "2a3aa5e5-5c28-4fb5-ae08-dd843f919dbd", "comment": "Malware payload (Mirai)", "value": "ff7ec1e723c7e0416e447ad0dd5d12e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678676, "uuid": "175f5042-fb10-45bc-b92d-445d1dcb98e2", "comment": "Malware payload (Mirai)", "value": "e145a889a8cb2ba5545a53dfa44feda9e46be0af7e2402424981cc50b77bcd64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678676, "uuid": "0ad810b4-fcd7-4999-bbac-4b9794a794e8", "comment": "Malware payload (Mirai)", "value": "a19df1863ddb717e60e9234a726663de58589c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678676, "uuid": "41d4850d-61c1-46d1-9203-0546bd2a664a", "comment": "Malware payload (Mirai)", "value": "48a5171d8743a26191dd5b5d34fe3b95f91bdce8ae13928458b9383db77bef4c905a28d0a63ef6f28362cdcc2ddf42bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678676, "uuid": "e74e3af3-c53e-40e2-9f7c-a60e623a5a43", "value": "T1C5831952FE81CC52C5E824BEF91F42DC3343076CC7EE76029E11AB256ADF5994E3AA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678676, "uuid": "ffed4df5-95c0-4c29-8c8a-bf7e20ab1890", "value": "1536:QE0jrNjnzz4oaUQ9LCoScCOM+CTohudBQWwatU/m7:Q9ntgoaVCo5C1YWFtUO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678676, "uuid": "55cda330-a184-41ee-af9e-58846330f950", "value": 88012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678676, "uuid": "9091e9a6-f5c9-4fef-8123-a984ab629e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678676, "uuid": "1cb465fb-bdb6-4d51-a583-a375d38703e8", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8708585e-4ece-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778678436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678436, "uuid": "6e348b05-47d6-4816-baf0-b10be3455780", "comment": "Malware payload (Mirai)", "value": "2ef5d3cf5621b8ee912d43c31477298c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678436, "uuid": "15c2d4bc-3b64-4ed5-86b4-4570c9dc4ec6", "comment": "Malware payload (Mirai)", "value": "e2748fcc09d83503b9e9fdc4f09fb3084dcdb8665f95795b29de6f8aba5b8538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678436, "uuid": "af2b0c2e-6640-487a-8ad4-f3a8234d1092", "comment": "Malware payload (Mirai)", "value": "1d5b8286bc0e239d4566133b8aac09ca8763317e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778678436, "uuid": "ac046f4f-6851-4d29-a878-fde778fb4939", "comment": "Malware payload (Mirai)", "value": "73bbeedf066d11272be2089dd5b1fe4128be28ff4b411170b340ca1877b2c9e0fa512847ac30b355c87e5a5436a69c71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678436, "uuid": "1de07caa-a89b-4ced-9e9a-f5b0be3f4612", "value": "T1DCC32866BA24EB7FC40F83306873CB504AD52DB12E92167E7264E79C7E3016A1F4B5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678436, "uuid": "85cc52cd-6821-421c-88d6-591d47f2ef91", "value": "3072:fNUj6qSyDNehHvHuXe/COlnH7+2/E22EsgbmoE:F34DNehPOXenb+2vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778678436, "uuid": "bc7297ca-ccb1-4515-8ae7-5a9951db3c53", "value": 123100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778678436, "uuid": "ce5e2278-bbd7-4ca5-a762-df3ea869bb5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778678436, "uuid": "cc846a0e-abfb-4b9e-9a7d-07073b422ef8", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23e2717-4eb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668173, "uuid": "d4a5466c-58ec-4aed-91ed-6ecbce2ca30b", "comment": "Malware payload", "value": "8b099809c2ae8a1fe0825b6ad082f3c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668173, "uuid": "1f4863ad-4df3-4751-b98a-22e1ab01bfb2", "comment": "Malware payload", "value": "e2d282627a232e4f6231c8ff0108a08b4e40c14104199d78a9e7e08ff377f248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668173, "uuid": "c4a77e79-7648-48a0-82e8-2474a1073d7d", "comment": "Malware payload", "value": "a0fa860d35d8b14382d806ab024203f3f8168460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668173, "uuid": "dea7be7b-db2e-4f5b-a097-fd852a025071", "comment": "Malware payload", "value": "3d632ecb81bb2b92ca1454bcb1c36fa3f1a08d106b2022f611e1acb2d7630931a68afc0d5888731e80443f31c9712108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668173, "uuid": "4bc60779-eec5-4e96-b734-905b94993f18", "value": "T1EA52610BE6B31C9EC63DC37401A75B7199A3BC3852713A632B98D9316DD29502F39E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668173, "uuid": "1d0a9613-8768-412b-b542-7a06d35a26eb", "value": "96:GJUvgXucbmz0ZGnwTwNbEUxi2J/vZ5rFbkqVpoQ:GcowB3NQU/J/h5rdkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668173, "uuid": "d18d7a2b-23ed-41aa-86d0-1d28f7f34426", "value": 13408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668173, "uuid": "9df25437-6e8c-43a1-8194-607139c0d15b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668173, "uuid": "09b9148a-015f-4c85-a7a2-b8559d329820", "value": "8b099809c2ae8a1fe0825b6ad082f3c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb77547-4f04-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778701636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701636, "uuid": "b0a15d9d-aa84-4403-80dc-81f47322c159", "comment": "Malware payload (Mirai)", "value": "25dab04db455ae465d02843ef3de3ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701636, "uuid": "4205a96a-a533-45d3-b103-2843173c072c", "comment": "Malware payload (Mirai)", "value": "e47fa77d91c5098e18ec0cb24aecf475e90feceb430afda1a0c6ed8763e8fcfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701636, "uuid": "8c8f7152-9253-4cbb-b587-b6a87f464c4c", "comment": "Malware payload (Mirai)", "value": "5db86b683929ec4e434c342018764c58babbe773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701636, "uuid": "761bf8a6-5207-407e-876e-7825315b261d", "comment": "Malware payload (Mirai)", "value": "fe006a1db04c49c3f3acb881e3ff5c22f3cc9cb99bf2756aa1600264a2ef9f8f676ec9cde155d432ad6a1e12f66e466f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701636, "uuid": "aa3f3675-a775-40c6-a5db-37fb4004fe79", "value": "T161E318C7F900DEB6F80AE73748530406B130BBA249525A337257352FED3E19955B7E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701636, "uuid": "50a69234-03c2-4dfb-a500-f9eba8fc5bad", "value": "3072:hKstzFgVWnrbOygEteSpGUtPQp6wsOo7V0jbiKLVtTfZ6kh4:pfOygEeSp9trnOoaLfL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778701636, "uuid": "ed8ef136-a80a-4862-96a8-999a57f538cc", "value": 151744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778701636, "uuid": "07834019-63ac-444f-8212-bcc4980d089e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701636, "uuid": "cb695eef-6f13-47c0-aa75-1e316ba6f9fa", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5c4fca-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698636, "uuid": "427979e8-ae23-4e5c-b910-1ec223b7eaeb", "comment": "Malware payload (Mirai)", "value": "adb0c9df366e005cc16faabdbfa99877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698636, "uuid": "2f3fca07-2230-4dfd-8e5a-cacc7fbda6ce", "comment": "Malware payload (Mirai)", "value": "e53978d10d1890041d691466e317054c3e356f3b865706fb24f253d5ad4d5a28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698636, "uuid": "919cdf76-0921-4c7a-87a6-8eeadabb95bd", "comment": "Malware payload (Mirai)", "value": "74cff2a044a5fcf6fa17c441c357d110e3a0be25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698636, "uuid": "ff5f2f92-5321-4af0-ad6d-52f831b23814", "comment": "Malware payload (Mirai)", "value": "acd8375769ef833a1bacbf6054348c01c12d1efdb0ca32ec938d7ec7eb9da8cce59d84b77877ef3a8357728148d498c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698636, "uuid": "c9ddb618-c1cc-46c9-9090-c8cad6395e40", "value": "T17553F2DD975D0900E16A603A93DD73AD78E0FC4A65C842F5E30CB790186EB5F3D28E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698636, "uuid": "b2a530e0-1093-43a0-815a-3fb9cd3c07a1", "value": "1536:A7whuWe52UvL4flbUPYCEzWLcZfcir4mzmI+nnouy8ry8:AscWe5qldCEzW4ZEc4AV6outn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698636, "uuid": "3dff6705-13d0-4ac8-bc8b-0744d0b63557", "value": 63964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698636, "uuid": "e097ae53-5f28-493d-a0c1-d4d679ee7375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698636, "uuid": "7b2fb274-cfe7-4c05-8dfa-63e6e0e07069", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e846287-4ea7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778661537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661537, "uuid": "d3f32c45-dd7b-42b8-b52e-1b595b448968", "comment": "Malware payload (ValleyRAT)", "value": "f81a6f17cb9956a66691805af740f9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661537, "uuid": "a5f29915-daff-47c7-bb15-0e1176cda028", "comment": "Malware payload (ValleyRAT)", "value": "e5f89ee89c4ea2643bb34c4a5a60881308bc79dc2bbe9f4b6e26a84b00ede6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661537, "uuid": "a2946141-bb89-4f51-9b26-f7e03da34b04", "comment": "Malware payload (ValleyRAT)", "value": "590e233df71016604a2ce57706067d68ee166895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778661537, "uuid": "80aaa6ee-279b-472a-8b85-dd227dc264a4", "comment": "Malware payload (ValleyRAT)", "value": "5881e031df46e69e3f66d4f29c0bc41f015ba62e9381d49922a363ea8553da08e20c27e6b81aab9d6b9947901292927a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661537, "uuid": "83b88013-e64e-47e3-859c-5a427bc50787", "value": "T149D4A607EB35E1A5D16AC4B966621373B631BC0CA3249367CF55AF217B31BA4CDBA700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661537, "uuid": "f4b3f133-7276-46f5-8588-f3f7eb5f24f1", "value": "9b738f748fda972cb4302bed2452843f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661537, "uuid": "64f6b086-5750-4ec7-9375-d11c2ba86c53", "value": "6144:X/eYN7FklW9tAdYUcmLy94Aa4o53GEfRx65LFcDT4QresEdZlUyzSyy1/n3zD7n9:veRkwuBjVjsfP3iBxS515", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778661537, "uuid": "f048aaec-e931-4b3a-9b10-31d1a43f37f8", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778661537, "uuid": "a47376b9-05ce-4eb2-9298-7ed47968c13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778661537, "uuid": "191a9bcc-6c8b-4cdd-bf38-4f9c288d1bd3", "value": "2026\u5e74\u7b2c2\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98746b1f-4f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778715831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715831, "uuid": "5876715b-2311-4dec-b2a0-c7ad52298e82", "comment": "Malware payload", "value": "a892b1d7c54cf65e83cf4063bf2faca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715831, "uuid": "3fa56a63-466b-45d8-971c-7da9097e8567", "comment": "Malware payload", "value": "e6586bcd0121205bca01de109101adbd2f771d8e94e50c460c24e71d2c7cb611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715831, "uuid": "16aed4a3-7877-4d4a-b3be-9731173f5e74", "comment": "Malware payload", "value": "2009c0321f401c0216a55a103c583ea5eea913a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715831, "uuid": "baf3abf7-6ab0-4d2f-af2b-b02b14c9b3d1", "comment": "Malware payload", "value": "3187771981840b4f06faa483ad392b16c5041370fa96bcbedf2a2375a5c3e55f962ae10748486d5bc39f6d7705ad6998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715831, "uuid": "beda20e5-e03e-41cc-9955-e3005a97ba57", "value": "T176730991FE81D952C5D939BAFA5F41C8338303ACD3DF72028E019A35A6DF51A4E7AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715831, "uuid": "166e8f23-d0a9-4838-b98b-6b345bd1c709", "value": "1536:GwQ7rNjQGv5g/VkfSv+vkIpWqW7LuxvFi1wWOS/Z2Qxqb7:kJ5gNwVMi/8utFuw0Rqb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715831, "uuid": "533bdef6-313b-4c06-a3f0-1b9c55dda8e0", "value": 80436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715831, "uuid": "ab808b9e-77b2-4f66-a96b-8381495cf219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715831, "uuid": "130c532c-9a9e-4e96-9d5b-73123e801fbb", "value": "SecuriteInfo.com.Linux.DDoS.2637.26560.4141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e347c6a6-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778638218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638218, "uuid": "6afa4a29-e972-44f8-bb1d-8a594c5dad86", "comment": "Malware payload (ValleyRAT)", "value": "0e08fe8da2df31c5133c6803697db6cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638218, "uuid": "362083ba-70cc-4acb-a32f-8175bff485f9", "comment": "Malware payload (ValleyRAT)", "value": "e66b89e5ba1662f055f9030c10af9cdb366eb72ffa893013ffb33ddafc2baa01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638218, "uuid": "e3b4689d-0828-4467-a7c3-7d2b365aef37", "comment": "Malware payload (ValleyRAT)", "value": "8a5ad5e836ecd8db32be25166fdeb6a90331db26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638218, "uuid": "61a45699-d4f2-4904-98be-b10ff4092a69", "comment": "Malware payload (ValleyRAT)", "value": "592558536e74b8babe7b6641ad5006eea8724bc51cda5e1788ac95595685fd69070003612f93d4bed4704d4aa23e44d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638218, "uuid": "5759ad22-836d-4b3a-9923-a8f94aed9dda", "value": "T1DD66AF11AFC54DB7CA23EB3C1916A06CB09E9C2417B5C3E3DADFBDEA1C344424968766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638218, "uuid": "fcf931b2-b463-4f8e-a042-1236d41295b6", "value": "0570f232072c2676976eea801785ad17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638218, "uuid": "b022f385-7b4c-411c-bfa0-46098a762c2c", "value": "98304:9zsmPeG+yhB0DhlL3Yi0x915FZLp9fj0pEd+2MiV+Uyg:hsPyhB5i0x99tpFel8Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638218, "uuid": "22034d59-3f18-46fe-bd9a-d53cd4d19d8c", "value": 6678464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638218, "uuid": "7358e3ef-9fc4-495d-b7a3-ca3eafe3f236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638218, "uuid": "25d202ce-bba9-4eeb-ba0f-34a0709cbc29", "value": "e66b89e5ba1662f055f9030c10af9cdb366eb72ffa893.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092875dc-4f06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778702276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702276, "uuid": "836902a0-c25d-45db-90a0-c8d3d4b30576", "comment": "Malware payload", "value": "8218cc08f593db53c0a3e09f1f56201a", "object_relation": "md5", "Tag": [ { "name": "cc-skimmer", "colour": "#3B6AE4", "exportable": true, "hide_tag": false }, { "name": "GorgonAgora", "colour": "#AD227D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "medusajs", "colour": "#6B1337", "exportable": true, "hide_tag": false }, { "name": "PaymentVanilla", "colour": "#14EE09", "exportable": true, "hide_tag": false }, { "name": "web-skimmer", "colour": "#3840E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702276, "uuid": "bd35e25c-d0d8-4756-92e3-7c61ce85f514", "comment": "Malware payload", "value": "e6c60ca4f996b209bbaf7429182d7ed76acf761bb9c1de63486fcb76635fa58c", "object_relation": "sha256", "Tag": [ { "name": "cc-skimmer", "colour": "#3B6AE4", "exportable": true, "hide_tag": false }, { "name": "GorgonAgora", "colour": "#AD227D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "medusajs", "colour": "#6B1337", "exportable": true, "hide_tag": false }, { "name": "PaymentVanilla", "colour": "#14EE09", "exportable": true, "hide_tag": false }, { "name": "web-skimmer", "colour": "#3840E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702276, "uuid": "62ee397b-10b3-4c95-a45f-3b70a5befcd0", "comment": "Malware payload", "value": "2deaddb1176d318f02e6462369e75da6f4e84185", "object_relation": "sha1", "Tag": [ { "name": "cc-skimmer", "colour": "#3B6AE4", "exportable": true, "hide_tag": false }, { "name": "GorgonAgora", "colour": "#AD227D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "medusajs", "colour": "#6B1337", "exportable": true, "hide_tag": false }, { "name": "PaymentVanilla", "colour": "#14EE09", "exportable": true, "hide_tag": false }, { "name": "web-skimmer", "colour": "#3840E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702276, "uuid": "547cbe78-9b57-4934-baed-7cd8c7ffa2f0", "comment": "Malware payload", "value": "14ec971ceac7b858f12f2d1ad7725e2c2c8b4108494e1cec9f2ea9515bf3aeeb19f465ac14fa59492f05d2bf78e9bf42", "object_relation": "sha3-384", "Tag": [ { "name": "cc-skimmer", "colour": "#3B6AE4", "exportable": true, "hide_tag": false }, { "name": "GorgonAgora", "colour": "#AD227D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "medusajs", "colour": "#6B1337", "exportable": true, "hide_tag": false }, { "name": "PaymentVanilla", "colour": "#14EE09", "exportable": true, "hide_tag": false }, { "name": "web-skimmer", "colour": "#3840E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702276, "uuid": "e27e9859-0f81-47d7-9753-7b1e8206e1b9", "value": "T1BE63D646B3E1672B83CA71636C9AC987B33995992386401C7B1CD5F8246CDB4C3B5FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702276, "uuid": "84634a9f-089b-416f-8c60-f3066076e064", "value": "1536:/tK6rN1naAHg9quIkZbLhnHbgCMAqV062cBmOd6l4UMyCZ:gA1nrkZbLhnHbZJq/2/Od6l4UMyCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778702276, "uuid": "d5e99277-1871-46dd-831a-e1f2b164b8ec", "value": 72605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778702276, "uuid": "c4dd2ea3-44bc-43d9-989e-80deb2e69f86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702276, "uuid": "56037de7-6fca-403e-98cf-155b206f54d6", "value": "payment-vanilla.iife.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78980647-4f05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778702034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702034, "uuid": "3c509b30-6342-41fd-8b0a-d0bd6efe010e", "comment": "Malware payload", "value": "e7427c042689b62d480478955aae924e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702034, "uuid": "293b291b-d8fc-40f5-96ef-a03691c5554b", "comment": "Malware payload", "value": "e7f0b76e70282a3b03e38955d3559660c55f757320930aaf3c413b0951941bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702034, "uuid": "c046483f-1024-4642-91a4-04efd3179ce2", "comment": "Malware payload", "value": "eb12676362f51d71ffcc76a7e947d3e9804e2965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778702034, "uuid": "b0a12f12-b273-4717-b464-39f0f48620f8", "comment": "Malware payload", "value": "e13462ab9826967c8199de22231f5bac76786167744ad2c6ca63e5e9cf263f21497be78374393a0dfdad634724a085b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702034, "uuid": "9330ec42-2e7b-46fb-8d88-4eb02c76d18d", "value": "T1FA936C0033EC621AFAFF8B7DACB520054A737A1BAD71E64D4C86519D0972B81D924F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702034, "uuid": "d9715cb0-7024-4de7-9c8b-6113d99764f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702034, "uuid": "9f305bb7-43ae-4ccd-a8bb-9bdf2be0a399", "value": "1536:p3r/cI+xJISqFubM79vVTsqa4tsi5WQf+1LGyamlbTKhCsmswk:p3Dc7pCAX4tn4QWRG9mlbTK8smlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778702034, "uuid": "eb356288-9aec-428d-bc81-d316cc305682", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778702034, "uuid": "de05fdda-26d6-4780-86f1-1476ef79c1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778702034, "uuid": "a639d75a-950c-47d3-9c9e-13569dfb9d23", "value": "zlalala.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24171c09-4e72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778638756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638756, "uuid": "d3b703db-3832-4195-906e-0b906b427457", "comment": "Malware payload (Mirai)", "value": "f9c02f2492b65558d0975ce19cde64eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638756, "uuid": "642cc20b-d238-412d-8a91-3cc31d84136a", "comment": "Malware payload (Mirai)", "value": "e8085e4c21496a3aa45fc981bf7185c34fffa983e67b2787026eb66eae85ba84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638756, "uuid": "c435eb90-423d-4458-9347-e9be94be8ed0", "comment": "Malware payload (Mirai)", "value": "79c0234b25a5127f7fb75f6a18c96a312194a5da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778638756, "uuid": "387fa864-caba-49e4-a554-4d018aa8fce6", "comment": "Malware payload (Mirai)", "value": "2728a067caa38c888f688f7614e7a78c9f00ba2923c718b5b8da6ffc18aaff03e0b26da9055cb9488f1e7ffdd9ccb146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638756, "uuid": "0f895dfa-b79d-4240-a3cd-0e5345a6b6fb", "value": "T14DA348D7F401DDBDF84ACB7B4453090AB131E3624A831F36626BB967E8351981937E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638756, "uuid": "50656f70-1773-4989-9168-be6da1adb88a", "value": "1536:jBzQ1QMf9jBzxWxnV1W8UqL4nHtWc6r8n36HKPa2J3zE566K3bedos4FsQTY2ld:jGjhxOnV11B+HtWc6Nc3ze6Zo4Fs8YCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778638756, "uuid": "50c00734-91b7-4cb5-8eb6-4aedd256c52c", "value": 99776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778638756, "uuid": "c6e58922-6966-4234-9f32-705511753731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778638756, "uuid": "bf71556d-917e-4ea1-98bb-216080935a90", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8320dc3-4efc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "984cd313-826a-4985-b405-ab770d0526f0", "comment": "Malware payload (Mirai)", "value": "2a0858a8fdfb7f132747704ab05bf1a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "4e436625-d9ef-4ead-b6bc-98fc182625e8", "comment": "Malware payload (Mirai)", "value": "e9096a674cc88a9c228efecf5178d8e7546ee60fc3787ba23f80337ecfe91927", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "12756a80-0f6e-4791-a465-48dcf4a48410", "comment": "Malware payload (Mirai)", "value": "9ac1eb2ed00ef69da6ed142bf8745dfa242ff414", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698248, "uuid": "4d23b24c-d96d-47c5-984f-d1ead793c874", "comment": "Malware payload (Mirai)", "value": "f4399fd20f6ee2cab6400f77cb1cfe4178d245ebe3675a89cc0f0e0b0f24a49a996c31986af2a969a7ad39ddc7d204ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "516f39f5-84c5-4183-b346-71d193444165", "value": "T197834B5ABD814A12C6D522BBF62E018C373653F8D2EA7207CE259F1137CA92B0D77B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "8ec8aa05-478b-4722-b899-d8d2333b1fd2", "value": "1536:OTJsMAcxxQ02U4YDSyOkuu+xM3N3dbf3sH8tHg+lQLq5jvf:OTJsO402zLHkz+MBl/sH8tHRigf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698248, "uuid": "6219e2e5-9c41-4d88-b8b9-058ae35ee539", "value": 83268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698248, "uuid": "1137915b-4f3d-490b-b7de-79cdca422f26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698248, "uuid": "5f391b69-407c-4018-8646-f94d74d55dd5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf4af7a-4f25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778715839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715839, "uuid": "db856ef2-c351-470f-b3f9-7b1c16fb59b6", "comment": "Malware payload (Mirai)", "value": "e3ef2f36cd38f383cc75000474e912ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715839, "uuid": "f67c56c7-8972-45c1-bb18-f608a15128a5", "comment": "Malware payload (Mirai)", "value": "ea219b922b484740beaa49603d3811c1cb79a676db011218b665cd8d41da2246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715839, "uuid": "70121f55-547b-4b12-a841-ba729db5df24", "comment": "Malware payload (Mirai)", "value": "66e94e7ec5841584aa34da3750e5e15f00b8e9cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715839, "uuid": "af5f785a-8bfa-4a51-a062-84580afb7d00", "comment": "Malware payload (Mirai)", "value": "cf7b9170fdba16d484d5b060090b9d7e233fe3595838d2aaf35b06230bea64d7da41e55f74b50f36ab09dee2e8f50566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715839, "uuid": "01ad3e3b-470e-4597-9922-5306e2ed5c51", "value": "T1E7635D89F783E0F0E9474671006BA76D8634EE235014EE6DDB947E729D72A12B21F72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715839, "uuid": "5c67e386-c4bb-4d5c-8dd3-985144a23543", "value": "1536:+NtbVyyhR1SgnHcbUU31s1R3C5moCL8b9/gkB6Hr:+7bVyyhREMMO7K//4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715839, "uuid": "29d207d3-5346-49dd-b187-39e1e1a2831f", "value": 70552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715839, "uuid": "7861b343-2043-41bc-8443-24034225ca10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715839, "uuid": "20eac428-6b60-42e7-8535-0d82b30b20c5", "value": "SecuriteInfo.com.Linux.DDoS.2637.1140.9759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cacfd02-4ed0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778679277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679277, "uuid": "a9a97a0a-2042-49e3-acab-6da8811bc05a", "comment": "Malware payload", "value": "b6482564cc628c9fa8cfd5acbe1309ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679277, "uuid": "d311adce-3f08-4434-a3cc-147615c81e86", "comment": "Malware payload", "value": "ecb5e08ecd8d287feb3f80fc1f18a47d901d947b1ad42b50345a51705856b05d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679277, "uuid": "eb62846d-76e5-4526-ae53-718e0e6c5aa5", "comment": "Malware payload", "value": "46389108e897078730c4b18100334f387ce9b385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778679277, "uuid": "31dee36b-5351-4d91-8b40-12662a72e70d", "comment": "Malware payload", "value": "c31afbfcbc96efb236dfbe66ad415329cb51097eee83785d7cb34efa09b58855a71d2d2df1b91e066c813a8ff5ab2cd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679277, "uuid": "649f8a44-0821-4662-ab1b-de76e2b1ee04", "value": "T1B7833A02FEE295ADD545C034064A9B2AE770BE8A0325779FA7C476793E36F907E19320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679277, "uuid": "5e885a66-69f3-43da-952c-17229a2eb210", "value": "1536:1ten6GorNtVwtp5AFvaKc45m8U8LDWMtAXQ7uzXwEiyA1EKJ3LEiBZZpcertdp+T:1w6GQhwtUE/45x9Dufy0A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778679277, "uuid": "09b0b535-f305-45bd-b216-5d7da27f6479", "value": 82640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778679277, "uuid": "7e88827e-5648-48cf-a879-c87c50ea90d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778679277, "uuid": "e30f756c-6317-43f9-8320-d24a411fb3fb", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14c7880-4f02-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778700813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700813, "uuid": "fa014748-8c30-4e8a-8fea-456c20416e14", "comment": "Malware payload (Mirai)", "value": "6219b899fb12925dec7d061287b7d1b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700813, "uuid": "07a7cdbf-e968-47eb-96b3-f8b88629726c", "comment": "Malware payload (Mirai)", "value": "ed24821c2eb412dd4c58786990877e25545c4516fbc8f43f23add40fbbb7f5f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700813, "uuid": "542efc73-f013-444e-8ad9-79869a56c5a4", "comment": "Malware payload (Mirai)", "value": "3f6a15a90d5a675265d05c727cb1432d26c51919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778700813, "uuid": "cf8aff6e-ab71-47ce-993a-990d8a51da09", "comment": "Malware payload (Mirai)", "value": "baf790cc84b3226d2134c820c71c724ddc87e3f300da1bc2a1ded2d15bd48e60e65fd6b1acb43c7522cf4ab5397de22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700813, "uuid": "970f8221-8a70-4617-8b49-0051decba80e", "value": "T11583019AB61BE8D5F99D4A7A20CD53F11C2A7440D6DD468D732588CAFAB7C4B600A0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700813, "uuid": "7d27feb0-8a8f-4e3f-9bac-57e1abaff84a", "value": "1536:qtvVEOw54MQPrQr0tKdW6y8SFyZlFniY580fXoqbggNOErEUAMy/yMnWknaF3:KdyQTwdW61SIJfbU2O+yMbXknat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778700813, "uuid": "9cfc10e4-cae0-46bb-8ff4-713e94f4bc07", "value": 85528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778700813, "uuid": "b6d4f793-de30-434d-8cfd-390e14aa40d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778700813, "uuid": "70744e71-7687-4cf5-b658-43f554a64af5", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33146ec7-4e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778635775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635775, "uuid": "26381f03-eef4-4227-a3d9-8a21790f8545", "comment": "Malware payload (Mirai)", "value": "f24900b9d3dc851d817814db4605a4f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635775, "uuid": "e233b477-087c-432b-abe7-be9b1976e72e", "comment": "Malware payload (Mirai)", "value": "ed2a0658061168432ffc9f4492826a6e23ee104cbc3bfd3b6dabc58b29fbf23b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635775, "uuid": "2ea3ecfe-b8b3-4d96-b605-8515ca746a3c", "comment": "Malware payload (Mirai)", "value": "abbac2ed2c56a66c2fe342b5db81eb4cbcbafca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778635775, "uuid": "c72812c7-4419-486a-bd45-4458facdb056", "comment": "Malware payload (Mirai)", "value": "3891a4214dc27938945f9a06b1f1e5372314dc5321a63de7cc8ef2ffe464d4c4faedcb08997ca44588397b6804b90e0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635775, "uuid": "eaaf5480-3792-4a77-95e8-71a8f23ad2fd", "value": "T196F31985FD419F22C6D6227BFF4E428D372A1768D3EE720389255F24378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635775, "uuid": "f6edf9c0-a7ea-47ac-aa76-d79248636b44", "value": "3072:4je6vIJGEMPjO6yjpvB/AANEhA4Z01sWJw9US1Nf+9:4jfIJnMXQwA4vWJsUoZ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778635775, "uuid": "3b91528f-b573-4e27-8cd8-d2f52a91a553", "value": 162736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778635775, "uuid": "c01e052e-1301-4c2b-bcd7-967f5d460217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778635775, "uuid": "c29402d1-c666-4be2-a2ca-a0b5eb0e4af0", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9171917e-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778698639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698639, "uuid": "b54c5c8f-170f-484b-9b28-29a7cae0ce9c", "comment": "Malware payload", "value": "8cecfbbaa90837b8dd48b4c2f09f0daa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698639, "uuid": "8a70a71a-aed2-4b5b-8265-31531895a6d3", "comment": "Malware payload", "value": "efa059c7e9ad73a511fb53b792ab1be0a0876a1a340b1e8fdf1de54e8fa8c6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698639, "uuid": "6723e8a5-8a8c-43a6-b1b2-819f7803dbb1", "comment": "Malware payload", "value": "50ffdfa18c73ab810bbd2d70dd96c307250e0396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698639, "uuid": "75c29020-934c-49be-97f5-f16636a5ca88", "comment": "Malware payload", "value": "9ccca8266ea4ad53bf1e9d951530f1a71c74b8cb01bd30899a150f01a480da4b6f12b8ddd7a54a49febdc315bff84c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698639, "uuid": "a91e8cdd-83ac-41b2-bdd9-e11a36451eaa", "value": "T10B83D692FE81CD52C9D838BAF91F42DC3347036CC3EE75029E129A3566DF5994A3AE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698639, "uuid": "8474778f-3fbc-41c6-833d-ed141e5b9907", "value": "1536:E9jNrNjY9TvjD4Qkx3mFMg7L68woSCD8PyKdlQfS7:GqdjM93mxG8L857Qq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698639, "uuid": "ec1b573c-a8c4-40a4-bb89-8eb92dc6ac3f", "value": 82356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698639, "uuid": "59aa5bd0-3254-4be7-9403-3c548db23663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698639, "uuid": "a7b17a32-e68f-4868-b2e4-c658fa8bd30a", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c384a15-4ec8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778675787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675787, "uuid": "1bbf4aad-1e37-4497-b85d-b05d041cb4f2", "comment": "Malware payload", "value": "881151e9db0f3be17a21c75b5d4fef28", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675787, "uuid": "16b83904-599d-4e25-894f-0709fe3bd6a3", "comment": "Malware payload", "value": "efc4d09fc5b70a1e4936a19d0cd005c7d3e4834c8a100469672ce6bdb0c87fb2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675787, "uuid": "9d62d858-3f92-44d2-bbe5-3b26d908be05", "comment": "Malware payload", "value": "fa0be89639d644d1bcf0ead23c2b404f3b617152", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675787, "uuid": "5f45da59-df93-4ff0-898e-8c47eb67ef36", "comment": "Malware payload", "value": "134ad077dba12a9f159e4d6570cc7f647cc22499e558d6972e1b41a0d1878d4df12b713084ba447d2f70f6aac435cbde", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675787, "uuid": "b0f3a06f-047d-447a-98e7-490bb9392bb4", "value": "T162136C6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675787, "uuid": "1cd6937c-89df-4892-be7f-3f5d9509cd5b", "value": "768:b2XRWNGxVu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bylxtco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778675787, "uuid": "4ddf3553-bbc7-4839-9a07-cc87a02fb98a", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778675787, "uuid": "e35e0661-356a-4873-b067-d8a5ace42eba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675787, "uuid": "d513aca7-b02c-45ac-903d-37b44b6c69c0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16df1e69-4e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778637875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637875, "uuid": "b89fde61-c106-42f8-adf0-a709a7df274e", "comment": "Malware payload", "value": "8267d34403d5f92967ff238dc10dbacc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637875, "uuid": "39c747cd-0a0c-483c-ac3b-5c46b7ca4b68", "comment": "Malware payload", "value": "f0980627fd5468c7cfd7680b2770746eb31e49d9433bb335d49cc4943e0dad9f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637875, "uuid": "78156e12-4996-4d29-a675-c9be02f486f6", "comment": "Malware payload", "value": "d80376772ecd3795084b3bebcc02d4e780552fb6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637875, "uuid": "a28b37c2-0e70-4829-b2f2-6eb398fb24a4", "comment": "Malware payload", "value": "c99b1c9ab92cea355c9241ccc43ada3fc25a69b9dcf1b9044d526cd2357ae9c1765fa495f4c5a1d354902b769826b65c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "homansicloud-icu", "colour": "#262532", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637875, "uuid": "2a514f4f-12c9-4119-9ffb-6b17eb628723", "value": "T17B079E07B3A141D8D0B7C0B98AAB954BE6713406073096DF9350DB9E5F37BE0AA7B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637875, "uuid": "0394787f-f7f5-42c3-8737-487912e5c0f3", "value": "bfbff861d27f35a91d19a5a58e3fb3ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637875, "uuid": "62119475-6063-483b-adfd-b5e378c52fe9", "value": "196608:lVqCe47r12MEwpH48oc5a3ujkFlzbHOih0YvyDnGldcUF:DJ2M1R5a3Jx1yDnGldc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637875, "uuid": "eae271d2-9e74-420c-95af-531d426de164", "value": 16855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637875, "uuid": "ec4fcb85-3073-44d4-9b01-c9ef68e0c7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637875, "uuid": "2211eb79-8373-4be8-9ecc-b1b27bc81262", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac547b6-4f0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778703997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778703997, "uuid": "1616ed09-ca7d-4b3c-8b21-7c39b89214b8", "comment": "Malware payload", "value": "006b71a7c851bcca51e58132d58d7046", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778703997, "uuid": "25292196-2c8b-46f0-8f86-0984bd7f5ead", "comment": "Malware payload", "value": "f0cea16aa110cfa3a45be700377d19ab17510a8a148a042609cd6e06ca88f8a3", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778703997, "uuid": "b037cfc5-5449-4e0e-b921-ba3318071129", "comment": "Malware payload", "value": "2462c3da56be1e707d2c82c890d4ad763dc3f111", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778703997, "uuid": "e9454fe3-907a-4664-a24f-5004bc8df383", "comment": "Malware payload", "value": "efc7972fc08b588ce25a60dd1419ef1f6f7c95450bdae3a170f5aba4422f72c8f6ce81e4b70951357d26a0004a78dddc", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778703997, "uuid": "356166e6-a561-4bc9-a337-a4bddadc31d4", "value": "T1C5767D27EDB509EBE46BF2748422B601BC223C408B191BD75AE4B3145E636F45BBFB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778703997, "uuid": "24277da1-f0fc-45da-8efa-fd496455b8ed", "value": "2d1a2a3b2edbe3e08125b43db0ee5897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778703997, "uuid": "dec8d691-6d02-4694-903f-c20b2b53e3c2", "value": "49152:huk9OJIfruB5cHUJ548erH5WRt76TFeyIorHUZNDv7+gN+P4+hvCQCK20J4r4bcN:huearcGrRmHoBj9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778703997, "uuid": "18eabebc-3545-4292-8263-6a1ca0500a38", "value": 7231976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778703997, "uuid": "c2ee5fc5-f127-427f-9d51-79d775796a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778703997, "uuid": "d1af97e9-5a73-4a6a-aa2a-1ea8aa999f63", "value": "20260513_150830_federated-runtime-network_wiki_f0cea16aa1.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34151e4-4ea1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778659209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659209, "uuid": "bf23e85b-184f-4859-b2a2-bbaf8d30e517", "comment": "Malware payload", "value": "b0e6d8708721cd7b597a6c0a73709948", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659209, "uuid": "e98c37b3-02d6-45b7-8809-f0c5cc40670c", "comment": "Malware payload", "value": "f143bc9ead9f891301abdaf2788eb6630030cf1e84156130b6b4656bd14da73b", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659209, "uuid": "f500f861-16ec-4ece-b2bc-048cab82d017", "comment": "Malware payload", "value": "1d0202bdaf211db90000bc3b47fed9764aaf13fc", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778659209, "uuid": "76f4a6ca-e27e-4daa-8bcf-eb3db6bc9097", "comment": "Malware payload", "value": "21c9ccc22b20bcccc9132d1e6e385da63368abe915ed8783c952ad64434cab358bab02780d0e9219613351694598ef70", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659209, "uuid": "53adbad4-67bf-4aa1-99f5-e4cfbd7c0d1c", "value": "T1FE74122125E0CC67E8734C301FAF9EE6CA7667F943642E8F5344A69829A739C4E3C355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659209, "uuid": "a6dbe4aa-3545-4388-9b4f-1ccf55adbe76", "value": "6144:PmOP320cNWoP78HOpf1iDLl2r4G7fHT6Jlvi4dhMMdCRXcDmXuWnknhrJlYtWp:PtoPdNi/Sfz6Jw8hrdCRXxNEhPYt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778659209, "uuid": "d3bdf534-c940-4b7e-ab52-ad408a22876f", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778659209, "uuid": "198e9905-6d44-4b8d-b663-e9d1e08ac949", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778659209, "uuid": "b7b58e94-e086-448c-85bb-c9b1f638e7a8", "value": "nDocument.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6752aa1d-4ec7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778675376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675376, "uuid": "d95dcdd9-2ba8-4a22-92a0-0fb8051c3ffa", "comment": "Malware payload", "value": "30a243bc030bcc07c969a1151aa44afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675376, "uuid": "90d4c3dd-5289-4f2b-8046-95f3281310d9", "comment": "Malware payload", "value": "f196058d2595ddb2109cf81051fbae83021d76859e282f5d9c2949e783a799c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675376, "uuid": "5f159f85-d851-49f8-9bc7-51d8d218d8df", "comment": "Malware payload", "value": "a79d5f408dcf4d40f5eae4e881240ccd8dce5f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778675376, "uuid": "a7adbc95-4e15-4145-8134-7336d6e6ee74", "comment": "Malware payload", "value": "db12ac6300135cf7b851befe551f02d4594c45d0428ee0c16d6e9a9b724751803ba9dabf17dbe44a4dcb2b24207a810e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675376, "uuid": "45c2c87c-11d9-440d-999a-eeeb9ca496c9", "value": "T1880373C9BAC2B265D712B02F2E2BF496E63D0CC1F6484044FF65B4A9FD60304D97AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675376, "uuid": "d4fa6ea9-6b76-4a72-a0f1-7bc664d4a8df", "value": "768:lNyuFQjkkb+M/u8fcG5L+RWsFUB/hH0FCF6m17Xg7nO7hedsG:CuFQjkkb+58fXB+RWs20Cr17QToh0sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778675376, "uuid": "d9ee282f-3fc0-461f-9c11-28c89b223038", "value": 39891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778675376, "uuid": "e619050b-0623-41ab-99d8-e32c20040c3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778675376, "uuid": "50fcb05b-f2d2-46f9-8dc6-1b5746765690", "value": "NEW INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab8f122-4f25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778715835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715835, "uuid": "53db3ae7-bf7c-48d1-b62d-2a9f9222ea77", "comment": "Malware payload", "value": "af40135e7022f0e1f8e4afc4b6634e64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715835, "uuid": "f445ca1f-f085-4960-a3d0-d5c8d69c0aef", "comment": "Malware payload", "value": "f24c7c017c10431ba64079262c64fa40270e865a5ea53d59d1a18c3595eb9075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715835, "uuid": "9e41dce8-c880-441b-bf43-7a6555cb8dcb", "comment": "Malware payload", "value": "ff4171e0727eca04c64ccf4e70ad6dbaf9892b05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778715835, "uuid": "fb2e420e-f49e-4cdc-8f7a-750998e0be86", "comment": "Malware payload", "value": "49d526fbe4c1fe3468a91949647b06638dc093e832cdad6f655fafcc6365a47fbd1ec4ec40317a0f9a45c12e5fea0db0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715835, "uuid": "a16a81da-7508-4413-8914-db4c6760d842", "value": "T12CB31866FA14EB3FC40E83306873C75056D52CB12E925ABE3264EB9C7E3415B1E5B9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715835, "uuid": "76b433ef-b64b-4c6c-b471-ebd27271af44", "value": "3072:HqSs2wELLGqf+Z+77py9Uc7nCbCBdulHmN:Hm2wELL5fXpYUc7oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778715835, "uuid": "03bc372d-fcfb-4d8e-b37c-28ccd2f75dd6", "value": 117308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778715835, "uuid": "ec87c530-11cb-43c5-b7d5-5da820fc74a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778715835, "uuid": "f855eb17-8822-4bb1-a583-f2f0937dec34", "value": "SecuriteInfo.com.Linux.DDoS.2637.12595.15874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9854f16a-4eb7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778668586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668586, "uuid": "7673fb13-a869-45fe-8725-5e65a2203c56", "comment": "Malware payload", "value": "2021dce7006e9e3b843728a2aa4ec3fe", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668586, "uuid": "33bfec09-c5f9-4520-802a-ab2e90fa0cd9", "comment": "Malware payload", "value": "f270a80b90acb4302bb29b2f4c7436f6d7eedc4738ca63351f59f22bd59ce28d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668586, "uuid": "ccbe8296-e05f-4f4a-96ce-2f967a0c29e0", "comment": "Malware payload", "value": "069811db2accdfd56797122f2b7f3463f2bf83e6", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778668586, "uuid": "38a948fe-dc83-4fec-a635-d1713b836db7", "comment": "Malware payload", "value": "bbb5c6bf0b7179857107dc3fd47d187b08b389dc0bcbc1c666fa9853f4f07549f5d2242fae08c6cab318a353e125f175", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668586, "uuid": "b1656d1f-5980-4cc0-93a2-32a7e9e4326f", "value": "T1E0059F119F9352EAEC334935D4EA131BB8F47CD882A08E33C6670E993D43565B33B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668586, "uuid": "26a13fe4-6ec2-4fd3-a696-1ae8c2df49db", "value": "0806fca8b0297d75effda0a739b8493e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668586, "uuid": "eb5a516f-e6d5-4939-85e9-c5cd736e951b", "value": "24576:VP134HzWJZncEGahYFQw6UOMc7YNQGAR:VEzgnceeOM8YmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778668586, "uuid": "20b351ed-3077-4557-8f00-f10efb7be56a", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778668586, "uuid": "3f76f779-5365-450c-ac83-f7397fb61fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778668586, "uuid": "ef6137ec-0dcc-4a3e-b443-a20217f11c46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccee435a-4f04-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778701746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701746, "uuid": "be1b240e-b1c7-4ac4-9e11-4ed6ee597598", "comment": "Malware payload (QuasarRAT)", "value": "a3b170e1a9e66a6a3bc0ddb4c145cba5", "object_relation": "md5", "Tag": [ { "name": "DefendNot", "colour": "#02528E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701746, "uuid": "4b878275-40ec-4091-a820-5b6c1f72aec1", "comment": "Malware payload (QuasarRAT)", "value": "f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2", "object_relation": "sha256", "Tag": [ { "name": "DefendNot", "colour": "#02528E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701746, "uuid": "3361afb3-2692-427f-827e-021278430f35", "comment": "Malware payload (QuasarRAT)", "value": "7358de0962f406fa775475bf42c3695fe5800f9b", "object_relation": "sha1", "Tag": [ { "name": "DefendNot", "colour": "#02528E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778701746, "uuid": "c5d6c5b9-3121-4ddd-b639-45e9883ce69d", "comment": "Malware payload (QuasarRAT)", "value": "6e96da4d02fc91d64e884d5b86f673fb6871f0e06962812f78227db1ac36a6d3e8d14e124ecc280296fc97b8d0f10afb", "object_relation": "sha3-384", "Tag": [ { "name": "DefendNot", "colour": "#02528E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701746, "uuid": "47eb7a7c-f4ce-4b88-a366-0c0fe4470d10", "value": "T14DC5F01077F9810AF3BF5BB9ABB6144D0B77B903EA7AD39E244840990FA33509E51763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701746, "uuid": "121bb4b5-ac10-4fed-9ea2-1a9e21a7db41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701746, "uuid": "e3f8587b-04ce-4a9e-8704-a49f9c0a42a8", "value": "49152:fPu6NL4xi8/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uanU:nu6tSi8VIxpL7oZNn2Km77LrwkFWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778701746, "uuid": "c8713447-c0fe-4c5d-b728-9c562b652aaa", "value": 2718720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778701746, "uuid": "53a44da1-95b8-4dfc-b49c-8f089a8ea363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778701746, "uuid": "0c599723-3341-4ad3-ac0e-864403ecdbeb", "value": "v5fueei.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e761e7c-4ed3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778680408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680408, "uuid": "3064aae7-fdd1-46d7-9272-a4738055a132", "comment": "Malware payload (Mirai)", "value": "a595abafad46599c42da4c5d8d122dd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680408, "uuid": "e2cf7ee7-5a6d-48b1-a4b9-d979b5de93da", "comment": "Malware payload (Mirai)", "value": "f76226ce0a9490b5a8a59b7497ef085abf9252c88baac818c7e7e2d85719a53c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680408, "uuid": "f51cc9b2-2c3a-4d59-ba73-1190d68504d9", "comment": "Malware payload (Mirai)", "value": "d87fc24ebec5c37fbad5261462bccef5167db32a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778680408, "uuid": "7779b549-06df-4f0b-b1cc-7903da53c33b", "comment": "Malware payload (Mirai)", "value": "6cd6a6bd346869096b0b31b5b42c249628d220ed01af9e7de400600e62b438486f9f5f3380276d29cd1ad33838ea9dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680408, "uuid": "a4ec8d3d-1454-44d3-8af1-66c5ccd9ba69", "value": "T11713F15D5DC65EA3C5308030789F058837BD1DEAC3FBA9BF2968143DB74581A29A93CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680408, "uuid": "3650cdc2-85fc-469b-bd07-9649512d1919", "value": "768:L1W/53fzl1rPfTW1envkNyR2uVnEL3hYHeJddEqgEGa3HXYRPGDf68ss3Uozm:uxnrPfqCBVm3WHAYEXXuPGbPzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778680408, "uuid": "819b8721-520e-447b-a4f9-e89956d58118", "value": 42076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778680408, "uuid": "b859ae72-f6a4-4c47-9786-00e99bd2edf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778680408, "uuid": "dc1ad245-5872-4af1-bf50-a00e841222ab", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09154acc-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698411, "uuid": "799f73ef-0a58-4bb5-a58f-0548fd8a78af", "comment": "Malware payload (Mirai)", "value": "55bdf4f6fa0d0855fd027211e7608843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698411, "uuid": "49d57e1b-3131-4320-9130-782c263fc518", "comment": "Malware payload (Mirai)", "value": "f762a8a7d3925b8034a327d92b1156dbe6efb2a88cb26a79da0b92645b5a124a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698411, "uuid": "fb778abb-a178-4f8b-927a-ca2ffdbfe7b1", "comment": "Malware payload (Mirai)", "value": "60ac45b65ebc1e579505c341e8fab68189d68c03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698411, "uuid": "9d2908b1-6bae-4bc6-b6e9-f71ed59e10cd", "comment": "Malware payload (Mirai)", "value": "6a8a53164ecb7e2c1105fabd20c637a398e533084d3bc0f33ab12f8e987f676430c3b0e79ec76ca64a463c721d5af80d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698411, "uuid": "0344eefe-0843-4af3-8ed2-05d9ce256410", "value": "T1B244C60F6E228F7DF3A9C77447B38E25975923D626E1D681D1ACC5005F6038E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698411, "uuid": "d43fb778-1a56-48d5-bc7f-737a1d559dd2", "value": "3072:Cs4nISEK16XiOhpk1DbnHhDyL2oOKetRY4SlVpcDLTcn1F04zZsf8hQ:Cs8ISEK1tCkJB8/Uylvocr04NDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698411, "uuid": "b271de8b-e322-4c4b-afd6-2556dc9ae359", "value": 263200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698411, "uuid": "b2303a0f-66cc-4a8b-9cce-ff616f1edb5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698411, "uuid": "8896b180-5b31-441d-8bc8-5e6b7280432e", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e37ee3-4efd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778698543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698543, "uuid": "cf59b135-22e5-4de3-9552-3d0aa417a1d4", "comment": "Malware payload (Mirai)", "value": "d6359f4d8ac90a0120da80991ac399dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698543, "uuid": "9327d35c-e5e7-44de-81c4-37f8591a02a5", "comment": "Malware payload (Mirai)", "value": "f94cd5688cbfa5f536eb15e5153e5158e588da2275a21b6dba5b2622dbc7a3a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698543, "uuid": "90d6394e-0efe-4996-bdeb-d46d3fb71243", "comment": "Malware payload (Mirai)", "value": "02a4d849c7a13564e2ad7085f8922644077d438b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778698543, "uuid": "7bfda77c-ad71-4050-b7e7-e34b3a29ae40", "comment": "Malware payload (Mirai)", "value": "2f80f6e796f40987057d8caa0f44b5871abc277ec8c2fe51c02dc9376d938276326f595b3528153dfa77e266a0a7f603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698543, "uuid": "53dd9623-913d-47fa-b50c-c388781fb220", "value": "T1F7D39E97B6075858C82106F44BCB875D2B6321068F679AF77C1E323E6E3E9DB68053D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698543, "uuid": "c49f7ab4-b108-4926-8ae2-188a21e3b45c", "value": "3072:2Wb5oe1MZUFbahw+zYDqnLKgRC5G2orR1qp:DVQZUIhT8GL1C5no3qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778698543, "uuid": "9f97e1bb-885e-4fe0-a70c-e1f12bc868f3", "value": 132816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778698543, "uuid": "92abf4c4-dea9-4e15-8a5d-c475672deb5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778698543, "uuid": "cf2a6f39-53e9-4b37-8ae6-c4d273a86ef5", "value": "bot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6491f3a-4f0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778705600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705600, "uuid": "139150a8-e717-4950-90bc-b4592a254a74", "comment": "Malware payload (Mirai)", "value": "6db196b886ab40d4bc598ea9b2243e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705600, "uuid": "78ca94b3-6379-4cc8-a3f9-054a2e871ec2", "comment": "Malware payload (Mirai)", "value": "fbde93278c6b68302a0b0980d4e89cda1b8fd56efbfc0a15fa4c29903b4fbda6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705600, "uuid": "e8482f5a-f443-4d2c-886e-0b1294432a65", "comment": "Malware payload (Mirai)", "value": "80947341dd51277a26916e0a8339c0dede30c60b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778705600, "uuid": "a04992b0-5c8d-4f6e-8334-77acb0ff955f", "comment": "Malware payload (Mirai)", "value": "163f45302847149c6d0b168d19af04627582aa7d8ffb5ef7f73857d40fd7a5a1d4f547c1ad8aff4800070ffcdb88151b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705600, "uuid": "527b3839-0740-42ba-8c37-145076a7d16e", "value": "T1EEB35BA3DC26AF58D624E5B4B4718F781FA3966080476FAE64B7C2B48443DCEF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705600, "uuid": "52aba271-a36d-4bda-b485-907b7cdefb6f", "value": "1536:Jh3pprHqK7HCvKK0kxM72OwOMU3hpvgWyTHkuUQ8p/:JhZprKKb80RUOMmTIWWHkL7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778705600, "uuid": "9edc5a64-3bc2-42e4-9483-eef0ff423294", "value": 114080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778705600, "uuid": "b4b5b1fd-80a4-43ec-be18-7a88306d69b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778705600, "uuid": "88076b36-ac37-4c56-a9a9-5cca934bfce4", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13345531-4e6e-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778637010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637010, "uuid": "21a0a27d-2251-417d-b064-7afe4aa84b78", "comment": "Malware payload (LummaStealer)", "value": "8358e17be0c680fd9a4d77df883407c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637010, "uuid": "ea852080-ab74-42d2-b403-9dd3d9b3954b", "comment": "Malware payload (LummaStealer)", "value": "fe1775d86cc9365e452e8c2e59e994d959e0836a92652a2e869fd8f4208d1389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637010, "uuid": "77c70504-e7d4-4b59-b127-03b1c7aac3c1", "comment": "Malware payload (LummaStealer)", "value": "f38347b0d0bfb25cd7204286e2203df565d2d890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778637010, "uuid": "2aa4c115-25ef-4443-aebd-2bff71bd25cc", "comment": "Malware payload (LummaStealer)", "value": "8db14ca363fc730645231c2c29e29af6a5d94254bd06a510ad73860e702d6479620ce471cf914c49911a1bedf4f36610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637010, "uuid": "a8f6753c-5d51-42f7-bfe7-7cced8565bc0", "value": "T1E6F53810FEDA44F6D5435E3140BF772F6B3468098B315AABEEA07D6CA877B50683264C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637010, "uuid": "25802dc4-32c5-4f97-a4a2-72f34d19ecab", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637010, "uuid": "36d5aad5-a3aa-4ea1-a79e-c8f490ea9255", "value": "49152:otCKeHe99nv5bC/mL3sR2XxmaAbZcvDFFSbQH0:D/Henv1MqaOxJAQFFJH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778637010, "uuid": "7664c6e5-4925-45ee-a7b0-d1f2a24f0978", "value": 3423360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778637010, "uuid": "284e95db-b0f1-47fe-9256-65a8dfd4bada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778637010, "uuid": "c6ba774d-71e4-440a-9af6-544ca4d5e69c", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }